Your information deserves a clear answer.

Synthetic testing only

Real customer intake is not authorized. Public Growth Audit requests and hosted website checks are closed. Do not enter real personal or customer information into the test application. The questionnaire can generate a browser-only snapshot without sending those answers to LeadMoko.

For privacy requests, email privacy@leadmoko.com. For general questions, email hello@leadmoko.com. The operator reported successful send and receive tests for both addresses.

Collection and purpose

The public questionnaire stays in your browser. In synthetic test environments, website checks send the URL to this server, which requests one public page and may follow up to three validated redirects. Do not include private paths, access tokens, query strings, or sensitive personal information. Full website findings and AI reports are not saved in the lead database.

When intake is separately authorized, a consultation request is designed to store a contact name, email, business name, optional public website and service area, category, goal, readiness answers, consent choices, privacy notice version, submission time and request reference. The founder can add follow-up status, internal notes and a status-change time. These details support review and response to the request. A city or region is enough; do not provide a home address, customer lists, passwords, payment details or sensitive notes.

Required contact consent concerns this request only. Optional marketing consent is separate, unchecked by default and not required. No marketing subscription or automated messaging is activated by submission.

Storage, access and integrations

Synthetic requests are stored in a server-side SQLite database outside public website files. Railway staging and the separate production service use persistent volumes. The application does not encrypt the live SQLite file. Platform storage protection must be verified separately. Administrative review requires authentication; authorized maintenance access relies on host permissions. Railway's published terms describe primary processing in the United States; account-specific logging, access, retention and processing facts remain under review.

The hosted adapter requires AI disabled, zero AI request allowance and application email disabled. No AI, automatic email, payment checkout or analytics integration is active for public intake.

Security/session cookies support CSRF protection and administrator login. The CSRF cookie expires after one hour and the admin cookie after twenty minutes; production cookies use Secure, HttpOnly and SameSite=Strict. No analytics cookies are used.

Retention and deletion

The operator approved a future policy of 90 days for New/Lost prospects, 180 days for Contacted/Qualified prospects and up to 365 days for Won/customer records, with earlier deletion where appropriate after relationship closure. CSV exports are to be deleted after use, within seven days. Encrypted backups are planned on a 30-day rolling window. These are policy targets, not a claim that automatic enforcement or independent backup operations are active.

Current synthetic environments may retain test evidence for acceptance review. Cleanup runs at startup or through operator action, not on an automatic daily schedule. Status changes affect the relevant retention clock; note edits do not.

Authenticated deletion removes the full active record, including consent and notes. It does not erase independent Railway, PC or removable-media backups, exports or downloads. Encrypted backups require a separate expiry policy; verified deletions and consent changes must be reconciled before restored data is used.

Logs and privacy requests

Application access logging is disabled and production error messages are sanitized. Railway may separately process request metadata; its actual collection, access and retention policy still requires verification. Disabling application logs does not disable platform logs.

To request access, correction, deletion or withdrawal, email privacy@leadmoko.com. Requests must be verified through that private contact channel without collecting unnecessary identity documents. A contact request is not blanket permission for marketing.

Canadian privacy/legal review, independent backup and recovery verification, and explicit owner authorization remain required before real-customer intake. This notice is not a claim of legal compliance.