Privacy Policy

This Privacy Policy explains which personal data we process on leadwin.ai in all its language versions, on leadwin.help, in the LeadWin Dashboard and when operating the LeadWin agent, for what purposes we do so and what rights you have. LeadWin is a product of Feedbax. A separate privacy policy applies to the website feedbax.de.

1. Controller

The controller responsible for data processing on leadwin.ai is:

Feedbax
Owner: Armin Bossag
Holsteinstr. 10
41564 Kaarst
Germany
E-mail: [email protected]

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. Who this policy applies to

LeadWin is used in three places. Who is responsible under data protection law depends on where you encounter the agent:

• Visitors to leadwin.ai: You read this website, try out the demo agent or sign in. We are the controller. This policy applies in full.
• Customers and team members in the Dashboard: You set up and operate an agent. We are the controller for your account data. This policy applies in full; for the data of your visitors, we enter into a data processing agreement under Art. 28 GDPR with you.
• Visitors to a website on which a customer uses the agent: The operator of that website is the controller. We process your data on the operator's behalf. That website's privacy policy governs; Section 8 describes what the agent technically processes there.

3. Your rights

You have the following rights against us with regard to the personal data concerning you:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing based on Art. 6 (1) (e) or (f) GDPR (Art. 21 GDPR), including objection to direct marketing,
• right to withdraw consent you have given at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, an e-mail to [email protected] is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

If you encountered the agent on a customer's website, please direct your request to the operator of that website. We will support the operator in responding to it.

4. Hosting and infrastructure

4.1 Hosting

leadwin.ai, the Dashboard and the agent are hosted by an external service provider. The provider is UmbHost Limited, United Kingdom; the servers used are located in Nuremberg, Germany. All data collected via this website and the agent is stored on these servers, in particular IP addresses, account data, conversations, contact details and usage data. The host is used for the performance of the contract (Art. 6 (1) (b) GDPR) and in the interest of a secure and efficient provision of our services (Art. 6 (1) (f) GDPR). We have entered into a data processing agreement with the host. Storage and backups take place exclusively in Germany. The host itself is established in the United Kingdom and may access the servers administratively from there; an adequacy decision of the European Commission exists for the United Kingdom.

4.2 Cloudflare

We use Cloudflare as a content delivery network, DNS provider and protection against attacks. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Every request to leadwin.ai is routed through Cloudflare's servers; in the process, Cloudflare processes your IP address and technical connection data. The legal basis is our legitimate interest in secure and fast delivery (Art. 6 (1) (f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, the Standard Contractual Clauses of the European Commission apply. A data processing agreement is in place with Cloudflare.

4.3 Server log files

Each time the site is accessed, information is automatically stored in server log files: the page accessed, date and time, amount of data transferred, browser type and version, operating system, referring URL and IP address. This data is not merged with other data sources. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the technically error-free and secure provision of the website. Log files are generally deleted after 30 days unless they are needed for longer to investigate a security incident.

4.4 Encryption

leadwin.ai uses TLS encryption throughout. Data you transmit to us cannot be read by third parties.

5. Cookies, local storage and consent

leadwin.ai is a separate domain with its own consent management. A choice made on feedbax.de does not apply here, and vice versa.

5.1 Technically necessary storage

Without your consent, on the basis of Section 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6 (1) (f) GDPR, we use:

• a cookie that stores your choice in the cookie banner (valid for 12 months);
• a session cookie ("AuthToken") for signed-in customers and team members, valid on leadwin.ai in all its language versions, which expires when your sign-in session ends;
• entries in the browser's local storage for the display (light or dark theme) and for operating the Dashboard;
• a connection for real-time updates of the Dashboard, which ends when the page is closed.

5.2 Storage requiring consent

Only with your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG) do we use the analytics tools described in Section 6. We ask for your consent via a banner on your first visit. You can change or withdraw it at any time via the "Cookie settings" link at the bottom of every page.

