Privacy Policy

1. Who we are

ChatLead is operated by Lister Labs Pty Ltd, an Australian company trading as ChatLead (“ChatLead”, “we”, “us”). ChatLead gives businesses an AI receptionist for their website chat and phone, with lead capture, lead alerts and a simple CRM, through chatlead.io and app.chatlead.io.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We also aim to treat people in the United States, the United Kingdom, Canada and New Zealand fairly under the privacy laws that apply to them. If you have a question about this policy, email hello@chatlead.io.

2. The two ways we handle information

For our own customers and visitors. When you visit our website, chat with Mia, request a demo, create an account, or use and pay for ChatLead, we decide how your information is used. This whole policy applies to you.

For our customers’ callers and website visitors. When a business uses ChatLead to answer its website chat or phone, we collect and store information about the people who contact that business on the business’s behalf, following its settings. The business decides what its assistant asks, who receives alerts, what it connects ChatLead to and how it follows up. If you contacted a business through ChatLead, please ask that business first about your information. We will help it respond, and you can also contact us.

3. Information we collect

When you visit our website

Our hosting provider receives your IP address with each request and tells us which country you are in, which we use to show prices in your currency. To stop abuse we count requests per visitor, storing a scrambled (hashed) form of the IP address rather than the address itself. Google Analytics collects information about the pages you visit and your device (see Cookies and analytics).

When you chat with Mia on our website

Your messages and anything you tell Mia, such as your name, email address and what your business needs. If you ask Mia to get you started, we email you a secure setup link.

When you request a demo

Your name, email address, business name and type of business, and your website, phone number and message if you add them. We save the request as an enquiry in our own ChatLead account and email it to our team.

When you create and use an account

• Your email address and, if you give it, your name.
• The business details you give us or Mia during setup, such as your business name, website, country, time zone, opening hours, services and answers to setup questions. If you give us your website address, we read its public pages to suggest answers.
• Your assistant’s greeting, instructions and knowledge base, and the email addresses and mobile numbers you choose to receive lead alerts and call summaries.
• Records of how you use ChatLead, such as usage counts against your allowances, your trial and subscription status, and settings changes.
• Messages you send us for support.

When you set up a phone number

Phone regulators require identity details before a local number is issued. We collect your business’s legal name, registration number, address and contact email, and any other details or documents the regulator asks for, and send them to Twilio for review.

When you pay

Stripe collects your card details, and your billing address where it is needed, on its own secure checkout and billing pages. We never receive your full card number. We keep your Stripe customer and subscription references, plan, price, currency, status and billing dates.

When you connect other apps

If you connect an accounting app (Xero, MYOB, QuickBooks or FreshBooks) or a webhook, we keep the connection details, with access tokens encrypted, and a record of what we sent.

If you are a ChatLead partner

Your partner profile, referral codes and commission records. If you create a demo for a prospect, we keep the prospect business’s name and public website, and any email address or phone number you enter for them.

4. Information about our customers’ callers and visitors

We collect the following on behalf of the businesses that use ChatLead.

• Website chat: the messages a visitor types and the details they share, such as their name, email address, phone number, company, website, what they need, timing, budget and preferred contact method. Each chat is saved as a conversation. A chat with contact details becomes a lead and a contact in the business’s dashboard. To prevent abuse, we count messages per visitor using a scrambled form of their IP address.
• Enquiry forms in the chat: the answers a visitor gives to the business’s questions, once the visitor reviews them and agrees to share them.
• Phone calls: the caller’s phone number, the number they called, call times, length and status, a written transcript of what the caller and the AI receptionist said, an AI-written summary, and details the caller gives, such as their name, email address and reason for calling.
• Onboarding links: if a business sends its own customer a ChatLead onboarding link, the answers that customer gives.

These details are sent to the email addresses and verified mobile numbers the business chooses for alerts and summaries, and to any webhooks or apps the business connects. We use this information only to provide ChatLead to that business, keep the service secure and meet legal obligations. We do not use it to market to those people.

