Privacy Policy and Data Use — CrazyLeads

1. About CrazyLeads

CrazyLeads is a tool that allows searching, analyzing and displaying reports on data collected through Facebook, as well as behavioral page data (via pixels) and integrations with other platforms. Our goal is to provide insights and analysis to help our users optimize their marketing and sales strategies.

2. Information we collect

We may collect and process the following types of information:

• Facebook data: information provided by Facebook, such as user identifiers, campaign data, ad metrics and other statistics permitted by the Facebook APIs. This information is only obtained when the user grants the necessary permissions to our tool.
• Page behavior data (Pixel): information about user navigation on sites where our pixel is installed, such as page views, clicks and conversion events.
• Data from other integrations: if you choose to sync data from other tools (for example CRMs, email marketing services or other platforms), we may collect and store information relevant to the analysis (such as leads, contacts or campaign metrics).

2.1. Google Ads integration

When you connect your Google Ads account to CrazyLeads, we collect data through the platform's official API, with the permissions you explicitly grant. The data collected may include campaigns, ad groups, ads, performance metrics (e.g. impressions, clicks, conversions) and other statistical information made available by the Google Ads API.

The purpose of collecting this data is exclusively to provide analytical features to the user, such as building dashboards, charts and performance reports. No data is shared with third parties, used for commercial purposes, or modified inside your Google Ads account.

The requested access scope permits reading and, where applicable, writing data. However, CrazyLeads uses that scope for reading only, making no changes to users' accounts.

We fully comply with Google's data policy guidelines, including the requirement that access can be revoked at any time through the Google account permissions panel.

Use of Artificial Intelligence (AI). CrazyLeads uses AI algorithms exclusively to generate insights, analysis and personalized recommendations based on data provided by the user themselves, such as advertising campaign information obtained via the Google Ads API. That data is processed for individual use only, to make results easier to interpret and to support strategic decisions. No data is used to train generalized AI or machine learning models, nor is it shared with third parties for that purpose. Data obtained through Google APIs, including Google Ads, is used solely within the authorized limits and is not employed to improve or develop general-purpose AI models.

2.2. Messages and comments (Instagram, Messenger and WhatsApp)

When a business connects an Instagram professional account, a Facebook Page or a WhatsApp Business number and turns on conversation management, CrazyLeads receives, through Meta's official APIs and with the permissions granted by the business itself:

• the messages people send to that account (Instagram Direct, Messenger or WhatsApp), with their text, attachments and date;
• who sent them: the name or username, on Instagram and Messenger, and the phone number, on WhatsApp;
• the comments left on the business's own posts, with the name of who commented;
• the replies the business's team sends through CrazyLeads and, on WhatsApp, their delivery status.

This data is used only so the business's team can read and answer conversations and comments on the source's Management tab and, on WhatsApp, to record each message in the contact's history inside the business's project. Replies are written by people on the team: from its screen, CrazyLeads does not start conversations or send bulk messages.

Storage. Messages are kept in the isolated data space of the business's project and are visible only to members of that project. Facebook Page comments are read live from Meta, without a copy. Media received on WhatsApp is kept in private storage and opened through temporary links.

Sharing. WhatsApp messages are also delivered to the apps that the business itself authorizes on CrazyLeads to read them. Instagram Direct and Messenger messages are not delivered to partner apps. Otherwise, section 4 applies. We do not sell this data or use it for advertising.

AI assistant. CrazyLeads has an AI assistant that answers the team's questions about its own project's data. When someone on the team uses the assistant, it may read these messages and send the excerpts it needs to answer to AI model providers that process the data on CrazyLeads' behalf, currently Anthropic and OpenRouter. CrazyLeads does not use these messages to train AI models. If the business itself connects an AI assistant of its choice to CrazyLeads (through our MCP server), that assistant can also read this data on the business's behalf.

Deletion. The business can delete the source at any time, under Settings › Danger zone › Delete source, which stops collection and erases that source's tables; the conversations and history already recorded on each contact's profile stay in the project until a deletion request is made. People who sent messages can ask for their data to be deleted through the email in section 9 or the data deletion instructions.

3. How we use information

The data collected is used to provide reports, analysis and insights in the CrazyLeads dashboard, allowing you to make strategic decisions based on more accurate results. Examples of use:

• Generating real-time reports and statistics
• Monitoring campaign and ad performance
• Audience segmentation and behavioral analysis
• Optimizing marketing and sales strategies

4. Data sharing

We do not sell or share user data with third parties without the user's express consent, except where necessary to:

• comply with legal or regulatory obligations, or relevant government requests;
• protect our rights, privacy, security or property, or those of our users;
• comply with the terms and policies of integrated platforms (for example, Facebook's Policies);
• rely on vendors that process data on our behalf to provide the service, such as the AI assistant's model providers (section 2.2).

5. Storage and security

We use reasonable administrative, technical and physical security measures to protect the information stored on our servers. Although we work to keep your data secure, no system is completely infallible. In the event of security incidents that may affect your data, we will take appropriate measures and notify affected users as required by law.

Retention. A project's leads and event history are kept for as long as the project exists; they have no automatic expiration. Technical records have their own periods: execution logs of the event services for 30 days; delivery and automation records for up to 90 days; event field values used for suggestions for 120 days; account and MCP server access records for 180 days, and known devices (IP, browser and country) for up to 400 days after last use; and usage and cost metrics, with no contact data, for up to 25 months (they may hold the internal id of the account user who performed the action). For connected apps, access tokens last 1 hour and refresh tokens 90 days.

When the owner deletes a project, its leads, events, sources, queries and artifacts are removed from active systems by an automated process, and a backup copy is kept for up to 180 days before being discarded. The process includes Inbox conversations and the analytics databases of older projects. The technical and measurement records above follow their own periods until they expire. Unused free-plan projects are closed automatically: with data, they get notices from 45 days without use, stop collecting at 90 and are deleted from 180 days; if they never received data, they get notices at 15 and 30 days and are deleted from 45.

6. User rights

Depending on applicable law, you may have the right to access, correct, update or request deletion of your personal information. To exercise any of these rights, contact us at the email address below. We will do our best to meet your request within the timeframes set by applicable law.

7. Compliance with Facebook policies

CrazyLeads follows the Facebook Platform Policies. This includes proper use of the APIs, protection of user data and respect for the permissions granted. We do not access or use information beyond what is necessary to provide our services, and any information collected is protected as described in this policy.

8. Updates to this Policy

We reserve the right to modify this Privacy Policy at any time, with adequate prior notice to users whenever there is a material change. The most recent version will be available on our website, with the date of last update at the top of the document.

9. Contact

For questions, complaints or requests related to this Privacy Policy or the use of your data in CrazyLeads, contact us at: douglas@vtsd.com.br.

10. Language

This English text is a convenience translation. The Portuguese version is the governing text and prevails in the event of any divergence between the two.