Leadavie — Privacy Policy

Leadavie

Leadavie is a lead-management service operated by Luhwah Web Services Ltd. Businesses (our customers) use it to keep track of enquiries their own customers send them.

Two different people appear in this policy, and the difference matters. A customer is the business paying for Leadavie. A visitor is a member of the public who enquired with that business. For a visitor's personal information, the business is the data controller and Leadavie is its processor — we hold the data on their instructions.

What we collect, and why

From visitors to our customers' websites

Contact details a visitor types into a form themselves — name, email address, phone number, and the answers to whatever the business asked. This is the enquiry itself.
Pages viewed, time on page, and how the visit arrived (the referring site and any campaign tags on the link), used to score how engaged an enquiry is and to tell the business which of their marketing is working.
A first-party identifier stored in the browser so repeat visits join up.
An approximate origin derived from the IP address. The IP address itself is never stored — only a salted one-way hash of it, which cannot be turned back into an address.

What we deliberately do NOT do

We do not identify anonymous visitors. We buy no data from brokers and use no identity-graph service, so a person who never types their details into a form stays anonymous to us. We honour Do Not Track and Global Privacy Control both in the browser and again on our servers.

Facebook and Instagram lead ads

A business using Leadavie may connect its own Facebook Page so that enquiries submitted through Facebook or Instagram lead forms arrive in Leadavie alongside the rest. This is optional and off unless the business switches it on.

What we receive from Meta	Why
The answers the person gave in the lead form (name, email, phone, and the business's own questions), and the name of the advert campaign	This is the enquiry. It is the reason the business connected the Page.
The Page's identifier and name	To know which business an arriving enquiry belongs to.
An access token for that Page	To read new lead-form submissions. Stored on our server only, never sent to a browser.
The app-scoped identifier of the person who connected the Page	So that if they later ask Facebook to delete their data, we can find and remove what they authorised.

Read-only, and narrow. We request only the permissions needed to read that Page's lead forms. We do not post anything, do not read or manage adverts, do not see advertising spend, and have no access to the ad account — including when an outside agency runs the ads.

If you connected a Facebook Page and want that removed

Two routes, both of which work:

Inside Leadavie: Integrations → Facebook → Disconnect. This removes the stored access token immediately and stops any further enquiries arriving.
From Facebook: remove Leadavie under Settings & privacy → Settings → Apps and websites. Facebook then notifies us automatically, and we delete the stored access token, the Page identifier and your app-scoped user identifier, and show you a confirmation code.

Either route deletes the connection. It does not delete enquiries already in the business's pipeline, because those belong to the business and not to the staff member who set the connection up. If you are a member of the public who wants your own details erased, use the route below — it needs no Facebook account and is not limited to Facebook.

Erasing a visitor's personal information

Any member of the public can erase themselves, at any time, without asking anyone. Visit the opt-out page and enter an email address and/or a phone number. Every matching record is deleted, and the contact is added to a permanent suppression list so it cannot be captured again. Because only salted one-way hashes are kept, the suppression survives without us storing the address itself.

Per-device opt-out is also available: add ?lv_optout=1 to any page URL on a tracked site, and that browser stops being tracked.

How long we keep things

Anonymous visitors and old page history: automatically deleted after 180 days.
Enquiries: kept while the business is a customer and needs them, then deleted with the account. A business may delete any individual record at any time.
Facebook lead-form answers: Meta itself deletes these after 90 days; the copy in Leadavie follows the rules above.

Who we share with

We do not sell personal information and never will. Data is shared only with services a business has themselves connected — such as their own CRM, booking system or practice-management system — and with the suppliers who host and deliver the service on our behalf.

Your rights

You may request access to, correction of, or erasure of your personal information, and may object to processing. The self-service erasure above is the fastest route. Otherwise write to us and we will respond within the time the law allows.

Contact

Luhwah Web Services Ltd — privacy@luhwah.com
For how tracking works in plain language, see the data & privacy FAQ.

If you are a business using Leadavie, this policy describes what we do as your processor; you remain the controller of your own customers' information and should describe this collection in your own privacy notice.