Privacy Policy

Last updated: September 1, 2026

1. Introduction

LeadAct ("we", "our", "us") is a WhatsApp Business messaging platform operated by ELMABROUK DEVELOPMENT, Tunisia. This Privacy Policy explains how we collect, use, and protect your information when you use our platform at leadact.cloud.

2. Information We Collect

• Account information: name, email, company name
• Contact data: phone numbers and names you import for messaging
• Message data: WhatsApp messages sent and received through our platform
• Usage data: login times, features used, campaign analytics
• Payment information: billing details (processed securely, not stored)

3. How We Use Your Information

• To provide and operate the LeadAct platform
• To send WhatsApp messages on your behalf via Meta's Cloud API
• To generate analytics and usage reports
• To process billing and subscriptions
• To provide customer support

4. Mobile Application (Android)

The LeadAct Android app (package cloud.leadact.app) is a mobile companion to the web platform. It requires an existing LeadAct account and is used by our business customers and their staff. When you use the app, we collect or process:

4.1 Permissions the app requests

• Camera — only when you choose to take a photo to attach to a conversation. The app never opens the camera on its own or in the background.
• Microphone — only while you are actively recording a voice note, after you tap the microphone button. Recording stops when you send or cancel. A recording you cancel is deleted from the device and never uploaded. The app does not record audio at any other time.
• Notifications — required on Android 13 and above to show alerts for new messages, campaign results and account notices. You can revoke this in Android Settings at any time, and mute individual categories or set quiet hours inside the app.
• Internet and network state — required for all features, and to detect when a connection returns so that a message you wrote offline can be sent.

The app does not request access to your device's contact list, your location, your call logs, your SMS messages, or files outside those you explicitly pick to attach.

4.2 Data the app holds

• Account details: your name, email address and role, so the app can show the right workspace and permissions.
• Push notification token: a Firebase Cloud Messaging token, together with your device model, Android version, app version, language and time zone, so notifications reach the right device and respect your quiet hours. The token is deleted from our servers when you sign out.
• Conversation content: the messages, contact names and phone numbers belonging to the business account you are signed in to. These are cached on the device so the inbox stays readable without a connection.
• Attachments you send: photos, videos, documents and voice notes are uploaded to our servers and then delivered to WhatsApp.
• Sign-in credentials: your session token is stored in the Android system keystore, not in ordinary app storage.

Signing out erases the local cache. The stored session token, the cached conversations and messages, and any queued unsent messages are all deleted from the device when you sign out, so the next person to use that device cannot read them.

4.3 Content sent to you by customers

Customers writing to a business on WhatsApp can send location pins and contact cards as message types. Where they do, the app displays and caches that content as part of the conversation, in the same way as any other message. This is content your customers chose to send to the business — the app does not read your device's own location or address book to obtain it.

4.4 Crash reporting

Release builds send crash reports to Google Firebase Crashlytics, containing the error, the stack trace, the device model and the Android version. Crash reports do not include message content, contact details or your password. Crash reporting is disabled in development builds.

4a. WhatsApp Data & Meta Platform

LeadAct uses the WhatsApp Business Platform (Cloud API) operated by Meta. Message data is processed through Meta's infrastructure. We comply with Meta's Platform Terms and WhatsApp Business Policy. We share only the minimum data required to deliver messages on your behalf.

5. Data Sharing

We do not sell your data, and we share it only with the providers needed to operate the service:

• Meta (WhatsApp Cloud API) — message delivery to and from WhatsApp.
• Google Firebase — Cloud Messaging delivers push notifications to the Android app, and Crashlytics receives crash diagnostics from release builds. A notification payload contains the sender's name and a short preview of the message, so that the alert is meaningful; crash reports do not contain message content.
• Email service providers — platform notifications and password resets.

We do not share data with advertisers or data brokers, and none of these providers is permitted to use the data for its own purposes.

6. Data Retention

We retain your data for as long as your account is active. Upon account deletion, data is permanently removed within 30 days.

Requesting deletion. To delete your LeadAct account and the data held against it, follow the steps on our Data Deletion page, or email contact@emdev.click from the address on the account. Uninstalling the Android app does not by itself delete your account, but it does remove the conversations cached on that device; signing out inside the app erases that cache immediately.

7. Your Rights (GDPR)

• Right to access your personal data
• Right to correct inaccurate data
• Right to delete your data
• Right to data portability
• Right to withdraw consent

To exercise these rights, contact: contact@emdev.click

8. Security

We use industry-standard encryption (HTTPS/TLS), secure database storage, and access controls to protect your data.

9. Contact

ELMABROUK DEVELOPMENT
RUE COLONIA N37 BIS 1002, Tunis, Tunisia
Email: contact@emdev.click
Phone: +216 53 551 146