Privacy Policy

1. Introduction

Lokal Media LLC, doing business as Fresh Leads Marketing (“Fresh Leads,” “we,” “us,” or “our”), operates the Fresh Leads Client Portal (the “Portal”), a web-based platform provided to our marketing services clients for the purpose of managing advertising campaigns, viewing performance analytics, managing customer relationship (CRM) data and customer re-engagement, operating client websites and a consumer customer application, accessing AI-powered tools, and managing billing for optional add-on services.

This Privacy Policy describes how we collect, use, store, share, and protect personal information when you use the Portal. By accessing or using the Portal, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Account Information

When your account is created by a Fresh Leads administrator, we collect and store the following: your full name, email address, assigned role (e.g., client owner, staff member), and an optional profile avatar. You do not create your own account — accounts are provisioned by our team during the onboarding process.

2.2 Authentication Data

We use Supabase Authentication to manage login sessions. When you sign in, we store a secure authentication token in an HTTP-only cookie on your browser, along with your assigned role and client identifier. Passwords are hashed and managed by Supabase — we never store plaintext passwords.

2.3 Business Information

For clients using the Portal, we store business-related information including: your business name, location, advertising platform account identifiers (Google Ads Customer ID, Facebook Ad Account ID), CRM platform identifiers (GoHighLevel Location ID), and POS system connection credentials. Sensitive credentials such as API keys and POS system passwords are encrypted at rest using AES-256-GCM encryption.

2.4 Advertising Performance Data

The Portal displays aggregate advertising metrics from your Google Ads and Facebook/Instagram Ads accounts. This data includes campaign-level metrics such as impressions, clicks, cost, conversions, click-through rates, cost-per-click, and cost-per-lead. This is aggregate performance data only — we do not import or store the personal information of your individual customers from these advertising platforms.

2.5 Billing and Payment Information

If you use optional paid features (AI Chatbot or AI Voice Bot), payment processing is handled entirely by Stripe, Inc. We do not store your full credit card number, CVV, or other sensitive payment card details on our servers. We retain your Stripe Customer ID, payment method identifier (for auto-reload functionality if you enable it), and transaction records including amounts, dates, and descriptions for accounting purposes.

2.6 AI Chatbot and Voice Bot Data

If you use the AI Chatbot or AI Voice Bot features, we store conversation transcripts, call metadata (duration, timestamps), and AI-generated analysis (sentiment, summaries). Chatbot conversations are processed by Anthropic (Claude AI). Voice calls are processed by Retell AI. These services receive conversation content to generate responses but do not use your data to train their models. See Section 5 for details on third-party data sharing.

2.7 Usage and Activity Data

We log activity within the Portal for security and operational purposes, including login timestamps, actions taken (e.g., marking onboarding tasks complete, sending messages), and IP addresses used during authentication for rate-limiting purposes. We do not use third-party analytics or tracking services on the Portal.

2.8 Cookies

The Portal uses the following essential cookies, which are strictly necessary for the Portal to function. We do not use advertising cookies, analytics cookies, or tracking pixels.

• auth_token — Secure, HTTP-only authentication session token (expires after 7 days)
• user_role — Your assigned access role for routing purposes (expires after 7 days)
• user_client_id — Your assigned client identifier for data scoping (expires after 7 days)

2.9 Your Customers' Personal Data (CRM, Re-Engagement & Customer App)

Where you connect your laundry point-of-sale (POS) system, CRM (GoHighLevel), and/or enable the customer re-engagement and consumer Customer Application (PWA) features, the Portal retrieves, stores, and processes the personal data of your customers in our databases. This may include their names, email addresses, phone numbers, loyalty/account or card identifiers, account balances, and visit, usage, and spend history. We use this data to build CRM segments, tag and re-engage lapsed customers (with campaigns delivered through your GoHighLevel account), produce analytics, and operate the Customer App.

As to this customer data, you are the data controller and we act as your service provider/processor, handling it solely to provide the Services and only on your instructions. We do not sell it, use it for our own marketing, or share identifiable customer data across clients (we may use aggregated and de-identified data as described in Section 3 below). You are responsible for having the rights, consents, and privacy notices needed to provide this data to us (see also Section 5 of your Marketing Services Agreement). End customers using the Customer Application are covered by a separate, consumer-facing privacy notice presented within that application.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To authenticate you and provide secure access to the Portal
• To display your advertising campaign performance data
• To process payments for optional add-on services (AI Chatbot, AI Voice Bot)
• To provide AI-powered chatbot and voice bot services on your behalf
• To synchronize, segment, and tag your customer data for CRM and customer re-engagement campaigns
• To operate your client website and the consumer Customer Application (PWA)
• To manage your client onboarding and account setup
• To facilitate internal messaging between you and the Fresh Leads team
• To generate performance reports and analytics dashboards
• To detect and prevent unauthorized access, fraud, and abuse
• To comply with legal obligations and enforce our Terms of Service

Aggregated and De-Identified Data. We may create and use data that has been aggregated or de-identified so that it cannot reasonably be used to identify you, any individual, or any customer, in order to operate, secure, develop, benchmark, and improve our services, models, and AI features, including across our client base, both during and after your engagement. We do not attempt to re-identify this data or present it in a way that identifies you.

4. Data Storage and Security

Your data is stored on Supabase-hosted infrastructure (PostgreSQL database) with encryption in transit (TLS 1.2+) and at rest. Sensitive credentials (API keys, POS system passwords) are additionally encrypted using AES-256-GCM before storage.

Payment data is processed and stored by Stripe in compliance with PCI DSS Level 1 standards. We do not store raw credit card numbers on our infrastructure.

Access to the Portal is protected by password-based authentication with rate limiting (5 login attempts per minute per IP address). API endpoints enforce role-based access control — client users can only access their own data, and all administrative actions require verified admin credentials.

While we implement commercially reasonable security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your information.

If we become aware of a confirmed unauthorized acquisition of personal data within our systems, we will notify affected clients without undue delay and cooperate in reasonable mitigation efforts.

5. Third-Party Service Providers

We share information with the following third-party service providers who assist us in operating the Portal. Each provider processes data only as necessary to perform their specific function:

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We may add or replace sub-processors as the Portal evolves. We will post material changes to this list on this page and update the “Last updated” date above.

6. Data Retention

We retain your information for as long as necessary to provide the Portal services and fulfill the purposes described in this policy:

• Account data: Retained for the duration of your active client relationship with Fresh Leads Marketing, plus 90 days after termination to allow for account reactivation or data export.
• Billing and transaction records: Retained for 7 years to comply with accounting and tax obligations.
• Advertising performance data: Retained for the duration of our service agreement to provide historical reporting.
• AI conversation transcripts: Retained for 12 months unless you request earlier deletion.
• Activity logs: Retained for 12 months for security and auditing purposes.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Data Portability: Request your data in a commonly used, machine-readable format.
• Opt-Out: We do not sell personal information. We do not use your data for targeted advertising.

To exercise any of these rights, contact us at info@freshleadsmarketing.com. We will respond to verifiable requests within 45 days.

8. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). We do not sell or share your personal information for cross-context behavioral advertising. You have the right to know what personal information we collect, the right to delete your personal information, and the right to non-discrimination for exercising your privacy rights. To submit a request, email info@freshleadsmarketing.com.

9. Children's Privacy

The Portal is a business-to-business platform and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting a notice within the Portal and updating the “Last updated” date above. Your continued use of the Portal after such changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at: