Privacy Policy
LeadTrap, Inc., a Delaware corporation doing business as Carelu (“LeadTrap,” “we,” “us”), provides an AI-powered lead capture, qualification, and intake platform for healthcare providers and service businesses. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to leadtrap.com, app.leadtrap.ai, and our chat, phone, SMS, email, and advertising-reporting products (the “Services”).
1. Information We Collect
Information you provide. Account details (name, email, phone, company), billing information, and content you submit through the Services.
Lead and intake information. When you interact with a LeadTrap chat widget, phone agent, SMS conversation, or intake form operated on behalf of one of our business customers (“Partners”), we collect the information you share — such as your name, contact details, insurance information, and the content of your conversation — on behalf of that Partner and process it under their instructions.
Email data (with your permission). If a Partner connects a Google or Microsoft email account to the Services, we access mailbox data through Google and Microsoft APIs solely as described in Section 3.
Advertising data (with your permission). If a Partner connects an advertising account to the Services — Meta (Facebook) or Google Ads — we access that account’s advertising data through the platform’s official APIs solely as described in Section 4 (Meta) and Section 5 (Google Ads).
Automatic information. Log data, device and browser information, approximate location derived from IP address, and usage analytics.
2. How We Use Information
We use information to provide and operate the Services; route, qualify, and follow up with leads on behalf of Partners; send and receive communications the Partner has configured (chat, SMS, phone, email); provide reporting and analytics to Partners; secure and improve the Services; and comply with law.
We do not sell personal information. We do not use lead or intake information for advertising.
3. Google and Microsoft Account Data
This section covers data we receive through Google and Microsoft APIs. A Partner may connect a mailbox (described here) and, separately, a Google Ads account (described in Section 5). The Google API Limited Use commitments set out below apply to all Google user data we receive, including Google Ads data.
If a Partner connects a Gmail or Microsoft Outlook account, LeadTrap accesses that mailbox only to provide user-facing features the Partner has enabled — such as sending intake follow-up emails from the Partner’s address, reading replies from leads so they appear in the Partner’s LeadTrap inbox, and organizing those messages (for example, marking them as read or labeled once handled).
LeadTrap’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only use Google user data to provide and improve the user-facing features described in this policy — the mailbox features described above and the advertising-reporting features described in Section 5.
- We do not transfer Google user data to third parties except as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition with notice.
- We do not use Google user data for advertising, including our own advertising and any ad targeting or retargeting. (Showing a Partner their own Google Ads performance inside their dashboard is a user-facing reporting feature they asked for, not advertising use of their data.)
- We do not allow humans to read Google user data unless we have the account holder’s affirmative agreement, it is necessary for security or compliance purposes, or the data has been aggregated and anonymized.
- We do not use Google user data — including Google Workspace, Gmail, and Google Ads data — to develop, improve, or train generalized artificial intelligence or machine-learning models.
Microsoft account data accessed through Microsoft Graph is handled under the same restrictions. Partners can disconnect a mailbox at any time from their LeadTrap settings, which revokes our access; previously synced data can be deleted on request.
4. Meta (Facebook and Instagram) Advertising Data
Partners may connect a Meta (Facebook) account to the Services — through our Meta app, Carelu Connector — so they can see how their Facebook and Instagram advertising performs alongside the leads and intakes those ads generate. Access is granted by the Partner through Facebook Login and Meta’s permission dialogs, and we access Meta data only through Meta’s official APIs (including the Marketing API).
What we receive. With the Partner’s permission, we receive: basic profile information of the connecting user (such as name and email address); the ad accounts, Pages, and business assets the Partner chooses to share; and advertising data from those assets — such as campaign, ad set, and ad names and settings, and aggregate performance metrics (for example spend, impressions, reach, clicks, and conversion counts).
How we use it. We use Meta data only to provide the features the Partner has enabled: displaying advertising performance in that Partner’s LeadTrap dashboard, attributing leads and intakes to the campaigns that generated them, and reporting on the results. Specifically:
- We do not sell Meta data or use it for our own advertising or marketing.
- We do not share Meta data with third parties, except with service providers who host and operate the Services for us under contract, or where required by law. Each Partner’s Meta data is visible only to that Partner’s account.
- We do not use Meta data to build or train generalized artificial-intelligence or machine-learning models.
- Access tokens for connected Meta accounts are stored encrypted and are never shared.
Our collection, use, and deletion of Meta data (“Platform Data”) complies with the Meta Platform Terms and Developer Policies.
Disconnecting and data deletion. A Partner can disconnect their Meta account at any time from their LeadTrap settings, which revokes our access. You can also remove the “Carelu Connector” app yourself in your Facebook settings under Settings & Privacy → Settings → Apps and Websites, which invalidates our access tokens. To have the Meta data we have stored deleted, disconnect (or remove the app) and email privacy@leadtrap.com from the account owner’s address with the subject “Meta data deletion request.” We will delete the stored Meta data associated with the connection within 30 days and confirm by email.