5. How we use information

• To provide ChatLead: answer chats and calls, save leads and conversations, send alerts, summaries and sign-in links, and run your dashboard.
• To manage trials, subscriptions, credits and refunds, and to apply plan allowances.
• To send service messages, such as when a trial is ending or a trial phone number is about to be released.
• To give support and reply to demo requests.
• To keep ChatLead secure and prevent fraud and abuse.
• To understand how people find and use ChatLead, so we can improve it.
• To meet our legal obligations, such as tax and record-keeping laws.

We send trial emails with setup tips, trial results and subscription reminders only if you agree to receive them. You can turn them off at any time from the link in each email or in Billing. We do not sell personal information, and we do not use your data, or your customers’ data, to train AI models.

6. How our AI uses personal information

To reply to chats and calls, pick out contact details and write summaries, we send the conversation and the relevant business information to OpenAI. The same applies when Mia answers questions or helps you set up.

ChatLead’s AI does not make decisions with legal or similarly significant effects on anyone. It answers questions, collects details and writes summaries, and the business decides how to follow up. AI can make mistakes, so businesses can review every conversation, transcript and lead in their dashboard.

7. Who we share information with

We use these service providers to run ChatLead:

• Supabase: our database and sign-in system.
• Vercel: hosting for our website and app.
• OpenAI: AI replies, summaries and setup help.
• Twilio: phone numbers, calls, speech-to-text, SMS alerts and phone number verification.
• Mailgun: sending our emails, such as sign-in links and lead alerts.
• Stripe: payments, invoices and the billing portal.
• Google Analytics: website and app analytics.

Apps a business chooses to connect. If a business connects Xero, MYOB, QuickBooks, FreshBooks or its own webhooks, we send them what the business sets up, such as lead details, quotes, call summaries and transcripts. For the GreekHomes property marketplace’s assistant, we look up public property listings on GreekHomes; we do not send GreekHomes visitors’ contact details.

Partners. If you sign up through a partner’s referral link or demo, that partner can see your email address, plan, monthly price and when you subscribed, so they can be paid commission. Partners cannot see your conversations, leads, calls or CRM records.

Your team. People your business gives access to its ChatLead account can see its records.

When the law requires it. We may disclose information to comply with the law or a valid request from a court, regulator or law enforcement, or to protect people’s safety. If ChatLead is sold or merged, information may pass to the new owner under this policy.

8. Where information is stored and processed

ChatLead is run from Australia, but most of our service providers store or process information outside Australia. Our main database is hosted by Supabase in Seoul, South Korea. OpenAI, Twilio, Mailgun, Stripe, Google and Vercel process information mainly in the United States, and some also use other countries where they or their suppliers operate. Apps a business connects process information wherever those providers operate.

We use established providers and give each one only the information it needs for its part of the service. Disclosing information overseas does not change how we handle it under this policy.

9. Cookies and analytics

We use these cookies to make ChatLead work:

• Sign-in cookies from Supabase keep you signed in to your dashboard.
• chatlead_business_id remembers which business you are viewing, for up to a year.
• chatlead_setup_token holds your setup link while you finish creating your account, for up to 24 hours.
• chatlead_mia_session keeps your conversation with Mia on our website, for 7 days.
• chatlead_live_demo is used by partners presenting a live demo.
• Accounting connection cookies protect the step where you connect an accounting app, for 10 minutes.

On our website, in the dashboard and on the onboarding pages businesses send their customers, we use Google Analytics. It sets its own cookies to measure visits, and receives the address of each page you view, with any personal details and one-time links removed from it first, and the campaign tags of the link you arrived from. It also records events such as sign-ups, completed setup, trial starts and subscriptions (with the plan, price and Stripe subscription reference, but not your name or email address). We also keep small notes in your browser so the same event isn’t counted twice and help tips you close stay closed. You can block or delete cookies in your browser settings, or use Google’s Analytics opt-out browser add-on. Blocking sign-in cookies will stop you signing in.

