Privacy

Privacy Policy

How Leadsize handles account, workspace, enquiry and connected-mailbox data.

Last updated · 17 August 2026Contact · ralfs@leadsize.com

Plain-language summary. Leadsize is an enquiry-control service for estate agencies. When an agency connects a company Gmail or Microsoft 365 inbox, Leadsize accesses the mailbox data needed to bring relevant enquiries into the workspace, keep the enquiry history visible, and allow authorised team members to respond from the connected mailbox. We do not sell Google Workspace user data or use it for advertising.

1. Who this policy applies to

This Privacy Policy explains how Leadsize handles personal data when you visit our website, create or use a Leadsize account, join a workspace, connect an email account, or otherwise use the Leadsize service (the “Service”).

For account, website and service-administration data, Leadsize generally acts as the party responsible for deciding how that data is used. For personal data contained in customer enquiries that an estate agency imports into Leadsize, the agency normally determines the purposes of processing and Leadsize processes that data on the agency’s behalf.

Privacy questions or requests can be sent to ralfs@leadsize.com.

2. Information we process

Account and workspace dataName, email address, account identifiers, workspace membership, role and agency settings.

Connected mailbox dataMailbox address, message/thread identifiers, sender and recipient details, subject lines, message bodies, message timestamps, reply headers and related metadata required to display and manage enquiries.

Enquiry and workflow dataLead/customer details contained in enquiries, source, status, waiting time, ownership/assignment, notes or replies, and message history shown in the workspace.

OAuth and connection dataAccess and refresh tokens and connection metadata needed to keep an authorised Gmail or Microsoft 365 connection working. Tokens are not intended to be exposed to other workspace users.

Technical and security dataSession information, browser/local-storage values, logs and technical information reasonably needed to authenticate users, protect the Service and diagnose errors.

3. How we use information

to authenticate users and operate Leadsize workspaces;
to connect an agency’s authorised Gmail or Microsoft 365 mailbox;
to retrieve relevant mailbox messages and turn incoming enquiries into a shared operational view;
to reconstruct message history and show whether the latest action is required from the agency or the customer;
to allow authorised users to send replies through the connected mailbox;
to provide ownership, waiting-time, priority and workflow features;
to maintain security, prevent misuse, troubleshoot faults and improve the reliability of the Service;
to comply with applicable law and enforce our Terms.

We do not use connected mailbox content for advertising, data brokerage, credit scoring or unrelated profiling.

4. Google Workspace API data

Leadsize uses Google Workspace APIs when a workspace owner or manager chooses to connect a Gmail account. The Service may read mailbox messages and thread metadata required to import and display enquiries and may send replies through that connected Gmail account.

Leadsize’s use and transfer of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace user data is used only to provide or improve user-facing Leadsize functionality. We do not sell that data, use it for advertising, or use it to train general-purpose AI or machine-learning models.

Human access to Google Workspace user data is restricted and is not part of ordinary service operation. Access may occur only where necessary with the user’s explicit permission for support, for security or abuse investigation, or where required by law.

5. Microsoft 365 data

If an authorised workspace user connects Microsoft 365, Leadsize may access mailbox messages and related metadata through Microsoft Graph for the same user-facing enquiry-management purposes: importing and displaying enquiries, maintaining conversation context and supporting the connected workflow.

6. Legal bases

Depending on the context and applicable law, we may process personal data because it is necessary to provide the Service or take steps requested by a user, because we have legitimate interests in operating and securing the Service, because the relevant agency has instructed us to process enquiry data on its behalf, because consent has been given where required, or because processing is necessary to comply with a legal obligation.

7. Service providers and sharing

We may use service providers that support authentication, database/storage, hosting, email integrations, security and infrastructure. For example, the current Leadsize application uses Supabase-backed account/workspace and application data services and connects to Google and Microsoft when a user chooses those integrations.

We do not sell personal data. We may disclose data where necessary to operate the Service, protect users and the Service, comply with law, or as part of a corporate transaction subject to applicable legal requirements.

8. International transfers

Some technology providers may process data in countries different from the user’s or agency’s location. Where applicable data-protection law requires transfer safeguards, we will rely on an appropriate legal mechanism or the relevant provider’s lawful transfer framework.

9. Retention and deletion

We retain account, workspace and enquiry data only for as long as reasonably necessary to provide the Service, maintain security, meet legal obligations and resolve disputes. Connected-mailbox data is retained only as needed for the user-facing enquiry-management functionality for which it was obtained.

A workspace owner may request disconnection of an integration or deletion of data by contacting ralfs@leadsize.com. We will act on valid deletion requests subject to legal, security and limited backup-retention requirements.

Users can also revoke Google access from their Google Account permissions or revoke Microsoft access through the relevant Microsoft account/administrator controls. Revocation prevents future API access but does not automatically erase data already lawfully imported into Leadsize; a deletion request can be made separately.

10. Security

We use technical and organisational measures intended to protect personal data, including authenticated workspace access, role checks, protected OAuth state, restricted token storage and secure transport. No internet service can guarantee absolute security.

11. Your rights

Depending on where you are located and the role in which Leadsize processes your information, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent where processing is based on consent, and complain to a competent data-protection authority.

If your information appears in an enquiry handled by an estate agency using Leadsize, the agency may be the appropriate first contact because it normally controls that customer relationship. We will assist our customer as required by applicable law.

12. Children

Leadsize is a business service and is not directed to children. We do not knowingly invite children to create Leadsize business accounts.

13. Changes

We may update this Privacy Policy as the Service changes. The “Last updated” date at the top identifies the current version. Material changes will be communicated where required.

14. Contact

Privacy questions, data requests and integration-deletion requests: ralfs@leadsize.com.