Privacy Policy

Last updated: April 2026

CatchLead ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal data when you use our website at catchlead.ai and our WhatsApp-based AI assistant service (together, the "Service").

We are a UK-based company and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO).

1. Who We Are

CatchLead is operated by CatchLead Ltd, a company registered in England and Wales under company number 17079928. For questions about this policy or your data, contact us at: privacy@catchlead.ai

2. What Data We Collect

2.1 Data from Tradespeople (our customers)

When you create an account and use CatchLead, we collect:

  • Account information: name, email address, phone number, business name, trade type, postcode, coverage area
  • Service configuration: working hours, price ranges, services offered, emergency keywords
  • Payment information: processed securely by Stripe. We do not store your full card details
  • Usage data: conversations handled, leads qualified, features used, login times

2.2 Data from End Customers (your customers)

When a customer messages your WhatsApp Business number, we process:

  • Contact information: phone number, WhatsApp display name
  • Message content: text messages sent to and from your business number
  • Lead data: job type, location, urgency, and other details extracted during the conversation
  • Booking data: calendar slots booked, appointment times

3. How We Use Your Data

3.1 For Tradespeople

  • To provide the CatchLead service (AI-powered WhatsApp responses, lead qualification, booking)
  • To manage your account and subscription
  • To send you daily summaries and service notifications via WhatsApp
  • To improve our AI conversation quality and service reliability
  • To provide customer support

3.2 For End Customers

  • To respond to WhatsApp enquiries on behalf of the tradesperson
  • To qualify leads and provide rough price estimates
  • To book calendar appointments
  • To detect emergencies and alert the tradesperson

4. Legal Basis for Processing

We process personal data under the following legal bases:

  • Contract: processing necessary to provide our Service to tradespeople who have signed up
  • Legitimate interest: processing end customer messages on behalf of the tradesperson to handle business enquiries, which is the core purpose of the Service
  • Consent: where required, such as for marketing communications
  • Legal obligation: where we are required to retain data for tax, accounting, or regulatory purposes

5. Data Sharing

We share personal data only with the following categories of recipients, and only as necessary to provide the Service:

  • Anthropic (Claude API): message content is sent to Anthropic's API for AI processing. Anthropic does not use this data to train their models. See Anthropic's privacy policy
  • Meta (WhatsApp Business API): messages are transmitted via Meta's WhatsApp Business Platform. See WhatsApp's privacy policy
  • Supabase: our database provider, hosting data in EU data centres
  • Stripe: for payment processing. See Stripe's privacy policy
  • Google: for calendar integration, only when enabled by the tradesperson

We do not sell personal data to third parties. We do not share data for advertising purposes.

6. Data Roles

Under UK GDPR, the tradesperson is the data controllerfor their end customers' personal data. CatchLead acts as a data processor, processing this data on the tradesperson's behalf and according to their instructions.

CatchLead is the data controllerfor tradespeople's own account data.

A Data Processing Agreement (DPA) forms part of our Terms of Service and governs how we process end customer data on behalf of tradespeople.

7. Data Retention

  • Conversation logs: retained for 12 months from the date of the last message, then automatically deleted
  • Lead data: retained for 12 months from creation, then automatically deleted
  • Account data: retained for as long as your account is active, plus 30 days after account deletion
  • Payment records: retained for 7 years as required by UK tax law
  • Usage analytics: retained in anonymised form indefinitely

Tradespeople can request earlier deletion of conversation and lead data at any time.

8. Data Security

We protect your data with:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Access controls and authentication on all systems
  • Database-level row security (each tradesperson can only access their own data)
  • Regular security reviews and monitoring
  • Secure payment processing via PCI-compliant Stripe

9. Your Rights (UK GDPR)

You have the following rights regarding your personal data:

  • Access: request a copy of the data we hold about you
  • Rectification: request correction of inaccurate data
  • Erasure: request deletion of your data (subject to legal retention requirements)
  • Restriction: request that we limit how we process your data
  • Portability: request your data in a machine-readable format
  • Objection: object to processing based on legitimate interests

To exercise any of these rights, email us at privacy@catchlead.ai. We will respond within 30 days.

End customers wishing to exercise their rights should contact the tradesperson directly in the first instance. Tradespeople can delete customer data via the CatchLead dashboard or by contacting us.

10. Cookies and Analytics

Our website uses essential cookies required for authentication and session management. We use PostHog for product analytics, which processes anonymised usage data. We do not use advertising cookies or third-party tracking.

11. International Transfers

Some of our service providers (Anthropic, Stripe) are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

12. Children

Our Service is not intended for individuals under the age of 18. We do not knowingly collect data from children.

13. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes via email or WhatsApp. The "last updated" date at the top reflects the most recent version.

14. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We encourage you to contact us first at privacy@catchlead.ai so we can try to resolve your concern.