Privacy Policy

This Policy applies to Openleet websites, applications, business profiles, hosted tenant websites, dashboards, AI-assisted tools, analytics, bookings, forms, integrations, domain services, and related support communications (collectively, the “Service”).

Openleet is responsible for personal information under its control and designates a Privacy Officer to oversee privacy practices. Questions, access requests, corrections, deletion requests, withdrawals of consent, and complaints may be sent to info@openleet.com with “Privacy” in the subject line.

This Policy should be read with our Terms of Service. A business using Openleet may also be responsible for its own privacy notice and handling of customer information.

Account and identity information

• Name, email address, account identifier, authentication status, profile image, and communication preferences.
• Business ownership, claim, authorization, team-member, and account-recovery information.
• Support messages, reports, feedback, and communications with Openleet.

Business and published content

• Business name, description, category, address, service area, contact details, operating hours, licences, external ratings, social links, and other profile information.
• Websites, articles, products, services, menus, events, galleries, FAQs, testimonials, team information, sustainability information, prices, offers, and uploaded media.
• Publication status, navigation settings, branding, domain, DNS, SEO, structured-data, and integration configuration.

Customer and operational information

• Booking-customer name, contact details, requested service, appointment time, address or service region, status, and notes entered through a business’s website.
• Contact-form submissions, inbox communications, subscriber information, testimonials, and business-customer interactions.
• Business schedules, booking rules, resources, service regions, availability, and operational settings.

Technical and usage information

• IP address or a hashed representation, browser, device, operating system, language, approximate location, request time, host, and security logs.
• Pages, titles, content, buttons, forms, searches, referrals, UTM campaign values, and feature interactions.
• Cookie or session identifiers, consent choices, bot classification, error information, and performance data.

Billing and domain information

• Plan, invoice, billing contact, amount, currency, tax, transaction identifier, payment status, refund, and purchase history.
• Domain name, registrar or registry response, DNS configuration, verification status, and renewal information.

When an account holder publishes business content, Openleet may make it available through Openleet.com, public business profiles, hosted websites, custom domains, directory and Explore pages, search results, feeds, sitemaps, structured data, social previews, and machine-readable resources intended for search engines and AI systems.

Public content may be indexed, cached, archived, quoted, or copied by search engines, AI assistants, social networks, web archives, and other independent parties. Openleet cannot control how those parties retain or use information after receiving it publicly.

Account holders should publish only information they have the right to disclose. Do not enter passwords, payment-card information, private keys, government identifiers, confidential customer records, health information, or other sensitive information in public fields, URLs, posts, media, metadata, or AI prompts.

• Create, authenticate, secure, support, and administer accounts.
• Build and deliver business profiles, websites, content, directories, bookings, domains, DNS, and related features.
• Publish content selected by an account holder and make it discoverable.
• Process purchases, subscriptions, refunds, accounting, and fraud checks.
• Generate AI-assisted drafts, assessments, suggestions, reports, and visibility analysis requested through the Service.
• Measure traffic, referrals, feature use, conversions, reliability, and performance.
• Personalize dashboards, recommend improvements, and develop new features.
• Prevent fraud, spam, abuse, infringement, security incidents, and violations of our Terms.
• Communicate about accounts, transactions, security, support, service changes, and—with appropriate consent—marketing.
• Comply with law, enforce agreements, establish or defend legal claims, and protect users and the public.

We limit collection, use, and disclosure to purposes a reasonable person would consider appropriate in the circumstances. If we propose a materially new purpose, we will provide notice and obtain additional consent where required.

Openleet does not sell or intentionally disclose account passwords to advertisers, analytics providers, AI providers, business owners, or payment providers. Where password authentication is used, Openleet stores protected credential information rather than a readable password. Authentication providers may process login information when a user chooses their service.

No security system is perfect. Users must keep credentials confidential, use unique passwords, and notify Openleet of suspected unauthorized access. Openleet support will not ask a user to place a password or one-time security code in a public field or AI prompt.

Full payment-card and bank-account credentials are collected and processed by payment providers such as Stripe and PayPal under their own terms and privacy policies. Openleet does not store full card numbers, card security codes, or online-banking passwords.

Openleet receives and retains limited transaction information needed to operate the Service, such as customer or payer reference, invoice, transaction or subscription identifier, amount, currency, status, payment method type, refund information, and fraud or dispute results.

