Privacy policy.

1. Who we are

TreeLeads is software for tree service companies. It runs the advertising, the booking pages, the call handling and the follow-up that turn a homeowner's search into a booked job, and it reports what each of those stages cost and produced.

This policy is issued by NEEDS FAIZAN — registered legal entity name — the company that signs contracts (Leeds Company or Scale and Automate LLC), operating as TreeLeads at treeleads.io. In this policy "we", "us" and "TreeLeads" mean that company.

For any privacy question, a data access request, or a deletion request, email support@treeleads.io. That mailbox is monitored and is the fastest route to a human.

2. Who this policy covers

This policy covers three different groups of people, and it is worth knowing which one you are, because the answers differ.

• Site visitors — anyone reading treeleads.io. We collect the least from you: the request data your browser sends, and whatever you type into the booking form if you choose to use it.
• Customers — tree service companies who buy the software or an engagement. We hold your business contact details, your account configuration, and the operational data the platform produces for you.
• Your customers' contacts — the homeowners who call you or fill in a form on a page we run for you. We process their data on your instructions, as your service provider. You decide what happens to it; we carry it out.

It also covers the Google integrations — the Google Ads API, Google Analytics 4 and Google Tag Manager. Because Google holds developers to specific commitments about that data, it has a section of its own below.

3. What we collect, and why

One row per category of data. "Who receives it" names the sub-processors in section 7.

We do not collect special category data — health, biometrics, race, religion, political opinion, union membership, sexual orientation — and we ask you not to type it into free-text fields.

4. Google User Data

This section describes exactly what TreeLeads does with data obtained through Google APIs. It applies whenever you connect a Google account to TreeLeads.

The APIs we use

Where it is stored, how long, and who can see it

• Where. Google Ads reporting data and OAuth tokens are stored on infrastructure we control, hosted in the United States. Tokens are encrypted at rest and are never written into a browser bundle, a log line, or a URL.
• How long. Reporting data for 12 months. OAuth tokens until you disconnect or revoke access, and deleted within 30 days of either.
• Who. Only the TreeLeads operator or operators who run your account, and only for the purposes above. No other customer can see your Google data. We run no process that pools one customer's Google Ads data with another's.

Limited Use

The Google API Services User Data Policy is the document that language refers to. Specifically, and without exception:

• We do not sell Google user data. Not to anyone, in any form, for any price.
• We do not transfer Google user data to any other app or third party, except as necessary to provide or improve the features you are using, to comply with applicable law, or as part of a merger or acquisition in which the receiving party remains bound by this policy.
• We do not use Google user data to serve advertising, to build advertising audiences, or for any advertising purpose outside operating your own advertising account at your instruction.
• We do not allow humans to read Google user data, except with your explicit consent for a specific purpose such as support you have asked for, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.

Disconnecting

You can revoke our access at any time at Google Account permissions, or by emailing support@treeleads.io. Revoking stops all further access immediately. We delete the stored tokens within 30 days, and we will delete the reporting data we already hold on request. There is more detail, step by step, on our Google Ads integration page.

5. How we use what we collect

• To run the service you bought: advertising, booking pages, call handling, follow-up and reporting.
• To contact you about an enquiry you submitted, or about your account.
• To keep the service working, secure and free of abuse.
• To meet legal, tax and accounting obligations.
• To improve the product — using operational and aggregated data, never by reading one customer's data to benefit a competitor of theirs.

We do not use your data, or your customers' data, to train general-purpose machine learning models. Where we use an AI provider to summarise a call, that provider processes the call on our instruction and does not use it to train its models.

6. Calls, SMS and consent

Phone and text are how this industry actually works, so it is worth being precise about consent.

• What consent we collect. Where a form on our site or on a page we operate for a customer offers SMS, it carries a separate, unticked checkbox. Ticking it is consent to receive text messages at the number given. It is never required to submit the form and it is never bundled into the terms of service.
• Message frequency. Message frequency varies with your enquiry — typically a handful of messages around a booking, and never a recurring marketing programme you did not ask for.
• STOP and HELP. Reply STOP to any message to stop all further messages to that number. Reply HELP for help, or email support@treeleads.io. We honour STOP immediately and automatically.
• Cost. Message and data rates may apply. Your carrier, not us, sets those rates.
• Call recording. Calls to tracked numbers may be recorded and transcribed. Where the caller's state requires all-party consent, the call carries a recording announcement before the conversation begins.