The ChatLead chat widget on businesses’ websites does not set cookies.

10. How long we keep information

We keep your account, business settings, leads, conversations, call transcripts, summaries and CRM records while your account exists, because they are your business records. We do not delete them automatically. A business can ask us to delete its records, or its whole account, at any time.

Some information has a set life:

• Sign-in and setup links expire after 24 hours and work once.
• Your Mia conversation can be picked up again in the same browser for 7 days. We keep the conversation itself, as described below.
• Onboarding links a business sends its customers expire after 7 days.
• Our record of events sent to connected webhooks is deleted after 30 days, once delivery has finished.
• Request counters we use to limit abuse hold only scrambled identifiers or account IDs, not IP or email addresses, and reset within a day at most.

If you chat with Mia or request a demo but don’t create an account, we keep the conversation, the details you gave us and any setup link we emailed you (after it expires) so we can follow up and pick up where you left off if you come back. We don’t yet delete these on a schedule. Ask us at hello@chatlead.io and we will delete them.

When an account is deleted, we delete or de-identify its information within a reasonable time. We keep billing records for as long as tax and accounting laws require (in Australia, generally five years), and Stripe keeps payment records under its own obligations.

11. How we protect information

• Information travels over encrypted (HTTPS) connections.
• Database access rules keep each business’s records available only to the people it gives access to.
• Access tokens for connected apps are stored encrypted.
• Sign-in and setup links are stored only in a scrambled form that can’t be turned back into the link, and each can be used once.
• We check that calls, texts and payment updates genuinely come from Twilio and Stripe.
• Our team accesses customer records only when needed to run, support or secure ChatLead.

No system is completely secure. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. If you think your account is at risk, email hello@chatlead.io straight away.

12. Access, correction and deletion

You can see and change most of your account and business details in your dashboard. You can also email hello@chatlead.io to:

• get a copy of the personal information we hold about you;
• correct information that is wrong, out of date or incomplete;
• delete your information or close your account; or
• stop trial and marketing emails.

We will confirm who you are before acting and reply within 30 days. We may need to keep some records, such as billing records, where the law requires. You can browse our website and ask Mia questions without telling us who you are, but we need an email address to create an account. Anyone receiving SMS alerts can reply STOP to stop them.

Depending on where you live, you may have more rights, such as to object to or restrict certain uses of your information, or to receive it in a portable format. Ask us and we will respond as the law where you live requires. We will not treat you differently for using your privacy rights.

If you contacted a business through ChatLead, ask that business first. It controls those records, and we will help it answer your request.

13. Complaints

If you have a concern about how we have handled your information, email hello@chatlead.io. We will look into it and reply within 30 days.

If you are not satisfied with our answer, you can complain to your privacy regulator:

• Australia: the Office of the Australian Information Commissioner at oaic.gov.au
• New Zealand: the Office of the Privacy Commissioner at privacy.org.nz
• United Kingdom: the Information Commissioner’s Office at ico.org.uk
• Canada: the Office of the Privacy Commissioner of Canada at priv.gc.ca
• United States: the attorney general or privacy regulator in your state.

14. Children

ChatLead is a service for businesses and is not meant for children. You must be 18 or older to create an account, and we do not knowingly collect children’s information for our own purposes. The people who call or chat with a business may include young people; that business is responsible for handling their information appropriately. If you think a child has given us information, email hello@chatlead.io and we will delete it.

15. Changes to this policy

We will post any update here with a new effective date. If we make a significant change, we will tell account holders by email or in the dashboard before it takes effect. Our Terms of Service and Refund & Cancellation Policy explain the rest of our agreement with you.

16. Contact us

Lister Labs Pty Ltd trading as ChatLead. Email hello@chatlead.io about privacy, access, correction, deletion or complaints.