Privacy Policy

Last updated: September 27, 2026

1. Who we are

agentlyleads is a product of CS2 Technologies Inc.(“we”, “us”), a company incorporated in Canada, Business Number 707258406RC001, at cs2technologies.ca. CS2 Technologies Inc. is the entity responsible for the AI-native CRM at agentlyleads.com and is the controller referred to below.

This policy explains how we handle personal data both as a controller (data about you, our customer — account, billing, and usage data) and as a processor (data our customers store in their CRM workspace about their own contacts and leads).

Privacy questions and data-rights requests: privacy@agentlyleads.com.

2. Data we collect as a controller

• Account data — name, email address, password hash, workspace name.
• Billing data — plan, subscription status, and payment events. Card details are held by Stripe, never by us.
• Usage and log data — IP addresses, browser/session metadata, and security logs kept to operate and protect the service.
• Support communications — messages you send us.

3. Data we process on behalf of customers

CRM records — contacts, companies, leads, deals, tasks, notes, emails, and files — belong to the customer workspace that created them. The customer is the data controller for this data; we process it only on their instructions, as described in our Data Processing Addendum. If your data appears in a customer’s workspace and you want it corrected or removed, contact that customer first; we assist them in fulfilling such requests.

4. How we use data

• To provide, secure, and improve the service (contract performance and legitimate interest).
• To bill for subscriptions via Stripe (contract performance).
• To send transactional email — sign-in verification, export links, notifications (contract performance).
• To power optional AI features, where content is sent to the AI provider the workspace has configured (see Subprocessors). We do not train models on customer data.

5. Connected Google and Microsoft accounts

You can connect a Google (Gmail, Google Calendar) or Microsoft 365 (Outlook, Outlook Calendar) account so agentlyleads can send email as you and keep your CRM in step with your mailbox and calendar. You choose what to grant on the provider’s consent screen, and each permission is used only for the feature it names:

• Send email — to send the emails, replies, and meeting confirmations you write or approve in agentlyleads from your own address.
• Read email (only if you turn on inbox sync) — to copy messages into your workspace’s shared inbox and link them to the matching contacts and leads.
• Calendar (only if you connect your calendar) — to show your busy times in the CRM calendar and on your booking page, and to add, move, or cancel meetings booked through agentlyleads.
• Basic profile (your email address) — to know which mailbox you connected.

Access and refresh tokens are encrypted at rest. We do not sell this data, use it for advertising, or let people read it, except with your permission, when needed for security or abuse investigations, to comply with law, or where the data has been aggregated and anonymised for internal operations. We do not use it to develop, improve, or train generalised AI or machine-learning models. When you use an AI feature on an email or meeting, that content is sent to the AI provider only to produce the result you asked for.

agentlyleads’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect an account at any time in Settings → Email, or revoke access from your Google account or Microsoft account. Disconnecting stops all further access; email already copied into the workspace stays with the workspace’s other CRM records and is deleted with the workspace, or sooner if an owner removes it.

6. Email suppression and deleted workspaces

When someone unsubscribes from a customer’s emails, their address goes on that workspace’s suppression list so they are not contacted again. If a workspace is deleted, we retain an irreversible SHA-256 hash of each suppressed address (with the suppression reason) for up to 2 years, so a returning customer cannot accidentally re-mail people who opted out. The hash cannot be reversed into an email address.

7. Retention and deletion

Workspace data is retained while the subscription is active. Owners can delete their workspace from Settings; deletion completes after a 7-day grace window, after which all workspace records and stored files are permanently erased (except the hashed suppression tombstones described above). Owners can also export all workspace data at any time.

8. Sharing

We share data only with the subprocessors listed at /subprocessors, with authorities when legally required, and in connection with a merger or acquisition (with notice). We never sell personal data.

9. Security

Data is encrypted in transit (TLS) and at rest. Passwords are hashed with bcrypt. Access to production systems is restricted and logged. Each customer workspace is logically isolated.

10. Your rights

Depending on your location (including under GDPR and CCPA), you may have rights to access, correct, export, delete, or restrict processing of your personal data, and to object to processing or withdraw consent. Contact us at privacy@agentlyleads.com and we will respond within the time required by law. You may also lodge a complaint with your supervisory authority.

11. International transfers

Our infrastructure runs in AWS us-east-1 (United States). Where data is transferred from the EEA/UK, we rely on Standard Contractual Clauses and equivalent safeguards, as set out in the DPA.

12. Changes and contact

We will post updates to this policy here and notify customers of material changes. Questions: privacy@agentlyleads.com.