What data lives where
A plain-English account of every external service LeadFuel touches, what we send each one, what we keep, and how long. Security-minded customers evaluating the suite get the "where does my stuff go" answers in one place here.
In two sentences
Your customer data lives in our Railway-hosted Postgres database in the US-East region. We send pieces of it out to a handful of third parties, always at your direction (you connect them), and we encrypt the sensitive access tokens at rest.
Where your data is stored
| What | Where | Encrypted at rest? |
|---|---|---|
| Account + invite + entitlement rows | Postgres (shared DB) | Yes (disk-level) |
| ICP documents, scoring data | Scope Postgres | Yes (disk-level) |
| Campaign plans, drafts, sends, replies | Reach Postgres | Yes (disk-level) |
| LinkedIn posts, personas, buckets | Signal Postgres | Yes (disk-level) |
| Mailbox-derived contacts & messages | Orbit Postgres | Yes (disk-level) |
| Microsoft 365 OAuth tokens | Orbit Postgres | Yes (Fernet, app-level) |
| LinkedIn OAuth tokens | Signal Postgres | Yes (Fernet, app-level) |
| Uploaded documents (Briefcase) | Core Postgres (BYTEA blobs) | Yes (disk-level) |
| Fieldy conversation transcripts & digests (personal suite) | Core Postgres | Yes (disk-level) |
| Mail-derived fitness/health-adjacent signals, if turned on (personal suite) | Core Postgres | Yes (disk-level) |
| Imported ChatGPT conversation history, if you upload an export (personal suite) | Core Postgres | Yes (disk-level) |
| QuickBooks-derived financial records, if connected (personal suite) | Core Postgres | Yes (disk-level) |
| Resolved city / calendar-derived location facet, if enabled for the account (personal suite, not on by default) | Core Postgres | Yes (disk-level) |
| Billing identifiers (Stripe IDs) | Core Postgres | Yes (disk-level) |
| Card numbers, raw payment details | Stripe, and we never see them | n/a |
Disk-level encryption means Railway/Postgres encrypts the
data store using AES-256. Fernet app-level encryption
means the application encrypts those specific fields before writing
them, so even a stolen DB dump can't reveal them without our
SECRET_KEY.
The personal-suite rows above (Fieldy, mail-derived fitness signals, ChatGPT
import, QuickBooks, location) only apply if you've connected that source
yourself. Several are off by default even after connecting and require an
explicit additional opt-in; see the "Personal suite" section below for which.
Personal suite (Life / Echo / Lucid): what's live, what isn't
The personal suite (Life, Echo, Lucid) reads from the same Postgres store as the B2B side, but adds sensor-like sources with more sensitive content. Here's the honest status of each, because "we built the code" and "it's active on your account" are not the same claim.
| Source | Status | What it captures |
|---|---|---|
| Fieldy (ambient conversation wearable) | Live, opt-in per account | You connect it yourself with your own Fieldy API key or by pointing Fieldy's webhook at your private ingest URL, but nothing flows in until you explicitly attest, at /fieldy/consent, that you understand Fieldy captures everyone present and that getting any consent recording-of-others law requires is on you. We store the transcript, a summary, and action items for every conversation Fieldy sends us, including the words of anyone else who was present; segments we couldn't attribute to you are redacted 30 days after the conversation. We still have no way to get consent directly from a third-party speaker; that remains on you. |
| Mail-derived fitness signals (ClassPass / Planet Fitness / Mindbody confirmation emails) | Built, off by default | Requires an explicit account-level opt-in on top of having mail connected. When on, matching booking/confirmation emails become typed session records. |
| ChatGPT conversation import | Live, you initiate it | You upload your own ChatGPT export. Your messages (not the assistant's replies) become searchable memory and can be distilled into durable "knowledge" facts about your skills and projects via a metered Anthropic call. |
| QuickBooks | Live, opt-in per account | Once you connect it, financial records are pulled on a recurring basis. |
| Location (calendar-derived city, or GPS pings from a connected companion app) | Built, not turned on for most accounts | Sits behind a feature flag that is off suite-wide today. Listed here so the capability is disclosed before it is switched on, not after. |
| OpenWeb Ninja / BestTime (place & foot-traffic intelligence) | Not active | Wired into the code but no API key is configured. No account data reaches either provider today. |
What we send to third parties (and why)
| Service | What we send | Why | Retention by them |
|---|---|---|---|
| Anthropic (Claude API) |
The prompt for each generation, which varies by feature: your ICP profile, persona, and draft text for the B2B side; and, for the personal suite's "Self" deep-inference engine, a sampled selection of your own connected content. Correction (August 2026): an earlier version of this page said no customer-list emails and no stored contact PII ever reached Anthropic unless you typed it into a prompt yourself. That was wrong. If you've connected mail, the Self engine's sample can include mail-derived text and the names/addresses that appear in it, along with your uploaded documents and (if imported) your ChatGPT history. We do not route Fieldy conversation transcripts or raw location pings into this pipeline; those categories are excluded by design. | Runs Scope synthesis, Reach drafting, Signal posts, Orbit relationship summaries, and the personal suite's Self engine and report generation. | 30 days for abuse review, then deleted. Your prompts are not used to train Anthropic's models (per their commercial API terms). |
| OpenAI | Audio + text transcript when you use voice intake where offered (Realtime API). Separately, if the founder has turned on optional voice-note transcription for a data import, the audio you uploaded. | Conversational ICP intake; optional transcription of your own uploaded voice notes during an import. | 30 days for abuse review. Not used for training under the API ToS. |
| Resend (email send + inbound) |
Outbound email content + recipient address. For Reach replies, the inbound email is forwarded back to us. | Sending campaign + transactional email and matching replies. | 30 days of message logs in Resend's UI for your own review. |
| Stripe | Your email + the amount + the product. Card data goes directly from your browser to Stripe. It never passes through our servers. | Billing. | Per Stripe's policy. They're PCI-compliant. |
| Post text when Signal publishes. Your access token for sign-in + posting. | Publishing to your LinkedIn profile or org pages. | Per LinkedIn's policy. | |
| Unipile (LinkedIn messaging) |
Nothing unless you've connected LinkedIn messaging. When you have, message content flows through Unipile to send and receive on your behalf. | LinkedIn direct-message channel. | Dormant unless explicitly connected; per Unipile's policy once connected. |
| Fireflies.ai | Nothing unless you connect your own Fireflies account. When connected, we pull your meeting transcripts, attendees, and summaries from Fireflies. | Meeting-transcript ingestion for the personal suite. | Per Fireflies' policy for their copy; ours is kept per this page's retention section. |
| Fieldy | Nothing outbound. Fieldy pushes conversation transcripts to us (your device, your account, your choice to connect). | Ambient conversation capture for the personal suite. | Kept until you delete it; see "Personal suite" above for the third-party-speaker caveat. |
| Intuit / QuickBooks | Nothing outbound. We read your financial records once you've connected your QuickBooks account. | Financial data for the personal suite's money features. | Per Intuit's policy for their copy; ours is kept per this page's retention section. |
| Microsoft Graph | Nothing. We read from your mailbox and calendar, and the token is encrypted on our side. If you've opted into mailbox management, we can also modify/archive/label/send on your instruction. | Orbit relationship intelligence + (optional) Reach customer-domain reply inbox + personal-suite mail-derived features. | n/a, read/write per your granted scope. |
| Google (Gmail + Calendar) | Nothing. We read from Gmail and Calendar, and can send/modify only if you've opted into mailbox management. We never request the unrestricted mail.google.com scope. See /privacy §5 for the Google Limited Use disclosure. |
Relationship intelligence, drafting, scheduling, and the personal suite's mail-derived features. | n/a, read/write per your granted scope. Subject to Google's API Services User Data Policy. |
| HubSpot / Pipedrive | Nothing. They POST events to us when deals close. | Scope deal outcome auto-sync. | n/a, inbound only. |
| Slack (your incoming webhook) |
Event titles + summaries you've opted into on /integrations. No raw customer data unless you've ticked the relevant event toggle. | Notifications. | Per your Slack workspace's retention policy. |
| Your outbound webhook URL | Same payloads as Slack: JSON, HMAC-signed with your suite's SECRET_KEY so you can verify authenticity. |
Custom integrations (Zapier/Make/n8n/anything). | Your decision. We don't store the payload anywhere it isn't already. |
| OpenWeb Ninja / BestTime | Nothing. Not active. No API key is configured for either provider today. | Would power place / foot-traffic intelligence if activated. | n/a, dormant. |
What we deliberately don't do
- We don't sell your data, and we don't share it with advertisers, data brokers, or aggregator partners. There are none. (We do send specific data to the processors listed above so the product features you use can run; that's different from selling or advertising-sharing, and the table above says exactly what goes where.)
