Leslie AR — Privacy Policy
Effective date: September 21, 2026 · Last updated: September 19, 2026
1. Two kinds of people in this policy
Customers. Businesses that sign up for Leslie AR. For their account data, we decide how it is used — we are the controller.
Their customers. People and businesses who owe money to a Leslie AR customer. They never signed up with us and never agreed to anything. Their data reaches us from our customer's accounting system. For that data, our customer decides how it is used and we act on their instruction — they are the controller, we are the processor.
Section 6 sets out what someone in the second group can ask us for. We think it matters that they can read this policy and find themselves in it.
2. What we collect
From our customer, when they sign up
- Name, email address, password (stored hashed, never in readable form)
- Company name, business postal address, time zone
From their accounting system, when they connect it
- Customer names, email addresses, and billing addresses
- Invoices: numbers, amounts, dates, balances, payment status
- We hold an access credential for that connection. We can read this data; we do not write to their books.
From their email mailbox, when they connect it
- Permission to send only. We cannot read their inbox, search their mail, or see anything they received before connecting.
- Follow-up emails we send on their behalf, and replies that reach us through the forwarding rule they set up — including message content.
As the service runs
- A record of every message sent: time, channel, recipient, which approval authorized it, which policy version applied, and a fingerprint of the content
- Notes and summaries generated from conversations with a customer's customers
- Log and device data: IP address, browser, timestamps
3. How we use it
- To do the job: work out which invoices are overdue, draft follow-ups, send what the customer approves, and handle replies
- To show the customer what happened, including the full text of what was sent
- To keep the service safe and working: prevent abuse, enforce sending limits, investigate problems
- To meet legal obligations and to establish or defend legal claims — see Section 5
- To contact the customer about their account
- To include advertising from partners in our regular communications with our customer, chosen using anonymized, aggregated usage data. This can happen on any plan, and the customer can opt out at any time in settings. We never advertise in email sent to their customers, we never sell their customers' data, and we never target advertising using it.
We do not sell or share personal information. Partner advertising is selected on our side: we decide what to show using what we already hold, and we disclose nothing about you to the partner in order to do it. Advertisers receive no personal information from us, whether in exchange for money or anything else.
4. Who we share it with
We use the vendors below. Each one only receives what it needs.
| Vendor | What it handles |
|---|---|
| Supabase | Database and account authentication |
| Fly.io | Application hosting |
| Mailgun | Sending our own email, and receiving forwarded replies |
| Google / Microsoft | Sending through the customer's connected mailbox |
| Intuit (QuickBooks) | The accounting connection |
| Anthropic, OpenRouter and the model providers it routes to | Drafting follow-ups and summarizing conversations |
| Twilio, Deepgram, ElevenLabs | Phone calls, transcription, and speech — not used today; email only |
| Cloudflare | Bot protection on our sign-up form |
Worth stating plainly: the content of email exchanged with a customer's customers is sent to AI model providers in order to draft replies. We require those providers not to train on that content and not to retain it beyond what is needed to return a response.
We may also disclose information where the law requires it, or to establish or defend legal claims.
5. How long we keep things
We keep data for the life of the account, and then:
| What | How long | Why |
|---|---|---|
| Conversations, messages, contact records, accounting data cache, settings | Deleted 30 days after the account closes | The grace period exists so an accidental closure can be undone |
| Connected credentials | Revoked with the provider, then deleted | |
| Compliance log of messages sent — time, channel, recipient, approval reference, policy version, content fingerprint. Message bodies are removed. | At least 4 years | If someone says they were contacted unlawfully, this is what answers it. The period matches the limitation period for telephone-contact claims. |
| Anonymized aggregate statistics, carrying no identity | Indefinitely | Product and benchmarking |
| Do-not-contact records, stored as one-way fingerprints that cannot be read back | Indefinitely | So "stop contacting me" is honored permanently, including after the account that sent the message is gone |
The part we want to be candid about. We keep that compliance log — and the underlying record of what the accounting system told us at the time — even after someone asks us to delete their data. Keeping it is how we can show what happened if a contact is later disputed, and we rely on the legal basis of establishing and defending legal claims. We are stating this in advance rather than raising it during a dispute. Everything else about that person is deleted, and they stay on the do-not-contact list.
6. If you received an email from Leslie AR and never signed up
You can:
- Stop the email. Use the unsubscribe link in any message, or reply STOP. We suppress the address permanently, including if the business that contacted you leaves Leslie AR.
- Ask what we hold about you, and ask us to correct or delete it.
- Complain to us.
Write to [email protected].
Two honest notes. First, the business that contacted you decides how your data is used and we act on their instruction. For access, correction and deletion we pass your request to that business and tell you we have done so; they are required to respond within 30 days. Second, deletion does not remove the compliance record described in Section 5, for the reason given there.
A request to stop being contacted is different: we act on it ourselves, immediately, and it does not depend on the business responding.
7. Customer choices
- See and export account data and message history from the dashboard
- Delete the account from settings, which starts the 30-day grace period
- Opt out of partner advertising at any time, on any plan
- Disconnect the accounting or mailbox connection at any time
8. Security
Access credentials and stored evidence records are encrypted. Access to production data is limited to people who need it.
9. Where we store data
Our infrastructure and the vendors listed in Section 4 are primarily in the United States, and that is where personal data is stored and processed.
10. Children
Leslie AR is for businesses and not directed to anyone under 18. We do not knowingly collect data from children.
11. Disclosures for California residents
California residents have the right to know what personal information we collect and why, to request access or deletion, to correct inaccuracies, and to be free from discrimination for exercising those rights. Sections 2, 3 and 5 set out the categories we collect, the purposes, and how long we keep each.
As stated in Section 3, we do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information for purposes requiring a right to limit.
12. Changes
We may update this policy. For material changes we will give notice by email and at https://leslie.ar/privacy, and update the date above.