Privacy Policy

Who we are

LeadRail is operated by Excalix, based in Toronto, Ontario, Canada. In this policy, “we”, “us”, and “our” mean Excalix. LeadRail is a marketing and CRM platform that helps you manage leads, run outreach, and publish social content. This policy explains what we collect, how we use it, who it is shared with, and the choices you have.

Because we operate from Canada, our handling of personal information is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

TODO (counsel): confirm the correct legal name and form of the operating entity, its registered address, and any business/registration number that should appear here.

Information we collect

• Account data — your name, email, and login credentials.
• CRM data — contacts, leads, companies, deals, and content you create or import into the app. This includes personal information about third parties that you choose to load.
• Connected platform data — when you connect a service such as Facebook, Instagram, or an email provider, we store the access tokens and account identifiers (Page IDs, Instagram Business account IDs) needed to act on your behalf.
• Assistant content — the messages you send to the in-app assistant, and the records it reads from your workspace in order to answer.
• Operational data — message send, delivery, open, click, and unsubscribe events for outreach you run through the platform.

How we use it

• To provide the CRM, outreach, assistant, and social-publishing features you request.
• To publish or schedule content to the social accounts you explicitly connect.
• To send email on your behalf through the providers you configure.
• To maintain suppression lists and honour unsubscribe requests.
• To secure, maintain, and improve the service.

We do not sell your personal data, and we do not use data obtained from connected platforms for any purpose other than the features you enable.

AI processing and model providers

LeadRail’s assistant is powered by third-party large language model providers. When you use the assistant, the content of your request and the workspace records the assistant reads in order to answer it — which can include contact names, email addresses, company details, deal and campaign data, and message text — are transmitted to one of these providers to generate the response. This happens on essentially every assistant turn. If you do not want a record sent to a model provider, do not ask the assistant to work with it.

By default, requests are routed through the following chain, falling back in order when a provider is unavailable:

• Groq (api.groq.com) — primary text and chat generation.
• OpenRouter (openrouter.ai) — first fallback for text and chat generation.
• OpenCode Go (opencode.ai) — last-resort text and chat generation.
• NVIDIA NIM (integrate.api.nvidia.com) — text embeddings used for the assistant’s memory search.
• Google Gemini (generativelanguage.googleapis.com) — image generation, when you request it.

Customer-configured providers. LeadRail also lets an account configure its own model providers, including OpenAI-compatible endpoints, Anthropic, and custom endpoints you supply. Where you do this, your requests are sent to the provider you chose instead of, or ahead of, the default chain above. Those providers are engaged by you and are your own processors: Excalix does not control them, does not have a data processing agreement with them on your behalf, and cannot make any representation about how they handle your data. The list above therefore describes our defaults, not an exhaustive list of every provider that may receive data from your account.

TODO (counsel/ops): confirm the data-retention and training terms of each default provider above, and whether any of them require a separate data processing agreement or sub-processor notice to customers.

Service providers we share data with

We share data only with the service providers required to deliver the product. These providers process data on our instructions, or — where you connected them yourself — on yours.

• Database, authentication, and file storage — Supabase.
• AI model providers — Groq, OpenRouter, OpenCode Go, NVIDIA NIM, and Google Gemini, plus any provider you configure yourself (see the section above).
• Outbound and transactional email — Resend and Brevo.
• Lead enrichment and prospect search — Apollo.
• Knowledge connectors — Notion and Google Drive, where you connect them.
• Social publishing and engagement — Meta (Facebook, Instagram, Threads), Buffer, Postiz, and GoHighLevel, where you connect them.

Which of these actually receive data depends on the integrations and providers your account has enabled. Connectors you have not configured receive nothing.

Where your data is stored

Your account and CRM data are stored in a Supabase-hosted PostgreSQL database and in Supabase file storage. That database is hosted in the European Union (Supabase region eu-north-1, Stockholm, Sweden). Excalix operates from Toronto, Ontario, Canada, so personal information you provide is transferred to and stored outside Canada, and personnel in Canada access it from there.

The AI, email, enrichment, and social providers listed above process data on their own infrastructure, in jurisdictions they determine. Data held or processed in any of these locations may be subject to the laws of that jurisdiction, including lawful access by foreign courts and authorities.

TODO (counsel): the operating entity is in Canada while the primary datastore is in the EU. The transfer mechanism, disclosures, and contractual terms this arrangement requires — under PIPEDA and, if EU/UK data subjects are in scope, under the GDPR — are counsel’s determination. This draft states the storage location as fact and makes no claim about adequacy, standard contractual clauses, or transfer assessments.

Outreach, consent, and unsubscribe

LeadRail is a tool you use to contact people you choose. It does not obtain, record, or verify those people’s consent to be contacted, and it does not check consent before a message is sent. You are responsible for having a lawful basis — including, where Canada’s Anti-Spam Legislation (CASL) applies, valid express or implied consent — for every commercial electronic message you send to every recipient you load into the platform, and for the accuracy of the sender identification and unsubscribe information in those messages.

What LeadRail does provide:

• A per-account suppression list. Addresses and domains on it are filtered out before a send.
• An unsubscribe link in outbound sequences. Confirming it adds the address to your suppression list and marks the contact unsubscribed.
• Automatic suppression of addresses that hard-bounce or generate a spam complaint at the sending provider.

Suppression and unsubscribe are enforced per account. They are not a substitute for obtaining consent in the first place.

Data retention & deletion

We keep your data while your account is active. You can disconnect any integration at any time from Settings → Integrations, which deletes the stored tokens and identifiers for that platform.

When an account owner requests account deletion, the deletion is scheduled 30 days out. During that grace window the account continues to work and the request can be cancelled. After the window elapses, a scheduled job removes the account’s stored files and then deletes the account record; all tenant-scoped data is removed with it by database cascade.

A privacy audit record of the deletion itself — the action, the requesting user, and the timestamp — is deliberately retained after the purge, so that the erasure can be demonstrated. That record does not retain the deleted CRM content.

For full account or data deletion, see our Data Deletion Instructions.

Your rights

Under PIPEDA you have the right to ask what personal information we hold about you, to be told how it has been used and to whom it has been disclosed, to challenge its accuracy and have it corrected, and to withdraw consent to our use of it (subject to legal and contractual limits). You may also complain to the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, email hello@leadrail.xyz. We will respond within the timeframe PIPEDA requires. We may need to verify your identity before acting on a request.

If you are an individual whose information was loaded into LeadRail by one of our customers, that customer — not Excalix — decides what is collected and why. Please direct access, correction, and deletion requests to them; we will assist them in responding.

TODO (counsel): decide whether this policy should also claim coverage under the EU and UK GDPR (which apply to EU/UK data subjects regardless of where Excalix is established) and Quebec’s Law 25 (which applies to Quebec residents). If so, the corresponding legal bases, transfer mechanism, and — for Law 25 — a designated privacy officer need to be stated. This draft deliberately makes no such claim.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “last updated” date above.

Contact

Questions about this policy? Email hello@leadrail.xyz, or write to Excalix, Toronto, Ontario, Canada.

TODO (ops): replace the address above with a monitored role mailbox, and add the registered mailing address once confirmed.