Privacy policy

Last updated November 5, 2026

LeadVault.com is run by SiteTools, Inc. LeadVault is software that mortgage lenders, brokers and other companies (our customers) use to collect and work their leads. This policy explains what we do with personal information: for the people who use LeadVault, and for the people whose information our customers keep in it.

Information our customers keep in LeadVault

Our customers collect information about their leads and website visitors through LeadVault: quote forms on their websites, Facebook and Instagram lead ads, lead providers, imports and their own entries. Depending on the customer, that can include names, contact details, property and loan details, answers to their questions, notes, call recordings and voicemails with their words and short summaries and, where a customer asks for them, dates of birth and Social Security numbers.

We handle this information for our customers and on their instructions, as their service provider. Each customer decides what to collect, how it's used, who it's shared with, and how long it's kept. If you gave your information to one of our customers, their own privacy policy applies, and they're the one to ask to see, correct or delete it. If you contact us instead, we'll pass your request to them and help them answer it.

When someone calls one of our customers' phone numbers, we keep the number they called from, when they called and for how long, and the recording or voicemail, with its words, on their lead. A caller the customer didn't have yet becomes a new lead, with just that number until someone adds more. Each call says it's recorded before anyone answers.

Some customers have Vaulty, LeadVault's AI assistant, answer their calls. Vaulty says it's an AI. What the caller says is turned into text by Twilio's speech recognition and sent to Anthropic's Claude, which writes Vaulty's answers; Twilio's voice speaks them. Vaulty asks for the caller's name, number, email and the customer's questions, and puts their answers on their lead with a short summary and the conversation's words. It's told never to take Social Security, card or bank numbers or passwords, and anything shaped like a Social Security or card number is removed from what's kept. Twilio and Anthropic handle the call only to provide this service.

Forms on our customers' websites

A customer's form runs on LeadVault but carries the customer's name, not ours. It saves each answer as it's given, so a visitor can come back to where they left off. Your information goes to the customer once you send your contact details on the form.

With each lead, LeadVault also keeps the rough place its IP address belongs to (city, state and country). It's looked up in a database kept on our own server, so the address isn't sent anywhere to do it.

If a visitor stops before that, the customer's setting decides how long the unfinished answers keep who the visitor was: 90 days unless they change it. After that we take out the name, email, phone, address, zip code, IP address and browser, and keep the rest with nothing that identifies anyone.

Some forms let visitors type answers and questions to an AI assistant. It's never given the visitor's name, email, phone, address, date of birth or Social Security number, and anything shaped like a Social Security or card number is removed from a message before it's sent.

People who use LeadVault

When our customers' staff use LeadVault, we keep their name, email, phone and cell phone if they give them, password (scrambled so it can't be read), two-step sign-in setup, time zone, and voice notes they record. A cell phone is used only to ring them with calls to their company's numbers, when their admins turn that on, and to text them alerts about new leads and missed calls, when they turn that on themselves. Those texts go through Twilio; replying STOP ends them. We don't share cell phone numbers, or the consent to text them, with anyone for their own marketing. We also keep when and from where they sign in (IP address and browser), and a log of important actions, such as exports and viewing a Social Security number.

When an account pays for LeadVault, its admin enters the card on our payment processor Stripe's own page. Stripe keeps the card details; we never see or store them. We keep only what we need to know about the account's plan: whether it's paid, until when, and for how many people.

When an account's admin sets up caller ID, we keep the company's legal name, tax ID (EIN), address and website, and the name, job title, email and phone of the person who answers for it. We send them to Twilio, which checks them with the phone companies so the company's calls show its name and aren't marked as spam, and use them for nothing else. When the admin registers the company for texting, we also send Twilio what the company texts about, how people agree to its texts, two example texts and the addresses of its privacy policy and terms, which Twilio sends to the phone carriers' registry.

When an account's admin moves the company's own phone numbers to LeadVault, we keep the name, phone number and service address on its phone company account, and the name and email of the person who signs for it. We send them, with the phone company account number, any port-out PINs and a copy of a recent bill, to Twilio, which sends them to the phone company to move the numbers and emails the signer a form to sign. The account number, PINs and bill go only to Twilio: we don't keep them.

