Privacy Policy

1. Information We Collect

When you create an account we collect your name, your email address and a password, which we store only as a secure hash. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password. When you pay for a plan, Razorpay handles the payment: we keep the payment ID, amount, plan and date, and we never store your card, UPI or bank account details. If you write to us through the contact form, your name, email address and message are emailed to our support mailbox.

We also collect usage data through our analytics SDK on websites where our tracking code is installed: page views, click events, scroll depth, and redacted copies of the page that are used to draw heatmaps. The SDK does not record video of a session and does not log keystrokes. Section 3 sets out exactly what it captures and what it removes.

Data you add about your own customers — clients, leads, invoices, estimates and form submissions — belongs to your organisation. We store and process it only to run Leaps for you.

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve the Service, process transactions, send you notifications and updates, respond to your inquiries, and generate aggregated analytics for our customers. We do not sell your personal information to third parties.

3. Analytics Data

Our analytics SDK (qct.js) runs on the websites of our customers. On each page it records: the page address, page views, clicks (position, the element clicked, and a short label for it), repeated "rage" clicks, how far down the page you scrolled, your browser's window size and device type, JavaScript errors the page throws, and an approximate location (country, region, city) derived from your IP address. Your full IP address is not kept: only a shortened form (the first three parts of an IPv4 address, or the first three groups of an IPv6 address) is stored with the visit record, together with your browser's user-agent string. Visit records follow the organisation’s heatmap retention period, measured from their last activity. The SDK also stores a random visitor ID and session ID in your own browser so repeat visits can be counted. To draw a heatmap over the page as it actually looked, it also sends a copy of the page's HTML.

That page copy is redacted inside your browser, before it is sent. The SDK works on a copy of the page, so the page you are using is never altered, and the un-redacted page never leaves your device. Specifically:

• Anything typed into a text, email, phone, number, date or search field is replaced with the word [redacted] — never the real characters, and never the real length.
• Passwords, hidden form fields (which often hold security tokens), and the name of any file you selected are dropped entirely, with no placeholder at all.
• Text typed into a multi-line box, the option you picked in a dropdown, and anything typed into a rich-text editor are replaced with [redacted]. For checkboxes and radio buttons only the ticked / not-ticked state is kept, never the underlying value.
• <script>, <noscript> and <template> blocks, HTML comments, inline event handlers, and embedded srcdoc documents are stripped out. This also removes the embedded application data that many website frameworks print into the page.
• Link, form and frame addresses, and the address of the page itself, have values after ? or # replaced with the word redacted when they are named like a token, one-time code, password, session, API key, e-mail address, phone, mobile or WhatsApp number, card, bank account, IFSC, UPI ID, PAN, Aadhaar or passport number, or a person's name, address or date of birth. Any value that is itself an e-mail address, a UPI ID or a number of 10 or more digits (such as a phone, card, Aadhaar or account number) is replaced whatever it is called, including inside a nested address such as a redirect link. Parts of the page path that are an e-mail address or such a number are replaced the same way. Our servers apply the same redaction again when the data arrives.
• The label recorded for a click on a form field is only its type and name (for example [INPUT:email:signup_email]) — never its contents. Any other click label, and the text of any JavaScript error, is scrubbed of e-mail addresses, runs of six or more digits, card- and phone-shaped number groups, and long token-like strings.

Website owners can add the data-leaps-ignore attribute (or the older data-qct-ignore) to any HTML element — a payment form, an account summary, a chat transcript — to exclude it and everything inside it. Clicks and rage-click detection inside that element are not tracked at all, and in the page copy the element is emptied completely: only an empty box with its size and styling is kept, so the heatmap still lines up. On the screenshots our servers capture separately, everything inside the same marked elements is removed before the picture is taken and before the page copy is stored, leaving only an empty box of the same size. Our servers load a page without the part of its address after ? or #. Whole pages can be excluded under Ignored Paths in an account's website settings; for those pages no events, page copies or server screenshots are kept.

What we cannot promise. A heatmap is only useful if it looks like the page, so the page copy keeps the page's visible text, its stylesheets, class names, data- attributes and image addresses exactly as they were displayed. If a website prints personal information into the page itself — a name in a greeting, an address on an order confirmation, a document shown as an image — that is captured as it appeared on screen. The scrubbing of free text such as error messages is pattern-matching, so an unusual format can slip through. Which option is selected in a dropdown is still visible from its position in the list. Because heatmaps are grouped by the page address's path, the path is sent as it is, apart from parts that are an e-mail address or a long number. A site that puts some other secret in the path, such as a random share-link code, will send it to us and should list those pages under Ignored Paths. Marking those areas with data-leaps-ignore is the website owner's responsibility, as is telling their own visitors that Leaps is in use.

Separately, a website owner can call our identify() function to attach a user ID and e-mail address of their choosing to a session. That is a deliberate choice by the website owner; the SDK never collects an identity on its own. An e-mail address is only stored when the website passes it to identify() together with a user ID. Page copies follow the organisation’s heatmap retention period, measured from capture.

On Leaps' own website, analytics only runs if you choose Accept All in the cookie banner. You can change your choice at any time from Cookie settings in the footer of our public pages; choosing Essentials Only or Disagree stops it straight away and deletes its visitor and session IDs from your browser. If you are signed in and have accepted, we attach your Leaps account ID and e-mail address to your visits; this stops as soon as you withdraw. We never record invoice or estimate share links, team invitation links, or password-reset and e-mail verification pages.

Short links and forms. When someone opens a Leaps short link, including a QR code that uses one, we record the date and time, a shortened form of their IP address (the first three parts of an IPv4 address, or the first three groups of an IPv6 address), their browser's user-agent string and whether they were on mobile or desktop. The link's owner sees the number of visits and the mobile and desktop split. These records are kept until the owner deletes the link, or the account or organisation that owns it is deleted. When someone submits a form made with Leaps (MailerHub), we store what they entered, any files they attached and their IP address for the website owner, until the owner deletes it.

4. Data Security

We implement industry-standard security measures including encrypted data transmission (TLS/SSL), secure authentication (JWT with HS256), password hashing (bcrypt), and role-based access controls. Your data is stored on secure servers with nightly backups.

5. Data Retention

We keep personal data only as long as we need it:

• Your account: for as long as it exists. Section 7 explains how to delete it.
• Analytics events (page views, clicks, scrolls and errors): removed by daily cleanup after the current plan’s retention period: 30 days on Free, 60 days on Studio and 365 days on Business. Platform-admin organisations use a 365-day period. A plan change applies its retention period at the next cleanup.
• Visit records (including the shortened IP address and user-agent string): removed by daily cleanup after the same plan-based retention period, measured from last activity.
• Page copies and page screenshots used for heatmaps: removed by daily cleanup after the same plan-based retention period, measured from capture. Free allows up to 200 stored snapshots per organisation; Studio allows 500 new snapshots per organisation per UTC calendar month.
• Deleting a website from your dashboard deletes its analytics events, visit records, page copies and screenshots straight away.
• Email log: a record of each email Leaps sends (recipient, subject, type and whether it was sent, never the message itself) is kept for 90 days.
• Team invitations, which hold the invited person's email address, are deleted 7 days after they were last sent.
• Short-link visits (including the shortened IP address and user-agent string): until the owner deletes the link, or the account or organisation that owns it is deleted.
• Form submissions and business records (clients, leads, invoices, estimates): until you delete them, or the organisation they belong to is deleted.
• Payment records and our audit log (a record of changes to accounts, money and access, with the e-mail address of the person who made each change): kept even after an account is deleted, because they record money that moved and changes made on the platform.
• Newsletter: if you subscribe, we keep your email address. Unsubscribing stops the emails; write to us if you also want the address removed.
• Backups: the database is backed up every night and we keep the last 14 backups, so deleted data can remain in a backup for about two weeks.

6. Who Helps Us Run Leaps

We share personal data only with the services that run Leaps for us (our sub-processors), and only what each one needs:

• MongoDB Atlas: our database.
• Cloudflare R2: file storage (organisation logos, files attached to form submissions, invoice and estimate PDFs, QR code images, page copies and screenshots, and database backups).
• Razorpay: payments.
• Zoho Mail: sending and receiving our email.
• Google: sign-in, only if you choose Continue with Google.

If your organisation connects its own email account or Razorpay account, that organisation's emails and payments go through those services instead, under its own agreement with them. These services have their own privacy policies. We may also disclose data when the law requires us to.

7. Your Rights

Under India's Digital Personal Data Protection Act, 2023 and similar laws, you can ask to see, correct or erase your personal data, withdraw consent you have given, and raise a grievance. You can do most of this yourself in Leaps:

• Download your data: Account Settings → Data & Privacy → Export All My Data gives you a JSON file with your profile and what you have created: clients, leads, invoices, links, websites, MailerHub data, activity and favourites.
• Correct your details: change your name in Account Settings. For anything you can't change there, write to us.
• Delete your account: Account Settings → Delete My Account. Your account is deleted straight away, together with every organisation where you are the only owner and everything in it. Organisations that have another owner carry on, and what you added there stays with them. Payment records and the audit log are kept (see section 5), and copies in backups disappear within about two weeks.
• Withdraw analytics consent on our website: Cookie settings in the footer of our public pages.

For anything else, or if you are unhappy with how we have handled your data, write to our Grievance Officer (section 11). You can also complain to the Data Protection Board of India.

If you visited a website that uses Leaps analytics or a Leaps form, that website's owner decides what is collected and we process it for them, so please contact them first.

8. Cookies

We use cookies and similar browser storage to keep you signed in, remember your preferences and, only if you accept, measure how our website is used. See our Cookie Policy for details; you can change your choice at any time from Cookie settings in the footer of our public pages.

9. Children

Leaps is meant for businesses and is not intended for anyone under 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact and Grievance Officer

For questions about this Privacy Policy, to exercise your rights, or to raise a grievance, write to: