Privacy Policy

Information you provide

• Name, email address, phone number, and website URL when you fill in our contact or audit request forms
• Business name and monthly ad budget range
• Any additional information you share with us via email or WhatsApp

Information we collect automatically

• If you accept optional analytics, pages visited, time on site, and interactions via Google Analytics 4
• If you accept optional analytics, device type, browser, and approximate location
• If you accept optional analytics, referral source (how you found our website)

Information from public sources

• Business data from Companies House (company name, registration number, SIC codes, registered address)
• Website performance data from Google PageSpeed Insights
• Business listings from Google Places (address, phone, reviews, ratings)
• Publicly available contact details from business websites

When a business authorises SwiftLead to manage its Meta advertising, we access the connected business, ad account, Page, advertising assets and performance results. We use this information to prepare and manage authorised campaigns, monitor delivery and report results to that business in its private portal.

For connected Instant Forms, we receive the contact details and answers that a person submits, together with the form, lead, ad and campaign identifiers and submission time. We store the enquiry for the relevant business and notify its verified contact so it can respond. Advertising clicks and form submissions are recorded separately from reviewed, qualified enquiries.

Connection credentials are used by our server and are not included in client portal responses. Enquiry records are stored with Supabase and processed by our Vercel-hosted service. Text notifications use Twilio and include the enquiry details needed by the receiving business. The business receiving your enquiry may also describe its own use of your data in the privacy notice linked from its form.

To request access to or deletion of Facebook or Instagram data held by SwiftLead, email james.wilson@swiftlead.co.uk. Include the business or Page name and the contact details used for the enquiry so we can locate the records and verify your request. Businesses can also revoke SwiftLead's access in their Meta business settings. Revoking access stops future provider access; it does not itself delete records already received. The retention and rights sections below apply to those records.

When you connect a calendar to SwiftLead Bookings, we access your account identity, calendar list and availability to help you choose calendars and offer visit times. We create, read, update and cancel SwiftLead visit events in the calendar you select. Customers see only available times and their own visit details.

We store encrypted connection credentials, your calendar selections and booking settings. Visit records include the customer's contact details, visit address, time, status and original enquiry reference. Appointment details are shared with the connected calendar provider and with the business and customer through booking updates.

We encrypt Google Calendar access and refresh tokens before storing them using AES-256-GCM. The encryption key is held separately in server-side configuration, and the encrypted credentials are bound to the relevant business. Tokens are handled by our server and are not included in browser responses.

We use HTTPS/TLS when exchanging data with Google. Access to stored connection and booking data is restricted to server-side services, with business-specific access checks and signed private management links. Calendar authorisation uses PKCE, random state values and a secure, HttpOnly callback cookie that expires after ten minutes. Private booking API responses are marked not to be cached and use a no-referrer policy.

Google Calendar data is used to provide the booking features you choose. We do not use it for advertising or to train general-purpose AI models, and we do not sell it. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

You can revoke access in your Google or Microsoft account settings, or revoke the app-specific password used for iCloud. This stops future access; existing visit records and calendar events are not automatically deleted. Contact james.wilson@swiftlead.co.uk to request removal of stored connection or booking data.

We process your personal data under the following legal bases (UK GDPR):

• Consent — when you submit a form on our website, agree to receive communications, or accept optional analytics
• Legitimate interest — to contact businesses about our services using publicly available information (limited to corporate subscribers under PECR)
• Contract — to fulfil our obligations when you become a paying client

Google Analytics is optional and does not load until you accept it. We also use local storage to remember your choice.

After choosing, you can reopen the consent choices at any time with the Cookie settings button on our website. You can also clear this site's data in your browser settings.