Connecting Gmail, Outlook and calendars

People who use LeadVault can connect their own Gmail or Outlook mailbox on their settings page, to send email to leads from it. LeadVault then asks Google or Microsoft for permission to send email as that person, and for their email address, and nothing more. We use it only to send the emails they write to their leads in LeadVault, when they press Send; each one is kept on that lead's timeline in the customer's account. We never read, search or keep anything else in the mailbox.

A connected Gmail or Outlook is for one-to-one email only: each email goes to one lead, written by the person and sent when they press Send, up to 300 a day. LeadVault never sends bulk email, drips or any other automated email through anyone's Gmail or Outlook; those go out through our own sending service, Amazon SES. And like every email from LeadVault, it goes only to a lead who agreed to get email, as below.

They can also connect the calendar of that Google or Outlook account. LeadVault then puts their appointments and callbacks from LeadVault on it (the time, the lead's name, the place and their note, with a link back to the lead), and changes or removes those events as they change in LeadVault. From the rest of the calendar it reads only when they're busy (start and end times, not what the events are), so the booking links they send skip those times and the LeadVault calendar shows them. Busy times are held for a few minutes and never stored; nothing they change in Google or Outlook comes back into LeadVault.

For a video call, Google or Microsoft adds a Google Meet or Teams link to the event, and LeadVault keeps that link to show on the lead and on the lead's booking page. When the lead has an email address, the event invites them: their name and email address go to Google or Microsoft as a guest, and Google or Outlook emails them the invite, any change, and the cancellation. An invite shows the time, the place and who the call is with, never the user's notes.

The access Google or Microsoft gives us is stored encrypted. It isn't shared with anyone, used for advertising, used to train AI models, or looked at by people, except to keep LeadVault secure or where the law requires. Disconnecting on the settings page ends it and takes LeadVault's events still ahead off the calendar (apart from invites a lead was sent, which stay so they aren't told the call is cancelled), and it can also be removed in the Google or Microsoft account. LeadVault's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Our customers and the people who use LeadVault for them may email only contacts who have consented to receive sales and marketing emails from them. Sending email to anyone who hasn't, and sending spam, isn't allowed. LeadVault holds every email to this, whether it goes from a connected Gmail or Outlook, in bulk or in a drip: it goes only to a lead with a record of agreeing to be contacted by that customer (the consent words they agreed to on the customer's form, with when and where; the consent a lead provider sent with them; or a lead ad form they sent the customer), or one that someone at the customer marked as having asked for its email, on the lead or when importing a list, which LeadVault keeps with the lead and the name of who marked it. A lead without any of these gets no email from LeadVault.

Every email ends with a link to unsubscribe, and bulk emails and those sent from Gmail also carry the one-click unsubscribe headers that email programs use for their own Unsubscribe button. One press unsubscribes the person from all email from that customer through LeadVault, one-to-one, bulk and drips alike, and it can't be undone by the customer: we keep the address on the customer's do-not-email list. The same goes for an address that bounces or marks an email as spam, and for anyone on the customer's do-not-contact list.

Facebook and Instagram lead ads

People who use LeadVault can connect a Facebook Page they run ads from. LeadVault then asks Facebook for permission to see the Pages they manage, to be told when someone sends one of the Page's lead ad forms, and to read those leads. When someone sends such a form, on Facebook or Instagram, LeadVault fetches what they entered (their answers to the form's questions, and the form, ad and campaign it came from) and adds it as a lead in that customer's account, like a lead from the customer's other forms. A date of birth or Social Security number from these forms isn't kept.

We use what Facebook gives us only to bring each lead into the customer's LeadVault account. The Page's access is stored encrypted. We don't send leads or anything else back to Facebook, use them for advertising, sell them, or use them to train AI models. Disconnecting the Page in LeadVault stops its new leads and tells Facebook to stop sending them; the access can also be removed in Facebook's settings, under Business Integrations. Leads that already came in stay with the customer, who decides how long they're kept. To have your information from a lead ad deleted, ask the company whose ad it was, or use our contact form as described under Your rights. Deleting your data has the steps.

Bulk email

Our customers can send one email to many of their leads from LeadVault. Each one goes out under the customer's name, with its mailing address and a link to unsubscribe, and it carries a tiny image and links that tell the customer when it was delivered, opened or a link in it clicked. It goes only to leads who agreed to get email from the customer, as above. Someone who unsubscribes, marks one as spam, or whose address bounces gets no more email from that customer: we keep the address on the customer's do-not-email list so that it stays that way.

