Privacy Policy
Leafdrop is a tool for businesses that run many Facebook Pages and Google Business Profile locations. It schedules and publishes Facebook posts and helps reply to Google reviews. Leafdrop is operated by Lotly Automotive Solutions LLC (“we”, “us”). This policy explains what we collect, why, who we share it with, and the choices you have.
Who this applies to
Leafdrop is used by businesses (our “customers”) and the people they invite to their workspace (“users”). It also touches information about members of the public who leave reviews on our customers’ Google Business Profiles. Customers decide which Pages and locations to connect and what to publish; for that information we act on the customer’s behalf.
What we collect
Account information
- Your email address and password. Passwords are stored only as a secure hash by our authentication provider; we never see them.
- If you sign in with Google instead: the name, email address and profile picture on your Google account. We don’t get your Google password or any other Google data from signing in.
- Your company name, your role in the workspace, and the brand details you enter (names, trade, brand voice notes, phone numbers, websites, hours).
Facebook data (when you connect Facebook)
- An access token for the Facebook login you connect with (or for the Business Manager system user, if you connect that way instead), and an access token for each Facebook Page you choose to share. Tokens are encrypted before they are stored.
- Each Page’s ID, name and follower count.
- The posts you create in Leafdrop (text, links, photos), when they should go out, and the result Facebook returns for each Page, including the post ID or the error.
We request these Facebook permissions: pages_show_list (to list the Pages you manage), pages_manage_posts (to publish the posts you schedule), pages_read_engagement (to read Page details and post results) and business_management (to find Pages that belong to your Business Manager).
Google data (when you connect Google)
- A Google refresh token that lets Leafdrop act on your Business Profiles while you’re away. It is encrypted before it is stored.
- Your Business Profile accounts and locations: names, addresses and identifiers.
- Reviews of your locations: the reviewer’s display name as Google shows it, the star rating, the review text, dates, and any existing reply.
- The replies you write, approve or schedule in Leafdrop.
We request one Google permission: https://www.googleapis.com/auth/business.manage, to read your locations and reviews and to post the replies you send.
Photos you upload
Photos you add to a post are stored so Facebook can fetch them when the post goes out. Each photo is saved under a long random address that is not listed anywhere, but anyone who has that exact address can view it, the same as a photo once it is published on Facebook.
Billing (paid plans)
Payments are handled by Stripe. Your card details go straight to Stripe and never reach Leafdrop. We store your Stripe customer ID, your plan, its status and renewal date, and Stripe sends us receipts and invoice status.
Waitlist
If you join the early-access list on our website we store your email address and, if you give them, your company name and Page count.
Technical information
Our hosting provider keeps standard server logs (IP address, request time, the page requested) for security and troubleshooting. Leafdrop keeps you signed in using your browser’s local storage, and sets one short-lived cookie while you connect Facebook or Google to protect that sign-in. We do not use advertising or tracking cookies, and we do not use third-party analytics.
How we use it
- To run the service: publish your scheduled posts to the Pages you choose, pull in reviews, draft replies, and send the replies you approve.
- To keep it working and secure: detect failed posts and expired connections, prevent abuse, and fix problems.
- To contact you about your account, the service, and changes to it, including a welcome email, the daily summary (which you can turn off in Settings), and billing emails.
We do not sell personal information, and we do not use your Facebook or Google data for advertising.
AI writing
To draft a reply, Leafdrop sends the review (reviewer display name, rating, text) and the brand details you entered to Anthropic, which provides the AI model. Anthropic processes it only to produce the draft and does not use it to train its models under its commercial terms. A person in your workspace reviews and edits drafts before they are posted, unless your workspace turns on automatic thank-you replies, which only ever apply to 4- and 5-star reviews.
When you ask Leafdrop to write a post or fill in your business details, it sends the topic and brand details you entered to Anthropic in the same way. Nothing is published until you choose to post it.
Google API Services
Leafdrop’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the review features described above; we do not use it for advertising, we do not sell it, and people do not read it except where you ask us to for support, where it’s needed for security or legal reasons, or where it has been aggregated and anonymized for internal operations. We do not use Google user data to develop or train generalized AI or machine-learning models.
Who we share it with
We share information only with the providers that run Leafdrop, and only what each needs:
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and photo storage |
| Railway | Hosting the Leafdrop app |
| Meta (Facebook) | Publishing the posts you schedule to your Pages |
| Reading your locations and reviews, posting your replies | |
| Anthropic | Drafting review replies and posts |
| Stripe | Taking payments for paid plans |
| Resend | Sending account and notification emails |
We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.
How long we keep it
We keep your data while your workspace is active. When you ask us to delete your account or workspace, we delete it within 30 days, including stored tokens, posts, reviews and photos, except for anything we must keep by law. Server logs are kept for up to 30 days. See Data deletion for how to ask.
Security
Connections use HTTPS. Facebook and Google tokens are encrypted with AES-256 before they are stored, and the key is held separately from the database. Each workspace can only read its own data, enforced in the database itself. No system is perfectly secure; if we learn of a breach that affects you, we will tell you promptly.
Your choices and rights
- Access and correction: you can see and edit most of your data in the app; for anything else, email us.
- Deletion: see Data deletion.
- Disconnecting: you can remove Leafdrop’s access at any time in Meta Business settings or at myaccount.google.com/permissions.
Depending on where you live (for example California, the EU or the UK) you may have additional rights, such as to receive a copy of your data or to object to certain uses. Email [email protected] and we will respond within 30 days.
If you left a review of one of our customers’ businesses and have a question about it, please contact that business first; we will help them respond.
Children
Leafdrop is a business tool and is not meant for anyone under 16.
Changes
If we change this policy we will update the date above, and for significant changes we will tell account owners by email before they take effect.
Contact
Lotly Automotive Solutions LLC
Email: [email protected]