Mobile information and consent to receive SMS are never sold, rented or shared with third parties or affiliates for their own marketing purposes. They are shared only with the sub-processors in section 7 that deliver the message on our behalf.

7. Sub-processors

These are the companies that process data on our behalf. Each receives only what its job requires.

We will update this table before adding a sub-processor that handles personal data. If you are a customer and a new sub-processor is unacceptable to you, tell us and we will work out an alternative or end the engagement without penalty.

Beyond this list, we disclose personal information only where the law requires it — a lawful court order, subpoena or regulatory demand — or to establish or defend a legal claim. We do not hand over customer data on an informal request.

8. Retention and deletion

Retention periods are in the table in section 3. When a period ends, the data is deleted or irreversibly anonymised.

You can ask us to delete sooner. Email support@treeleads.io with the word Deletion in the subject line and tell us which data you mean. We acknowledge within 10 days and complete the deletion within 30 days, unless a law requires us to keep a specific record — in which case we will tell you which record and which law.

Step-by-step instructions, including what to send and what happens to backups, are on the data deletion page.

9. Security

Stated honestly. Everything below is verifiable in the code that builds this site, or is a control we actually operate.

• This website is static, pre-rendered HTML. It has no database, no user login and no session. There is nothing on it to breach.
• It has exactly one write path — the booking form — which posts to a same-origin serverless function. That function accepts an allow-list of five fields, truncates each to 200 characters, and fails closed if its credentials are missing rather than passing the request on.
• The CRM credential and account identifier are held as server-side environment variables. They are never included in the browser bundle and are never read from the request body, so a crafted request cannot redirect a write into another account.
• All traffic is served over HTTPS, enforced by the host. Data is encrypted in transit; OAuth tokens are encrypted at rest.
• Access to the CRM, the ad accounts and the Google connection is limited to the operator or operators who run your account.
• We do not hold SOC 2, ISO 27001 or any comparable certification, and we do not claim to. We are a small company and we would rather tell you that than imply an audit we have not had.

No system is perfectly secure. If you believe you have found a vulnerability, email support@treeleads.io and we will respond.

10. Cookies and analytics

treeleads.io loads no analytics scripts, no advertising tags and no third-party trackers of its own. That is a design decision and you can verify it by viewing the page source.

• Our host may set a strictly necessary security cookie to distinguish humans from automated traffic. It carries no advertising identifier.
• The booking calendar on our booking page is embedded from our CRM provider and may set its own cookies when you interact with it. If you would rather not load it, call (469) 369-2430 or email support@treeleads.io instead.
• Advertising pages we operate for customers are different: those carry Google Analytics 4 and Google Tag Manager, because measuring an ad is the job. Those pages carry their own notice.

You can block or delete cookies in your browser settings, and opt out of Google Analytics with Google's opt-out browser add-on.

11. California privacy rights (CCPA / CPRA)

If you are a California resident you have the right to know what personal information we collect and why, to access a copy, to correct it, to delete it, and to limit the use of sensitive personal information. You also have the right not to be discriminated against for exercising any of them.

The categories we collect, the purposes and the recipients are in the table in section 3. To exercise any right, email support@treeleads.io. We will verify your request — usually by confirming control of the email address or phone number already on file — and respond within 45 days, extendable once where the law allows. An authorised agent may act for you with written permission.

12. UK and European rights (UK GDPR / GDPR)

Where the UK GDPR or the EU GDPR applies to our processing, you have the rights to access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting processing already carried out.

Our legal bases are named per category in section 3. Where we rely on legitimate interests, the interest is operating and defending a business service, and we have weighed it against your rights.

To exercise a right, email support@treeleads.io. We respond within one month. Where we process your data as a processor on a customer's instruction, we will route your request to that customer and tell you we have.

We are based in the United States, so data you send us is transferred there. Where a transfer is subject to the GDPR we rely on the Standard Contractual Clauses with our sub-processors. You have the right to complain to your supervisory authority — in the UK, the Information Commissioner's Office.

13. Children

This service is sold to businesses and is not directed to children. We do not knowingly collect personal information from anyone under 13, or under 16 where local law sets that age. If you believe a child has given us personal information, email support@treeleads.io and we will delete it.

14. Changes to this policy

When this policy changes we update the "last updated" date at the top of the page and publish the new version here. For a material change — a new category of data, a new purpose, a new sub-processor handling personal data, or anything that narrows your rights — we will email active customers at least 14 days before it takes effect.

Questions about any of this go to support@treeleads.io, or (469) 369-2430.