How we use information

To run LeadVault for our customers and do what they ask of it.
To keep accounts secure, prevent abuse and fix problems.
To answer support questions, and to tell people who use LeadVault about their account and changes to the service.
For internal training and compliance, using information with anything that identifies a person taken out, for example how far visitors get on forms and where they stop.
To meet legal obligations, resolve disputes and enforce our agreements.

We don't sell personal information, we don't use it for targeted advertising, and we don't use one customer's leads for another customer or for marketing of our own.

Companies that help us run LeadVault, under agreements that let them use the information only to provide their service to us:

The company that hosts our servers, in the United States.
Anthropic, for LeadVault's AI features (search, the assistant, AI on forms, summaries of recorded calls, which an account can turn off, and Vaulty answering and making calls, when an account turns it on), under terms that don't let it train its models on this information.
Deepgram, to turn voice notes and recorded calls into text, with its use of them for training turned off.
Twilio, to place calls, when a customer turns calling on; to hear and speak for Vaulty on calls it answers, when a customer turns that on; to register a customer's company and its numbers with the phone companies, when it sets up caller ID; and to text sign-in codes to people who choose codes by text.
Google, for address suggestions on forms and for signing in with Google.
Microsoft and Meta, for signing in with their accounts, when someone chooses to.
RentCast, for a home value estimate from a property address on a form.
Amazon Web Services, to send LeadVault's own email, like invitations and password links, and the bulk email customers send to their leads.
Stripe, to take payment for LeadVault from the accounts that pay for it.

Our customers get their own data, including anything they send from LeadVault to their other tools through its API and webhooks. We may also share information when the law requires it, to protect people's rights and safety, or as part of a merger or sale of our business, where this policy would continue to apply to it.

Cookies

LeadVault uses a sign-in cookie, a security cookie that stops other sites from sending forms in your name, and, on a customer's form, a cookie that finds your unfinished answers again for 30 days. A form placed on a customer's own website keeps the same kind of note in your browser's storage. We don't use advertising or analytics cookies, tracking pixels or third-party trackers on our pages. (Bulk emails our customers send tell them when one is opened or clicked, as above.)

How long we keep it

Our customers decide how long the personal information they collect is kept. They can delete leads at any time, and on their Data retention settings they choose how long unfinished form visits keep who the visitor was, how long recordings are kept, and whether closed leads are deleted after a set time.

When a customer's account ends (a free trial ends without a paid plan, or its billing stops), we keep its data for 90 days in case it comes back, then delete it. For five years after that, we keep only what we need for legal and compliance purposes: a record of each consent a person gave the customer (the wording, when and where it was given, and the phone number and email it covers), records of what we charged the customer, and the log of important actions in the account, with the names and emails of the people who took them. Then those are deleted too.

We keep information about the people who use LeadVault for as long as their account is active and we need it to provide the service and contact them about it, or as needed to comply with legal obligations, resolve disputes and enforce our agreements. Information with anything that identifies a person taken out may be kept and used as described above. We don't try to identify anyone from it.

Security

LeadVault is only reached over encrypted connections (HTTPS). Social Security numbers and dates of birth are stored encrypted, shown in full only to the roles a customer allows, and every viewing is logged. Two-step sign-in is required once an account holds leads, and each customer's data is kept apart by the database itself, not just by our code. No system is perfectly secure, but we work to protect the information we hold, and we'll tell customers promptly if their data is affected by a breach.

Your rights

Depending on where you live, including California, you can ask to know what personal information is held about you, to get a copy, to correct it, or to delete it. You can also tell us not to sell or share it, though we don't, and to limit how sensitive information like a Social Security number is used; we use it only to provide the service. We won't treat you differently for asking.

If your information came to LeadVault through one of our customers, please ask that company, since it decides what happens to it. If you can't, or your request is about your own LeadVault account, use our contact form. We'll check it's really you, usually by email, and answer within 45 days. Someone you authorize can ask for you.

LeadVault isn't meant for children, and we don't knowingly collect information about anyone under 16.

Changes

If we change this policy, we'll update it here and change the date at the top. For important changes, we'll also tell our customers' account admins.

Contact

SiteTools, Inc. (LeadVault.com), 1411 Federal Ave, Los Angeles, CA 90025. Reach us through our contact form.