When a user activates an AI feature, Openleet may send the user’s prompt, selected public business information, drafts, content, and instructions to OpenAI or another disclosed AI service provider. This processing supports drafting, rewriting, suggestions, assessments, content-quality review, FAQ ideas, visibility reports, and similar requested functions.

Openleet does not intentionally send private booking-customer information to an AI provider as part of standard AI content and assessment features. If a future feature requires that processing, Openleet will provide appropriate notice and require deliberate user action and authority. Users must not include passwords, financial credentials, health data, confidential customer records, or other sensitive information in AI prompts.

OpenAI states that API data is not used to train its models by default unless the API customer opts in, and standard API inputs and outputs may be retained for a limited period for abuse monitoring unless different controls apply. Provider practices can change; see the OpenAI enterprise privacy information.

Openleet may retain prompts, generated results, assessment records, and user actions when needed to provide history, allow review, improve the feature, investigate abuse, or meet legal obligations. AI output is not guaranteed to be accurate and should be reviewed before use.

Openleet analytics

Openleet’s own analytics may record a session identifier, page path, title, hostname, referral domain, UTM source, medium and campaign, content and button interactions, searches, form or booking events, browser user-agent, bot status, and a hashed representation of an IP address. The current first-party analytics session cookie may remain for up to 180 days. Business owners may receive aggregated reports about activity on their profiles and websites.

Vercel Web Analytics

Vercel may process page URL, referrer, approximate location, browser/device information, and aggregated request information to provide hosting analytics. Vercel describes Web Analytics as cookie-free and designed not to retain directly identifying visitor information. See Vercel Analytics privacy information.

Ahrefs Web Analytics

Ahrefs may process page URLs, referrers, user-agent information, browser language, interaction events, and city/country derived from an IP address to provide aggregated traffic and referral reporting. Ahrefs states that its standard Web Analytics service is cookie-free, does not store raw IP addresses, and does not use persistent cross-site identifiers. See Ahrefs Web Analytics information.

Google Analytics

Where activated, Google Analytics may use first-party cookies or identifiers and process page activity, sessions, approximate location, browser, device, referral, and interaction information. Optional analytics should load according to applicable consent choices. See Google Analytics data collection.

Consent preferences may be stored in a cookie or browser local storage. Blocking or deleting storage may cause the consent panel to reappear or may affect optional features. Essential authentication, security, routing, load-balancing, and preference storage may operate without an optional analytics choice where permitted by law. Visitors can withdraw or update optional consent at any time by using the Cookie settings or Privacy settings button shown near the bottom of the website.

An ADVANCED website owner may activate third-party tools such as Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, Microsoft Clarity, TikTok Pixel, LinkedIn Insight, or Pinterest Tag. Verification tools such as Google Search Console or Bing Webmaster may also be used.

Openleet’s tenant consent interface is designed to prevent optional analytics and marketing scripts from loading until the visitor makes a choice. The business owner is responsible for selecting a lawful configuration, accurately describing its purposes, honoring visitor choices, and complying with each provider’s requirements.

These integrations are controlled for the benefit of the relevant business owner, which may receive resulting reports. Visitors should also review that business’s privacy notice. Openleet may disable an integration that presents security, privacy, or legal risk.

Openleet does not sell personal information. We disclose limited information to providers that perform functions on our behalf, subject to contractual, technical, and organizational protections appropriate to the service. Depending on the features used, recipients may include:

• Vercel and infrastructure providers: hosting, content delivery, security, logs, file storage, analytics, domains, and DNS.
• Database and storage providers: application records, business content, customer information, backups, and uploaded files.
• OpenAI and AI providers: user-initiated prompts, selected business content, instructions, and generated results.
• Google services: analytics, maps, places/address verification, reCAPTCHA, search verification, and owner-enabled advertising.
• Ahrefs: aggregated website traffic, referral, browser/device, and interaction measurement.
• Stripe, PayPal, and payment providers: payment, subscription, refund, fraud, and dispute processing.
• Email and communication providers: account notices, transactional messages, support, and consented marketing.
• Domain registrars, registries, and DNS providers: domain availability, registration, verification, renewal, and routing.
• Security, monitoring, professional, accounting, and support providers: fraud prevention, incident response, legal compliance, and business operations.

We may also disclose information:

• At the user’s direction or with consent.
• To the relevant business owner when a visitor submits information through that business’s website.
• When reasonably required by law, legal process, regulators, or to protect rights, safety, security, and platform integrity.
• In connection with financing, reorganization, merger, acquisition, sale, or transfer of relevant business assets, subject to appropriate confidentiality protections.

When a visitor contacts, subscribes to, books with, or otherwise interacts with a business through a tenant website, Openleet processes information to deliver that functionality and make it available to the business owner. The business determines its services, required fields, follow-up, and business use of that information.

The business owner is responsible for providing its own required privacy notice, collecting only information it needs, managing lawful consent, limiting staff access, responding to customer rights, and not using information for unrelated or unlawful purposes. Requests about a business’s independent use should normally be directed to that business; Openleet will assist where appropriate.

Openleet sends operational messages needed for accounts, security, purchases, domains, bookings, and service administration. Promotional email is sent based on consent or another lawful basis. Marketing messages will identify the sender and include a working unsubscribe method where required.

Unsubscribing from marketing does not prevent necessary account, security, billing, or transactional messages. We retain suppression information needed to respect an unsubscribe request.

Openleet and its providers may process or store information in Canada, the United States, and other jurisdictions where providers operate. Information processed outside a person’s province or country may be accessible to courts, law enforcement, and authorities under local law. We use contracts and other safeguards appropriate to the service and sensitivity of the information.

We retain information only as long as reasonably required to provide the Service, maintain an account or published business presence, complete transactions, honor user choices, resolve disputes, prevent fraud and abuse, enforce agreements, maintain security and backups, and meet tax, accounting, legal, or regulatory obligations.

Retention varies by record and provider. Public content may remain until unpublished or deleted by an authorized user or Openleet. Some records may remain temporarily in backups, logs, search caches, or third-party indexes. Transaction, consent, security, infringement, and legal records may be retained after account closure where necessary.

When deletion is appropriate, Openleet removes or de-identifies information from active systems under its control, subject to lawful retention requirements and reasonable backup cycles. Public content previously copied or indexed by search engines, web archives, scrapers, AI services, or other independent third parties is controlled by those parties and may remain until updated or removed according to their policies and schedules. Where appropriate and legally required, Openleet may take reasonable steps to request correction or removal, but cannot guarantee deletion from systems it does not control.

Openleet uses administrative, technical, and organizational safeguards intended to protect information based on its sensitivity. Measures may include access controls, protected credentials, encrypted transport, provider security controls, logging, backups, rate limiting, and restricted administrative access.

Openleet assesses suspected privacy and security breaches and takes reasonable steps to contain, investigate, document, and mitigate them. Where required by applicable law, Openleet will notify affected individuals, the Office of the Privacy Commissioner of Canada, or other applicable privacy regulators as soon as feasible. Under PIPEDA, a breach involving personal information under Openleet's control that creates a real risk of significant harm will be reported and affected individuals will be notified as required by law. Openleet maintains records of privacy and security breaches for the periods required by applicable law.

No internet service can guarantee absolute security. Users should avoid unnecessary sensitive information, secure their accounts, review team access, and report suspected incidents promptly to info@openleet.com.

Subject to applicable law and permitted exceptions, a person may ask to:

• Learn whether Openleet holds personal information about them and how it has been used or disclosed.
• Access personal information under Openleet’s control.
• Correct inaccurate or incomplete information.
• Delete information or close an account where retention is not required.
• Withdraw consent, understanding that this may prevent some features.
• Change optional analytics or marketing choices.
• Challenge Openleet’s compliance and receive information about the complaint process.

Requests may be sent to info@openleet.com. We may need to verify identity and authority before responding. We may deny or limit a request where permitted or required by law and will explain the reason where appropriate.

Openleet accounts and business-management services are intended for adults and are not directed to children under 13. A person must be at least 18 to create or manage a business account unless an authorized adult or organization lawfully supervises the activity.

Businesses offering services involving children must not publish a child’s personal information or collect unnecessary information through Openleet. The business is responsible for required parental or guardian consent and industry-specific obligations. Contact us if you believe a child’s information was submitted improperly.

We may update this Policy when the Service, providers, data practices, or law changes. We will revise the date above and provide additional notice for material changes where reasonably appropriate.

Contact the Openleet Privacy Officer at info@openleet.com. Include your name, relationship to Openleet, the relevant business or account, and a clear description of the request. You may also contact the appropriate Canadian or provincial privacy regulator if a concern is not resolved.