Privacy Policy

1. Information We Collect

Depending on how you interact with us, we may collect:

• Account information: your name, email address, phone number, company/brokerage details, job title, timezone, and profile photo.
• Lead and contact information that subscribers enter or capture: names, email addresses, phone numbers, postal/property addresses, property preferences, survey responses, notes, and marketing-consent records.
• Financial and payment information: billing details and subscription history. Card payments are processed by Stripe — we do not store full payment-card numbers on our systems.
• Connected-account credentials: access tokens and metadata for integrations you choose to connect (including Facebook User Access Tokens, Page Access Tokens, Page IDs, Page names, Instagram Business Account IDs, Instagram usernames, WhatsApp Business credentials, and email credentials). These are held encrypted in AWS Secrets Manager.
• Technical and usage information: IP address, browser and device type, operating system, and application activity and audit logs.

2. How We Use Your Information

We use personal information to:

• Provide, operate, and improve the LeadAgent platform and our services.
• Authenticate and publish marketing campaigns, broadcasts, and social posts directly to your connected Facebook Pages and Instagram feeds at your direction.
• Process subscriptions and payments and manage billing.
• Send service/transactional messages and, where consent has been given, marketing communications (each of which includes an unsubscribe option).
• Provide customer support and respond to inquiries.
• Maintain security, prevent fraud and abuse, and keep audit records.
• Meet our legal, regulatory, and tax obligations.

3. Roles: Controller and Processor

For information about our own subscribers (account, billing, profile), Softurns is the organization accountable for that information.

For the lead and contact data a subscriber stores in LeadAgent, the subscriber is responsible for that information and the lawful basis to hold and contact those individuals; Softurns processes it on the subscriber's behalf to provide the service. If you are a lead and wish to access or delete your data, please contact the agent or brokerage who holds it, or contact our Privacy Officer and we will help route your request.

4. How We Share Information

We do not sell, rent, or lease personal information or social media integration credentials. We share it only with service providers that help us run the platform, and only as needed for them to perform their function:

• Stripe — payment processing and subscription billing.
• Amazon Web Services (AWS) — cloud hosting, database, and file storage (see §6, Where Your Data Is Stored).
• Meta Platforms (Facebook, Instagram, WhatsApp Business) — only when you connect those integrations, to publish or send the content you direct.
• Legal authorities — where required by law or to protect our rights, safety, or property.
• A successor entity — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Marketing and CASL

Commercial electronic messages sent through LeadAgent require consent. Subscribers are responsible for obtaining and recording consent before contacting their leads, and every marketing message we send (and that subscribers send through the platform) identifies the sender and includes a working unsubscribe link. Unsubscribe requests are honoured across all sending paths.

6. Where Your Data Is Stored

Your data is hosted in Canada, in Amazon Web Services' Canada (Central) region (ca-central-1). Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Some service providers named above (for example Stripe) may process limited data outside Canada in order to provide their service.

7. How Long We Keep Your Information (Retention)

We keep personal information only as long as needed for the purposes above, or as required by law:

• Account and CRM data: retained while your account is active.
• On account closure or a verified deletion request: personal data is erased within 30 days (see §8).
• Security and audit logs: retained for up to 12 months.
• Backups: retained on a rolling basis for approximately 35 days, after which deleted data ages out.
• Payment and tax records: retained for approximately 7 years to meet Canada Revenue Agency and other legal obligations, even after an account is deleted.

8. Your Privacy Rights

Under PIPEDA you may access the personal information we hold about you, ask us to correct it, withdraw consent, and request its deletion. You can exercise these rights as follows:

• Account deletion: signed-in subscribers can request deletion from Settings → Privacy & Data. Deletion runs on a 30-day grace period — you can cancel during that window, after which your personal data is permanently erased (payment/tax records excepted, per §7).
• Meta Integration Deletion: You can disconnect and permanently erase your Facebook and Instagram integration data from our systems at any time via Settings → Integrations, as described in the User Data Deletion Instructions.
• Lead deletion: if you are a lead, you can ask the agent or brokerage who holds your data to delete it, or contact our Privacy Officer to have your request actioned. The agent can erase the lead and all attached records, and we will help ensure it is completed.
• Access or correction: contact our Privacy Officer (§9) and we will respond within 30 days.
• Data portability: signed-in subscribers can download a machine-readable copy of their personal data (account, profile, and the leads they hold) as a JSON file from Settings → Privacy & Data.
• You also have the right to complain to the Office of the Privacy Commissioner of Canada (and, for Quebec residents, to the Commission d'accès à l'information du Québec).

9. Privacy Officer

Softurns has appointed a designated Privacy Officer, Shibu Cherian, who is accountable for our compliance with this Policy, with PIPEDA, and with Quebec's Law 25.

You can reach our Privacy Officer at privacy@softurns.com. Please direct any privacy question, access request, or complaint to this address.

10. Data Breach Notification

We maintain a documented process to identify, contain, and assess security incidents. If a breach of security safeguards creates a real risk of significant harm to affected individuals, we will notify the Office of the Privacy Commissioner of Canada and the affected individuals as soon as feasible, and keep records of breaches as required by PIPEDA.

For Quebec residents, where Quebec's Law 25 applies, we will notify the Commission d'accès à l'information du Québec (CAI) and affected individuals within 72 hours of confirming a breach presenting a risk of serious injury.

11. Data Security

We use industry-standard technical and organizational safeguards — encryption in transit and at rest, access controls, and audit logging — to protect personal information. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any issue.

12. Children's Privacy

Our services are not directed to children under 13, and we do not knowingly collect their personal information.

13. Quebec Residents — Law 25

If you are located in Quebec, Quebec's Act respecting the protection of personal information in the private sector (Law 25) applies to you in addition to PIPEDA. In particular:

• Explicit consent: we rely on your express, opt-in consent (an unchecked box you actively tick) before collecting your personal information.
• Data portability: you can obtain your personal information in a structured, commonly used, machine-readable format — see Data portability in §8.
• Deletion: you can request deletion of your personal information, processed within the 30-day window described in §8.
• Breach notification: we notify the Commission d'accès à l'information du Québec (CAI) and affected individuals within 72 hours of confirming a breach presenting a risk of serious injury (§10).
• Privacy Officer: our designated Privacy Officer (named in §9) is accountable for our compliance with Law 25.

14. Changes to this Privacy Policy

We may update this Policy from time to time. Changes are posted here with a revised effective date; continued use of our services constitutes acceptance of the revised Policy.

15. Contact Us

For any question about this Policy or our data practices, contact our Privacy Officer, Shibu Cherian, at privacy@softurns.com, or: