Privacy Policy

Ledeflow · AI Breslau Sp. z o.o.

1. Who we are

Ledeflow (ledeflow.com, portal app.ledeflow.com) is a browser-based CRM for real estate agencies and small businesses. It is operated by:

AI BRESLAU spółka z ograniczoną odpowiedzialnością
ul. Maślicka 171/35, 54-104 Wrocław, Poland
NIP 8971914184 · KRS 0001001487 · REGON 523636612
Management Board: Dzmitry Babinau, President of the Management Board (Prezes Zarządu)
Privacy contact: privacy@ledeflow.com

In this policy, “we”, “us” and “our” mean AI Breslau Sp. z o.o. “Customer” means a company that uses Ledeflow; “User” means a person who signs in to a Customer’s workspace.

2. Our role: controller and processor

• Controller. We are the controller of personal data of Users and Customer contact persons that we need to provide accounts, sign-in, support, billing and security of the service.
• Processor. For data that Customers enter into Ledeflow or receive through it — leads, contacts, deals, activities, emails and ad lead form submissions — the Customer is the controller and we act as a processor on the Customer’s documented instructions under Article 28 GDPR. If you are a lead or a client of one of our Customers and want to exercise your rights, please contact that company first; we will assist them.

3. Data we process

• Account data: name, business email address, password (stored only as a secure hash), role in the workspace, language and interface preferences.
• Customer data: company details, contact persons, and contract and billing information.
• Workspace content (as processor): leads, contacts, organizations, deals, activities, notes, emails sent and received through a connected mailbox, call records and lead form submissions, as entered or received by the Customer.
• Integration data (as processor): OAuth access tokens and identifiers of connected ad accounts, pages and lead forms, and the content of lead form submissions (typically name, phone number, email address and answers to form questions).
• Technical data: sign-in events, IP address, browser type and security logs needed to protect the service. We do not record the content of emails, notes or passwords in logs.

4. Purposes and legal bases

We do not use personal data for automated decision-making that produces legal effects, and we do not use workspace content for advertising.

5. Integrations with Meta, TikTok and Google

A Customer may connect its own advertising accounts so that new leads from ad lead forms appear in its Ledeflow workspace automatically.

• Meta (Facebook / Instagram Lead Ads) and TikTok Lead Generation are connected via OAuth by an authorised person of the Customer. We request read-only access to lead form submissions and to the basic data of the advertising account and pages needed to receive them.
• Google Ads lead forms: lead form submissions are delivered to the Customer’s workspace.
• We do not create, edit, pause or delete ads, campaigns or budgets, and we do not publish anything on the Customer’s behalf.
• Access tokens are stored encrypted on our servers and are used only to fetch lead submissions.
• Lead data is delivered only to the workspace of the company that connected the account. It is not shared with other Customers.
• We do not sell, rent or share data obtained through these integrations with third parties, and we do not use it for advertising, profiling or training of models.
• When the integration is disconnected, the stored tokens are deleted. Lead data already in the workspace remains under the Customer’s control and can be deleted by the Customer or on request (see Data deletion).

6. Recipients and sub-processors

• UpCloud — infrastructure hosting; servers located in the European Union.
• Email — transactional and system email is sent from our own mail server.
• AI providers chosen by the Customer. Content Studio can use AI services (for example Anthropic, fal.ai, ElevenLabs) only if the Customer connects them with its own API keys. In that case the Customer decides what content is sent and is responsible for its relationship with that provider.
• Public authorities, where we are required by law to disclose data.

We do not sell personal data and do not share it with advertising networks.

7. Where data is stored

Ledeflow runs on a self-hosted database on servers located in the European Union. We do not transfer personal data outside the European Economic Area. If a Customer enables an AI provider located outside the EEA with its own key, that transfer takes place under the Customer’s arrangement with the provider.

8. How long we keep data

• Account and workspace data: for as long as the Customer’s account is active, and deleted within 30 days after the account is closed, unless a longer period is required by law (e.g. accounting records).
• Encrypted backups are kept for a limited period and are overwritten on a rolling basis.
• Security logs: only as long as needed for security purposes.

9. Cookies

We use only strictly necessary cookies required to sign in and keep your session secure in the portal. We do not use advertising or cross-site tracking cookies. Because these cookies are necessary for the service, no consent banner is required for them.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), encryption of integration tokens and backups, separation of data between companies enforced at database level, role-based access within each workspace, and minimal logging that excludes message content.

11. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• rectify inaccurate data;
• erasure (“right to be forgotten”);
• restriction of processing;
• data portability;
• object to processing based on legitimate interest;
• lodge a complaint with the supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

To exercise your rights, write to privacy@ledeflow.com. We respond within one month (30 days). Where we process data as a processor, we will forward your request to the Customer concerned and assist it.

12. Data deletion

This section explains how to delete data that Ledeflow received through an integration (including Meta and TikTok) or that relates to your account.

Option A — disconnect the integration in the portal

1. Sign in at app.ledeflow.com.
2. Open the lead source settings in the Ledeflow portal (CRM → Leads → Sources).
3. Select the connected account (for example Meta or TikTok) and choose Disconnect. Stored access tokens are deleted immediately.
4. To delete leads already received, delete them in the CRM, or ask us to delete all data from that integration (Option B).

You can also remove Ledeflow’s access on the platform side, for example in Facebook Settings → Business Integrations, or in TikTok For Business.

Option B — request deletion by email

Send a request to privacy@ledeflow.com from the email address associated with your account or company, stating the workspace or ad account concerned and what should be deleted. If you are a person whose data was submitted via a lead form, include the email address or phone number you used, so that we can find the record and pass the request to the company concerned.

We confirm receipt and complete the request within 30 days. Deleted data is removed from encrypted backups when those backups expire.

13. Changes to this policy

We may update this policy when the service or the law changes. The current version is always published on this page, with the date of the last update below. Material changes are communicated to Customers in advance.

14. Contact

Privacy questions: privacy@ledeflow.com
General: dev@ledeflow.com
Post: AI Breslau Sp. z o.o., ul. Maślicka 171/35, 54-104 Wrocław, Poland

Last updated: 13 October 2026