6. Analytics and audience measurement (only with consent)

6.1 Google Analytics

We use Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse your use of the website (page views, time spent, approximate location, device and browser). Google truncates IP addresses in the process. The data may be transferred to servers of Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. We use Google Consent Mode: without your consent, no cookies are set and no personal data is transferred to Google. We have entered into a data processing agreement with Google. The data is deleted after 14 months.

6.2 Hotjar (Dashboard only)

In the Dashboard we use Hotjar to understand how the Dashboard is used (mouse movements, clicks, scrolling behaviour, session recordings without input content). The provider is Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta. Hotjar is loaded only after you have given your consent and only on screens with a width of at least 1200 pixels. A data processing agreement is in place with Hotjar. You can additionally object to data collection at hotjar.com/policies/do-not-track.

6.3 Visitor analytics of the demo agent

Our own LeadWin agent is embedded on leadwin.ai so that you can try it out. If you consent to analytics, in addition to the information listed in Section 8.1 it processes the sequence of pages within your visit, time spent and scroll depth, device and browser information, the origin of your visit (referring website and campaign parameters) and an approximate location derived from your IP address (country, region, city). A visitor identifier stored in the browser (valid for around 13 months) recognises returning visits; an interest score for the visit is calculated from this information. The individual data is deleted after 90 days at the latest; after that, only aggregated statistics without personal reference remain (for up to two years).

7. Demo agent on leadwin.ai

When you open the chat on leadwin.ai and enter messages, we process your input in order to respond to it. The agent works exactly like the agent our customers use on their websites; here, we ourselves are the controller. Section 8 applies, with the proviso that contact details you leave in the chat are used by us to respond to your enquiry and to contact you (Art. 6 (1) (b) GDPR, pre-contractual measures). Appointments booked via the demo agent are created in our calendar.

8. The LeadWin agent on websites

This section describes what the agent technically processes when it is embedded on a website. On leadwin.ai, we are the controller. On our customers' websites, the respective operator is the controller and we are the processor; the operator's privacy policy applies there.

8.1 Without consent: origin context

When the chat is opened, the path of the page accessed (without parameters), the host of the previously visited website (only if it is a different website) and a country of origin derived from the IP address are processed and transmitted together with the chat messages to the AI service provider used, so that the agent can respond appropriately. To derive the country, the truncated IP address is transmitted to the geolocation service ip-api.com and is not stored. No cookies are set and no identifiers are stored in the browser; page sequence, time spent and previous visits are not evaluated. The legal basis is the legitimate interest in a functioning advisory service (Art. 6 (1) (f) GDPR). This information becomes part of the stored chat history and is deleted together with it.

8.2 Chat messages and AI processing

Your messages are transmitted, together with the origin context and the knowledge sources and instructions stored by the operator, to a provider of AI language models, which generates the response. Currently this is OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, USA, via the OpenAI API. According to its own statements, OpenAI does not process API data to train its models. We call the API with storage disabled (setting "store=false"); OpenAI therefore retains inputs and outputs only for abuse monitoring, for a maximum of 30 days, and deletes them afterwards. No permanent copy of your chats is kept at OpenAI. The transfer to the USA is based on OpenAI's certification under the EU-U.S. Data Privacy Framework and, in addition, on the Standard Contractual Clauses of the European Commission; a data processing agreement is in place with OpenAI. The provider used may change; we will update this policy accordingly.

So that the agent answers in your language, we determine the language of each message. To do so, we transmit the text of the message, truncated to 1,000 characters and stripped of any web and email addresses it contains, to the language detection service detectlanguage.com operated by Web Cats UAB, Baltupio st. 57-2, LT-08322 Vilnius, Lithuania. No origin context, identifier or IP address of yours is transmitted. The service determines only the language of the text and, according to its own statements, does not store the text. Processing takes place within the European Union. The legal basis is the legitimate interest in advice in the visitor's language (Art. 6 (1) (f) GDPR).

Please do not enter any special categories of personal data (e.g. health data) or any payment details in the chat unless this is necessary for your enquiry.

