Privacy Policy

This Policy explains how Leadica Limited ("Leadica", "we", "us") handles personal information in Signature HQ, including our website, app, Outlook add-in and related services (the "Service"). We comply with the New Zealand Privacy Act 2020 and, where they apply, other privacy laws such as the Australian Privacy Act 1988 and the GDPR.

Summary

We never read, store or route the content of your emails, attachments, inbox or calendar.
We use staff details only to build and apply email signatures.
We do not sell personal information, use it for advertising, or allow it to be used to train AI models.
Customer organisations control their staff data and can ask us to export or delete it.

1. Our two roles

Our own customers and visitors. For account holders, website visitors, trial sign-ups, enquiries and billing, we decide how information is used and are responsible for it.
Customer staff data. For staff details a customer adds or syncs from Microsoft 365 or Google Workspace, we hold the information on the customer's behalf (as an agent under section 11 of the Privacy Act 2020, or a processor under the GDPR). The customer is responsible for it. If you are a staff member, please contact your employer first; we will help them respond.

2. What we collect

Account holders. Name, email address, role, organisation, sign-in details (passwords are stored securely by our authentication provider and never in plain text), two-factor settings, and security logs such as sign-in time, IP address and browser.

Staff records. Name, job title, department, email address, phone numbers, office address, headshot, social and meeting links, and signature and rollout settings. Some of these are synced from the customer's Microsoft 365 or Google Workspace directory.

Brand content. Logos, colours, banners, templates and disclaimers.

Microsoft 365 and Google Workspace connections. The directory list of users and basic profile fields, organisation details such as tenant ID and domain names, and the signature setting of mailboxes the customer switches on. For the Outlook add-in, the signed-in user's name, email address and Microsoft account identifier, used to find their approved signature. For Google Workspace, we read the staff list and read and set only the signature on the included user’s Gmail send-as address. We never read mail or access other Gmail settings. Before first deployment we keep a private server-only copy of the original signature so removal can restore it; the copy is deleted after successful removal or organisation closure. Google domain-wide tokens are short-lived, are not cached, and are not included in audit logs; per-user Google tokens are not stored. We never receive Microsoft or Google passwords.

Link clicks. When someone clicks a tracked link in a signature (such as a banner, button or meeting link), we record the time, which link and signature, the destination, the browser type (user agent) and the referring page. We do not record the clicker's email address, and click records do not store their IP address. We do not use tracking pixels or record email opens.

Add-in diagnostics. Troubleshooting events such as mailbox address, Outlook platform and version, the step reached, and error details.

Website visitors. The homepage signature preview runs in your browser and what you type is not stored. Our hosting providers keep standard server logs (such as IP address, browser and pages requested) for security.

Trial sign-ups and access requests. Name, email address, organisation, domain, and anything else you enter. When you set up an organisation, we may fetch public branding such as your logo and colours from your website.

Support. Messages and any screenshots or details you send us.

Billing. Billing contact, billing address, plan, subscription status, invoices and payment history. Card details are entered directly with Stripe and are never stored on our systems.

3. What we do not collect

The content, subject lines, attachments or recipients of your emails, or your contacts and calendars.
Microsoft or Google passwords.
Sensitive information. Signatures should not contain it.

4. How we use information

To provide the Service: build, preview, approve and apply signatures, sync staff, run scheduled banners and show click reports.
To keep the Service secure: sign-in, two-factor authentication, rate limits, audit logs and fraud prevention.
To provide support, onboarding and any managed services you engage Leadica for.
To send service emails such as invitations, sign-in and password emails, and account or billing notices.
To improve the Service, using aggregated or de-identified usage information.
To send account holders news about Signature HQ or Leadica. You can unsubscribe at any time. We never use customer staff data or email recipients' details for marketing.
To meet our legal obligations.

We share information only with providers that help us run the Service, under contract and only as needed:

Supabase (through Lovable Cloud): database, sign-in and file storage
Cloudflare: hosting, content delivery and security
Lovable: application platform, service email delivery, and AI features in some admin tools (processed by OpenAI or Google through Lovable's AI service)
Firecrawl: fetching public branding from a website you give us during setup
Stripe: payments, subscriptions and invoices. Stripe may also use payment information to prevent fraud, under its own privacy policy.

Microsoft and Google are the platforms you choose to connect. We send information to them only to apply signatures in your own tenant or domain.

We may also share information with Leadica staff and contractors who need it and are bound by confidentiality, our professional advisers, authorities where the law requires it, and a buyer of the Service or our business (we will tell you first).

6. Storage outside New Zealand

Our providers store and process information outside New Zealand, including in the United States and other countries where they operate. We use reputable providers with contractual and security protections, and take reasonable steps to make sure information is protected in a way comparable to the Privacy Act 2020.

7. Security

We protect information with encryption in transit, role-based access, two-factor authentication for administrators, audit logs of connections, deployments and removals, and verified ownership checks before any Microsoft 365 or Google Workspace connection. Our Microsoft access uses certificate authentication and has no Exchange permissions or administrator role. Google access is domain-bound, uses one scope per call and an endpoint allow-list, and stops when the connection is disconnected or organisation/platform access is paused. No system is completely secure, but we work to keep risk low and act quickly on any issue.

8. How long we keep it

Customer data is kept while the organisation is active.
After an organisation is cancelled or closed, the customer can request an export for 30 days. We then delete its data within 90 days, apart from backups (which expire on their normal cycle) and records we must keep by law, such as tax and accounting records (7 years).
Security, audit and diagnostic logs are kept as long as needed for security and troubleshooting.
A customer can ask us to delete its data sooner by emailing hello@leadica.io.

9. Your rights

You can ask to access or correct personal information we hold about you. We will respond within 20 working days. If we hold your information on behalf of your employer, we will pass your request to them. People in the EU or UK also have rights under the GDPR, including erasure, restriction, portability and objection.

If you are not satisfied with our response, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz) or your local privacy regulator.

10. Cookies

We use only essential cookies and browser storage needed for sign-in, security and remembering your settings, plus a security cookie set by Cloudflare. Stripe sets its own cookies on payment pages to process payments securely and prevent fraud. Our hosting provider records basic, aggregated page-view statistics for our website. We do not use advertising cookies.

11. Privacy breaches

If a privacy breach is likely to cause serious harm, we will notify the people affected and the Privacy Commissioner as the Privacy Act 2020 requires. If it involves customer staff data, we will tell the customer without undue delay so it can meet its own obligations.

12. Children

The Service is for businesses and is not intended for anyone under 18.

13. Changes to this Policy

We may update this Policy. We will tell account admins about material changes by email or in the app, and show the date of the latest version at the top of this page.

14. Contact

Privacy Officer, Leadica Limited
Level 1, 285 Parnell Road, Parnell, Auckland 1052, New Zealand
hello@leadica.io | +64 9 309 5050