5. Google Ads Advertising Data
Partners may connect a Google Ads account to the Services so they can see how their Google advertising performs alongside the leads and intakes those ads generate. Access is granted by the Partner through Google’s OAuth consent screen, and we access Google Ads data only through the official Google Ads API, using the https://www.googleapis.com/auth/adwords scope.
What we receive. Read-only, and limited to the Partner’s own advertising data: the list of Google Ads accounts the connecting user is able to access; basic details of the account the Partner selects (account name, currency, and time zone); and campaign performance — campaign ID and name with daily spend, clicks, and impressions. This data is refreshed on a nightly schedule that re-pulls roughly the last 35 days, so late-reported figures and spend corrections are picked up. We do not request or receive the connecting user’s Gmail, contacts, calendar, Google profile, or any other Google data through this connection.
Read-only access. We only read. We never create, edit, pause, or delete campaigns, ad groups, ads, budgets, or bids, and we never spend money in a Partner’s Google Ads account. The connection makes no changes of any kind to the account.
How we use it. We use Google Ads data only to provide the features the Partner has enabled: displaying advertising performance in that Partner’s LeadTrap dashboard, attributing leads and intakes to the campaigns that generated them, and reporting on the results (for example, cost per lead by campaign). Specifically:
- We do not sell Google Ads data or use it for our own advertising or marketing.
- We do not share Google Ads data with third parties, except with service providers who host and operate the Services for us under contract, or where required by law. Each Partner’s Google Ads data is visible only to that Partner’s account.
- We do not use Google Ads data to develop, improve, or train generalized artificial-intelligence or machine-learning models.
- We do not allow humans to read Google Ads data except with the account holder’s affirmative agreement, where necessary for security or compliance, or where the data has been aggregated and anonymized.
Our use and transfer of information received from Google APIs, including the Google Ads API, adheres to the Google API Services User Data Policy, including the Limited Use requirements set out in Section 3.
Disconnecting and stored data. A Partner can disconnect their Google Ads account at any time from their LeadTrap settings. Disconnecting stops the nightly sync, revokes our access, and clears the stored OAuth tokens for that connection. You can also revoke LeadTrap’s access yourself at any time at myaccount.google.com/permissions. Advertising performance that has already been synced (daily spend, clicks, and impressions by campaign) is kept after disconnection so the Partner’s past reports remain intact. To have it deleted, email privacy@leadtrap.com from the account owner’s address with the subject “Google Ads data deletion request.” We will delete the stored Google Ads data associated with the connection within 30 days and confirm by email.
6. SMS / Text Messaging
Leads may receive SMS messages from a Partner via LeadTrap only after providing consent — for example, by submitting a form or chat conversation that discloses SMS follow-up, or by texting in first. Message frequency varies; message and data rates may apply. Reply STOP to opt out at any time and HELP for help.
Messages from LeadTrap itself. If you submit a contact, demo, or intake request to LeadTrap on leadtrap.com and check the SMS consent box on that form, LeadTrap may text you at the number you provided about that request and our services. The box is unchecked by default, and consent is never a condition of purchase or of any service. The same terms apply: message frequency varies, message and data rates may apply, reply STOP to opt out and HELP for help.
No mobile opt-in data is shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except as necessary to deliver the messages (e.g., our SMS carrier partners) or as required by law.
7. Sharing
We share information with: the Partner on whose behalf a conversation occurs; service providers who process data for us under contract (hosting, telephony/SMS carriers, payment processing, analytics); and authorities when required by law. We may share aggregated, de-identified information that cannot reasonably identify you.
8. Data Retention and Deletion
We retain personal information for as long as needed to provide the Services to the relevant Partner, then delete or de-identify it. Partners may request deletion of lead data at any time; account holders may request deletion of their account data by contacting privacy@leadtrap.com.
9. Security
We use industry-standard safeguards, including encryption in transit (TLS) and at rest, access controls, and least-privilege internal access. OAuth tokens for connected email accounts are stored encrypted and are never shared.
10. Your Rights
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to opt out of certain processing. Contact privacy@leadtrap.com to exercise these rights. If we process your data on behalf of a Partner, we may direct your request to that Partner.
11. Children
The Services are not directed to children under 13, and we do not knowingly collect their information without appropriate consent obtained by the Partner (e.g., a parent completing intake for a child’s care).
12. Changes and Contact
We will post any changes to this policy on this page with an updated effective date. Questions: privacy@leadtrap.com, LeadTrap, Inc., 169 Madison Ave, STE 62431, New York, NY 10016.