Privacy Policy
Leafdrop is a tool for businesses that run many Facebook Pages and Google Business Profile locations. It schedules and publishes Facebook posts and helps reply to Google reviews. Leafdrop is operated by [Company legal name] (“we”, “us”). This policy explains what we collect, why, who we share it with, and the choices you have.
Who this applies to
Leafdrop is used by businesses (our “customers”) and the people they invite to their workspace (“users”). It also touches information about members of the public who leave reviews on our customers’ Google Business Profiles. Customers decide which Pages and locations to connect and what to publish; for that information we act on the customer’s behalf.
What we collect
Account information
- Your email address and password. Passwords are stored only as a secure hash by our authentication provider; we never see them.
- Your company name, your role in the workspace, and the brand details you enter (names, trade, brand voice notes, phone numbers, websites, hours).
Facebook data (when you connect Facebook)
- An access token for the Business Manager system user you connect, and an access token for each Facebook Page it manages. Tokens are encrypted before they are stored.
- Each Page’s ID, name and follower count.
- The posts you create in Leafdrop (text, links, photos), when they should go out, and the result Facebook returns for each Page, including the post ID or the error.
We request these Facebook permissions: pages_show_list (to list the Pages you manage), pages_manage_posts (to publish the posts you schedule) and pages_read_engagement (to read Page details and post results).
Google data (when you connect Google)
- A Google refresh token that lets Leafdrop act on your Business Profiles while you’re away. It is encrypted before it is stored.
- Your Business Profile accounts and locations: names, addresses and identifiers.
- Reviews of your locations: the reviewer’s display name as Google shows it, the star rating, the review text, dates, and any existing reply.
- The replies you write, approve or schedule in Leafdrop.
We request one Google permission: https://www.googleapis.com/auth/business.manage, to read your locations and reviews and to post the replies you send.
Photos you upload
Photos you add to a post are stored so Facebook can fetch them when the post goes out. Each photo is saved under a long random address that is not listed anywhere, but anyone who has that exact address can view it, the same as a photo once it is published on Facebook.
Waitlist
If you join the early-access list on our website we store your email address and, if you give them, your company name and Page count.
Technical information
Our hosting provider keeps standard server logs (IP address, request time, the page requested) for security and troubleshooting. Leafdrop keeps you signed in using your browser’s local storage, and sets one short-lived cookie while you connect Google to protect that sign-in. We do not use advertising or tracking cookies, and we do not use third-party analytics.
How we use it
- To run the service: publish your scheduled posts to the Pages you choose, pull in reviews, draft replies, and send the replies you approve.
- To keep it working and secure: detect failed posts and expired connections, prevent abuse, and fix problems.
- To contact you about your account, the service, and changes to it.
We do not sell personal information, and we do not use your Facebook or Google data for advertising.
AI-drafted review replies
To draft a reply, Leafdrop sends the review (reviewer display name, rating, text) and the brand details you entered to Anthropic, which provides the AI model. Anthropic processes it only to produce the draft and does not use it to train its models under its commercial terms. A person in your workspace reviews and edits drafts before they are posted, unless your workspace turns on automatic thank-you replies, which only ever apply to 4- and 5-star reviews.
Google API Services
Leafdrop’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the review features described above; we do not use it for advertising, we do not sell it, and people do not read it except where you ask us to for support, where it’s needed for security or legal reasons, or where it has been aggregated and anonymized for internal operations. We do not use Google user data to develop or train generalized AI or machine-learning models.
Who we share it with
We share information only with the providers that run Leafdrop, and only what each needs:
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and photo storage |
| Railway | Hosting the Leafdrop app |
| Meta (Facebook) | Publishing the posts you schedule to your Pages |
| Reading your locations and reviews, posting your replies | |
| Anthropic | Drafting review replies |
We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.
How long we keep it
We keep your data while your workspace is active. When you ask us to delete your account or workspace, we delete it within 30 days, including stored tokens, posts, reviews and photos, except for anything we must keep by law. Server logs are kept for up to 30 days. See Data deletion for how to ask.
Security
Connections use HTTPS. Facebook and Google tokens are encrypted with AES-256 before they are stored, and the key is held separately from the database. Each workspace can only read its own data, enforced in the database itself. No system is perfectly secure; if we learn of a breach that affects you, we will tell you promptly.
Your choices and rights
- Access and correction: you can see and edit most of your data in the app; for anything else, email us.
- Deletion: see Data deletion.
- Disconnecting: you can remove Leafdrop’s access at any time in Meta Business settings or at myaccount.google.com/permissions.
Depending on where you live (for example California, the EU or the UK) you may have additional rights, such as to receive a copy of your data or to object to certain uses. Email [contact email] and we will respond within 30 days.
If you left a review of one of our customers’ businesses and have a question about it, please contact that business first; we will help them respond.
Children
Leafdrop is a business tool and is not meant for anyone under 16.
Changes
If we change this policy we will update the date above, and for significant changes we will tell account owners by email before they take effect.
Contact
[Company legal name]
Email: [contact email]