Privacy Policy
[Име на фирмата] ("LeadPilot", "we") provides LeadPilot, an AI assistant for salons and barbers that answers their customers on Instagram and in a website chat and helps them book appointments. This policy explains what data we process, why, and how to ask us to delete it.
Who is responsible
For salon accounts (LeadPilot users): [Име на фирмата], [Адреса, Скопје, Северна Македонија], [privacy@leadpilot.mk].
For a salon's customer messages and bookings: the salon is the controller; LeadPilot processes that data on the salon's behalf and only on its instructions.
What data we process
Salon account: email, business name, password (stored only as a cryptographic hash), team member roles.
Salon settings: services, prices, opening hours, answers to frequent questions, connected channels.
Messages from a salon's customers: message text, the sender's Instagram-scoped ID (or a random ID for a website chat visitor) and timestamps.
Bookings: service, time, and the name the customer gives when booking.
Technical data: security and audit logs (who changed what, when) and IP addresses for abuse prevention.
We do not process card payment data; payments are handled by the billing provider.
Why
To answer the salon's customers, offer free appointment times and record the booking.
So the salon can see conversations and bookings and take a conversation over.
For security, abuse prevention and billing.
We do not sell data or use it for advertising.
Who we share it with
OpenAI — to generate AI replies (conversation text and the salon's business information).
Meta (Instagram) — to receive and send Instagram messages, only if the salon connected its account.
Google (Google Calendar) — to check free times and record bookings, only if the salon connected its calendar.
Hosting: [хостинг провајдер и земја на серверот, на пр. Hetzner, Германија (ЕУ)].
Google (Google Analytics) — only visit statistics for the home page, and only with your consent.
We disclose data to public authorities only when required by law.
How long we keep it
While the salon uses LeadPilot. After a salon cancels, its data is deleted within 30 days unless the law requires longer retention (e.g. accounting records).
Database backups are kept for at most 14 days and then deleted.
Cookies
We use only necessary cookies: a sign-in (session) cookie and a language preference cookie.
The salon's website chat keeps a random conversation ID in the browser only while the tab is open. Google Analytics cookies (visit statistics for the home page) are used only if you agree in the cookie bar; we use no advertising cookies.
Security
Access is HTTPS only. Instagram and Google access tokens are stored encrypted. Each salon sees only its own data. Sending messages and writing to calendars is possible only after the salon explicitly switches it on.
Your rights
You may request access, correction, deletion or restriction of processing, and object to processing, under the North Macedonian Personal Data Protection Law and the GDPR. You may complain to the Personal Data Protection Agency (azlp.mk).
If you are a salon's customer, you can contact the salon or us directly.
Data deletion
Email [privacy@leadpilot.mk] with the subject "Data deletion" and include your Instagram username (if you wrote on Instagram) or your account email (if you are a salon), and the salon's name.
We delete your messages, bookings and related data within 30 days and confirm by email.
Salons can request deletion of the whole account the same way; it also removes every Instagram and Google Calendar connection. You can also revoke LeadPilot yourself in Instagram/Facebook (Settings → Business Integrations) and in your Google Account (Security → Third-party apps).
Changes
Last updated: 9.11.2026. We notify salons in advance about significant changes.