- We don't fine-tune AI models on your data.
- We don't pre-load your contacts to any service you didn't explicitly connect.
- We don't use your prompts for product analytics in a way that retains identifying content.
- We don't store credit-card numbers. Stripe does.
Per-customer isolation
Every customer's data is scoped by account_email in every table.
Cross-customer reads are gated at the application layer and the
service-mesh layer. Admins (us, the operators) can impersonate a
customer for support. When this happens, a visible orange banner
appears at the top of every page that says
"Viewing as customer@example.com · Exit impersonation"
and the action is logged.
Retention & deletion
- Audit logs: 90 days, aged out automatically by a daily background process (an admin can also run the same purge on demand from /admin/audit).
- Magic-link sign-in tokens: 30 minutes (then deleted).
- Customer-deleted ICPs / campaigns / posts: soft-deleted, purged from disk on the next archive run.
- Personal-suite mail-derived signals, Fieldy transcripts, and other learned/inferred content: kept until you delete them or delete your account. There's no fixed age-out. A 30-day redaction of Fieldy segments we couldn't attribute to the account owner ran between 17 and 23 August 2026; it was stopped on 24 August 2026 and the text it had removed was restored, because it was also removing the account owner's own words. Nothing in this category ages out today.
- Export your data: from Settings → Your data you can download a JSON copy of everything tied to your account, any time. The export is complete-or-error: if any part of it can't be assembled, it fails loudly instead of handing back a silently partial copy. Uploaded document files are included as actual content (bytes bundled directly into the export, or a real download link for anything too large to inline), not a size marker.
- Delete just one source: from Settings you can also remove everything one connector taught us (for example, everything learned from Fireflies or Fieldy) without touching the rest of your account.
- Full account deletion: from Settings → Your data you can request deletion yourself. It signs you out of the suite right away and schedules a permanent purge after a 30-day grace window, run automatically by a daily process (so an accidental request can still be undone within the window). If you've linked more than one login email to the same person, both export and deletion cover every linked identity. Prefer a human? Email hello@leadfuel.cloud.
Honest limitations (August 2026)
- We are not SOC 2 certified yet. The compliance audit is on the roadmap once we hit the customer threshold that warrants it.
- We are not currently set up to sign BAA / HIPAA-grade agreements. Don't put PHI in here.
- We do follow the EU GDPR's data-minimization and access-request principles. Write to us and we'll honor a data-subject access request.
- Fieldy's ambient capture still has no way for the other person in a recorded conversation to consent directly; they're not a LeadFuel user and we have no channel to reach them. What we have is the account owner's explicit attestation to their own consent-gathering responsibility before any Fieldy data flows in (/fieldy/consent). We previously also aged out segments we couldn't attribute to the account owner; that job was stopped on 24 August 2026, so a third party's words now persist until the account owner deletes them. We would rather say so than leave a mitigation described here that no longer runs. See the "Personal suite" section above.
- For very paranoid customers: we can configure a per-customer BYO-Anthropic-key override so your AI calls route through your own API account. Ask us.
Questions or corrections to this page? Email hello@leadfuel.cloud. Updated 2026-08-10.