Security & Compliance

Data residency

For information on data residency, contact support@leadhanger.com.

Access control

Each account can access only the leads routed to its own locations. The server, not the app, enforces this restriction. Owners can grant staff access to a subset of their own locations only. Brand users see the network in the dashboard according to their role.

Phone number protection

The LeadHanger app partially masks a customer's phone number until someone at the location reveals it. We log each reveal with the location and the time.

Authentication

We hash passwords with bcrypt. Sessions use signed tokens (JWT) that expire. We record each account's most recent sign-in and its failed sign-in attempts.

Encryption

We encrypt traffic between the chat, the LeadHanger app, the dashboard and our servers in transit, using HTTPS (TLS).

Consent capture

The chat shows the brand's own consent language and can link to the brand's privacy notice. The visitor must accept it before sending the request. Consent to calls and texts is a separate, optional opt-in.

SMS compliance (A2P 10DLC)

We send text messages about a request through Twilio, under a registered A2P 10DLC brand. Recipients can reply STOP to opt out or HELP for help. We never share SMS opt-in data for marketing. The SMS Terms and SMS Consent pages set out the program terms and the opt-in wording.

Lead intake API

Leads reach LeadHanger from the chat on the brand's website or from the brand's own systems through our lead intake API. The API accepts requests over HTTPS and authenticates them with an API key we issue.

Subprocessors

Each processes data only to provide its service to us, under contract.

• Cloud hosting provider stores the data.
• Email provider sends and receives our email.
• Twilio delivers text messages.
• Expo delivers app notifications and app updates.
• Apple and Google carry notifications to phones through their notification services.

Data retention and deletion

We retain leads for the term of the brand's contract. When a location user requests deletion of their account, we remove it from live systems within 30 days and from backups within 30 days after that. The Privacy Policy and the Delete Your Account page provide details.

Security questionnaires and vulnerability reports

For security questionnaires and vulnerability reports, contact support@leadhanger.com.