Chat histories are stored by us so that the operator of the website can read and respond to enquiries in the inbox and so that the conversation can be continued. How long they are stored is determined by the operator. They are deleted when the operator deletes the agent or their account or arranges for deletion, and at the latest after the end of the operator's contractual relationship with us.

8.3 Contact details, appointment booking and verification

If you leave contact details in the chat (name, e-mail address, telephone number, company, your enquiry), these are stored and displayed to the operator of the website in the inbox so that the operator can get in touch with you. If you book an appointment via the agent, the appointment is created in the calendar connected by the operator and you receive a confirmation by e-mail. The legal basis is Art. 6 (1) (b) GDPR (initiation of a contract with the operator).

If the operator has enabled verification of contact details, you will receive a confirmation code by e-mail or SMS. To send SMS codes we use Twilio Inc., 101 Spear Street, San Francisco, CA 94105, USA (Standard Contractual Clauses of the European Commission). Your telephone number is transmitted to Twilio for this purpose.

If the operator uses Calendly for scheduling, a connection to Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA, is established when the booking step is opened; Calendly's privacy policy and that of the operator apply to this booking.

8.4 Handover to the team and live chat

The operator and their team members can take over a conversation in the inbox and reply to you directly. Whether a human is currently replying is indicated in the chat. The agent is labelled as an AI system.

8.5 Live search on the operator's website

If the operator has enabled live search, the agent may, in order to answer your question, look up individual public pages of the operator's website. To do so, the AI language model named in Section 8.2 selects suitable pages from the sitemap of the operator's website based on your question. Their addresses are then retrieved via the fetching service ScraperAPI LLC, USA, which delivers the page contents to us. Only the addresses of publicly accessible pages of the operator's website are transmitted to ScraperAPI, no message content, identifier or IP address of yours. No personal data of yours is transferred to the USA for this purpose.

8.6 Public help pages

Customers can publish their knowledge sources as a public help centre at leadwin.help or under their own domain. Our own help centre for LeadWin is at leadwin.ai/help. Sections 4 and 5.1 apply when these pages are accessed.

9. Account, sign-in and Dashboard

9.1 Sign-in

You register on leadwin.ai with your e-mail address, your name and your company, or via an account with Google, Microsoft or LinkedIn. You then sign in via a sign-in link that we send to your e-mail address, or again via that provider. If you use a provider, it transmits your name and e-mail address to us and learns that you are signing in with us. The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. If you are registered with Feedbax as a service provider, you sign in with your Feedbax account instead, via LinkedIn or a sign-in link; sign-in on leadwin.ai then takes place via a secure handover of the existing session, in which a short-lived, single-use ticket is transferred. If you are registered with Feedbax as a client, we set up a LeadWin account from your existing Feedbax session and take your name and e-mail address from your Feedbax account for this. The legal basis is Art. 6 (1) (b) GDPR.

9.2 Account data and configuration

In the Dashboard we process the data of your account (name, e-mail address, company), the configuration of your agent (instructions, knowledge sources, logos, greetings, settings), the conversations and contacts of your visitors, appointment bookings, the data of your team members (name, e-mail address, role), usage counters (conversations per month, top-up credit) and log data on security-relevant actions (time, IP address), for example when the embed code is copied. The legal basis is Art. 6 (1) (b) GDPR; for the log data, Art. 6 (1) (f) GDPR (prevention of abuse).

9.3 Team members

If you invite team members, we send them a personal sign-in link by e-mail on your behalf. Team members can see the agent's conversations and reply to them. Please invite only persons who are authorised to do so.

9.4 Knowledge sources and website import

To build your agent's knowledge base, we import content from your website at your request. For this we use the fetching service ScraperAPI LLC, USA; only the addresses of publicly accessible pages of your website are transmitted to it. If your agent shows posts from your social media profiles (LinkedIn, Instagram, TikTok, X), we import these public posts via Apify Technologies s.r.o., Vodičkova 704/36, 110 00 Prague, Czech Republic; only the address of your profile is transmitted to Apify. If you connect your Intercom help centre, we retrieve its articles from Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18–21 St. Stephen's Green, Dublin 2, Ireland, using the read-only access key you have provided. To translate content we use DeepL SE, Maarweg 165, 50825 Cologne, Germany. To link your Google Business Profile (reviews as trust signals) we use the Google Places API of Google Ireland Limited. The legal basis is Art. 6 (1) (b) GDPR.

