Quick Lead — Privacy Policy

← Back to app

Privacy Policy

Last updated: 16 June 2026 (self-service deletion disclosure added; sub-processor retention windows clarified)

Quick Lead is designed with privacy first. Your day-to-day app data lives on your own device first, but several categories ARE stored on our servers to make the product work: your account profile, jobs you save (cloud-synced to Firestore), inbound emails routed via Postmark, certificates you save, public booking requests submitted by your clients, encrypted SMS gateway credentials (when you choose to add them), Web Push subscription endpoints, your last-signin IP for abuse detection (24h–90d retention), and short-lived attack-signal logs (CSP reports, honeypot triggers, CORS rejects — 24h retention). Each category is listed below with retention and legal basis. You can export everything via Settings → Export My Data, or request deletion any time.

Who we are

Quick Lead is a job management app for tradespeople, operated by Quick Lead. For privacy enquiries contact: support@quicklead.app

What data we collect and why

Your engineer details (name, company, phone, email, Gas Safe / NICEIC number)

Job data (addresses, tenant names, phone numbers, job descriptions)

Authentication

Security log — sign-in IP and browser

Third-party services

Firebase / Google Cloud (authentication & data storage)
Firebase Authentication stores your email address, a salted hash of your password, the emailVerified flag, account creation timestamp, last sign-in timestamp, and provider list. Firestore stores your job, certificate, and account data. Both persist until you request deletion. Google's privacy policy applies: policies.google.com/privacy

Note: Firebase Authentication metadata (emailVerified, last sign-in timestamp, creation timestamp) persists until you exercise the right to erasure above. We delete the Authentication account as part of our standard erasure response.

Anthropic (Claude AI)
When you parse a job email, the email content is sent to Anthropic's Claude API to extract job details. Anthropic's privacy policy applies: anthropic.com/privacy

VoodooSMS (SMS gateway)
Quick Lead uses VoodooSMS to deliver outbound SMS messages — chiefly on-my-way alerts to customers, booking confirmations, appointment reminders and (where the engineer has not configured a personal key) new-booking alerts to the engineer themselves. Two modes are supported:

Data sent to VoodooSMS per message: recipient mobile number (E.164), sender ID (max 11 chars, e.g. your trading name or Job Booking), and the full message body. Message bodies typically contain the customer's first name, the appointment date and time, the engineer's first name, and an absolute URL to the public booking page or reschedule link. Customer addresses, prices, certificate data and email contents are never sent to VoodooSMS.

Lawful basis (UK GDPR Art.6(1)(b) / Art.6(1)(f)): messages to customers rely on the engineer's contract with the customer (Art.6(1)(b)) and on soft opt-in — the customer supplied their number when requesting the job and reasonably expects appointment-related SMS. Messages to the engineer rely on Art.6(1)(b) (contract with Quick Lead). Marketing SMS are not sent.

Retention at VoodooSMS: approximately 30-90 days for delivery metadata (recipient number, sender ID, status, timestamps) and a shorter window (typically a few days) for actual message body content, per their then-current published policy: voodoosms.com/privacy-policy. Quick Lead does not retain copies of sent SMS bodies after delivery confirmation; recipients can request VoodooSMS-side erasure directly under UK GDPR Art.17.

Stripe
If you add a Stripe payment link to invoices, payments are processed directly by Stripe. Quick Lead does not handle payment card data. Stripe's privacy policy: stripe.com/gb/privacy

Data retention

Data storage and security

Your rights (GDPR)

Under UK/EU GDPR you have the right to:

To exercise any right or raise a concern, contact: support@quicklead.app

Self-service account deletion

You can permanently erase your Quick Lead account from inside the app at any time. You do not need to email us first — the in-app flow runs the same server-side erasure we would run manually, but instantly.

How to delete your account

You are signed out automatically and returned to a confirmation page. The action is rate-limited to 3 attempts per hour per account, and we require a recent password sign-in (within the last 5 minutes) for the destructive step.

What we delete immediately

What may persist briefly

Can I rejoin?

Yes. You can sign up again with the same email address straight away — deletion frees the Firebase Authentication record immediately. Your @mail.quicklead.app handle enters a 90-day cooling-off period to protect against hijacking; if you rejoin with the same email within those 90 days you can reclaim it instantly, otherwise it returns to the public pool after 90 days. The new account is completely fresh: there is no recovery, no archive, no restore.

Your customers' data

For the records you create inside Quick Lead — your customers' names, addresses, phone numbers, tenancy details and certificate test results — you are the data controller under UK GDPR, and Quick Lead is the data processor acting on your instructions. The full controller / processor terms (Article 28(3) of UK GDPR) are set out in our Data Processing Agreement, which you accept at signup. When you delete your account, every customer record you have ever stored in Quick Lead is wiped along with the rest. You remain responsible for honouring any subject access or erasure requests received directly from your own customers before you delete the account.

Cookies and local storage

Quick Lead does not use tracking, analytics, or advertising cookies. We use:

Bot protection

Our public booking form may use Cloudflare Turnstile to distinguish real customers from automated bots. Turnstile is a CAPTCHA replacement designed by Cloudflare to be privacy-friendly: it does not show puzzles, does not track users across the web, and is designed to comply with UK-GDPR. Turnstile does collect limited browser characteristics (such as user-agent and timing signals) at the moment you submit the booking form, processed by Cloudflare under its own privacy policy at cloudflare.com/privacypolicy.

Children's privacy

Quick Lead is intended for use by tradespeople and business owners. We do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy from time to time. The date at the top of this page will reflect any changes. Continued use of the app after changes constitutes acceptance.

Contact

For any privacy questions: support@quicklead.app