9.5 Calendar connection (Google Calendar, Microsoft 365)

If you connect your Google Calendar or your Microsoft 365 calendar to LeadWin, we receive an access authorisation granted by you (OAuth token), which we store and which you can revoke at any time in the Dashboard or in your Google or Microsoft account. We process the data received via the Google Calendar API or Microsoft Graph (free/busy times and appointments created on your behalf) exclusively to display availability and to carry out appointment bookings. The providers are Google Ireland Limited and Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not transferred to any AI/ML models or third-party AI services and is not used to create, train, or improve AI/ML models.

9.6 E-mail notifications

We send you e-mails that are necessary for operating your agent: new enquiries and appointment bookings, sign-in links, team member invitations, notices regarding your allowance, invoices and contract changes. We send transactional e-mails via Microsoft 365 (Microsoft Ireland Operations Limited); bulk mailings via Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France). The legal basis is Art. 6 (1) (b) GDPR. We send you product information only to the extent permitted by Section 7 (3) UWG (German Act Against Unfair Competition) or where you have consented; you can object at any time.

10. Payment and contract data

For paid plans we process master data (company, billing address, VAT identification number, e-mail address), contract data (plan, term, top-up credit) and invoices. The legal basis is Art. 6 (1) (b) GDPR. We retain invoices and accounting records for the periods required by commercial and tax law (generally ten years) (Art. 6 (1) (c) GDPR).

Payment processing is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter your payment details (card or bank account details) directly with Stripe; we do not receive them, only an identifier and the payment status. Stripe processes the data to carry out the payment and for fraud prevention, in part also at Stripe, Inc. in the USA (Standard Contractual Clauses of the European Commission). Details at stripe.com/en-ie/privacy. Stripe processes the payment data as an independent controller. The legal basis is Art. 6 (1) (b) GDPR.

11. Contacting us

If you contact us by e-mail, we store your enquiry, including the contact details it contains, in order to process it and to handle follow-up questions. The legal basis is Art. 6 (1) (b) GDPR if the enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR. We delete the data once your enquiry has been fully dealt with and no statutory retention periods prevent deletion.

12. Recipients and transfers to third countries

We disclose personal data only to the extent described in this policy, where necessary for the performance of a contract, where you have consented or where we are legally obliged to do so. The service providers named process data on our behalf on the basis of data processing agreements pursuant to Art. 28 GDPR, unless they act as independent controllers (such as Stripe for payment processing or the sign-in providers).

Your account data, conversations and contact details are stored in Germany. Some service providers are based in the USA or the United Kingdom. An adequacy decision of the European Commission exists for the United Kingdom. We base transfers to the USA on the recipient's certification under the EU-U.S. Data Privacy Framework or on the Standard Contractual Clauses of the European Commission. Please note that US authorities may, under certain conditions, access data held by US companies.

13. Retention period

Unless a more specific period is stated in this policy, we store personal data for as long as the purpose of the processing exists, in particular for the duration of the contractual relationship. The contractual relationship exists for as long as you maintain a LeadWin account, including on the free plan; cancelling a paid plan does not end it. If you delete an agent or your account, we delete the associated data without undue delay; if we end the contractual relationship, we delete it afterwards. This does not apply to invoices and accounting records, which we retain for the statutory periods (Section 10). Copies in backups are overwritten in the regular rotation cycle. At your request we will also delete individual data, provided no obligations prevent this.

14. No automated decision-making

The agent does not make decisions with legal effect or similarly significant impact within the meaning of Art. 22 GDPR. The interest score of a visit, calculated with consent, serves the operator only to prioritise enquiries.

15. Changes to this Privacy Policy

We will amend this Privacy Policy if our processing or the legal situation changes. The current version can always be found at leadwin.ai/privacy. The date of the last change is shown at the top of this page.