Privacy Policy

Lead with How is built on the belief that your stories belong to you. This policy explains what we collect, how we use it, and how we protect it.

What We Collect

• Your name and email address when you create an account
• Impact stories, narratives, and professional content you enter into the app
• Photos and videos you upload
• Organization profiles and team member information you add
• Basic usage data (which features you use, when you log in)

We do not collect payment card information. All payments are processed by Stripe, which has its own privacy and security practices.

How We Use Your Data

• To provide and improve the Lead with How service
• To generate AI-assisted story prompts and impact summaries using your content
• To send transactional emails (account verification, team invites, weekly digests)
• To display your stories and impact model within the app

We will never sell your data. We will never use your stories or personal content to train AI models without your explicit consent.

Sub-Processors

Lead with How uses the following third-party services (sub-processors) to operate. Each one receives only the data necessary for its function, never sells your data, and is contractually bound by their own privacy commitments.

Sub-processor	Purpose	Data shared	Location
Anthropic	AI text generation (Claude). Powers the How Agent and content drafting.	Story content, articles, and conversation context, only when you invoke an AI feature. Anthropic does not train on API data.	United States
OpenAI	Voice transcription (Whisper) and optional spoken responses.	Audio files only when you record a voice memo or use spoken agent mode.	United States
ElevenLabs	Voice cloning for the spoken How Agent (opt-in, off by default).	Voice samples you explicitly upload for cloning.	United States
Cloudflare R2	Media storage for photos, videos, voice memos, document uploads.	Media files you upload. Encrypted at rest by default.	United States (multi-region edge)
Stripe	Payment processing. We do not see your card number.	Billing email + subscription tier. Stripe holds the card data, not us.	United States
Resend	Transactional email delivery (welcome, digest, etc.).	Recipient email + the email content we send.	United States
Railway	Application hosting and managed Postgres database.	Application data and user records. Encrypted in transit and at rest.	United States
CloudMailin	Inbound email parsing (forwarding notes to your library by email).	Only the emails you specifically send to your LWH-issued inbox.	United States

We notify users by email at least 30 days before adding a new sub-processor that receives personally identifiable data. If you want a written Data Processing Agreement (DPA) for your organization, email hello@leadwithhow.com.

Data Retention

We keep your data only as long as it serves you and only as long as we are required to.

• Active accounts: All your stories, photos, and impact-model content are retained for as long as your account is active.
• Inactive accounts: If you do not log in for 36 consecutive months, we will email you and, if there is no response within 30 days, archive your account. Archived accounts can be restored on request within the following 12 months, after which the data is permanently deleted.
• Deleted accounts: When you delete your account, your stories, profile, and personal content are removed from the live database within 7 days and from our daily backups within 90 days (the natural backup rotation window).
• Billing records: Stripe retains subscription and payment history for legal/accounting purposes (typically 7 years). We keep only the receipt metadata Stripe pushes to us.
• Operational logs: Error logs, request logs, and audit events are kept for 90 days then pruned, unless they are needed for an active security investigation.
• Media in Cloudflare R2: When you delete your account or specific files, R2 objects are removed within 7 days.

You can export your data at any time from My Account → Export my data, or by emailing hello@leadwithhow.com.

Your Rights

• You can request a copy of your data at any time
• You can request deletion of your account and all associated data
• If you are in California, you have additional rights under the CCPA (see below)
• If you are in the European Union, you have rights under GDPR

To exercise any of these rights, email us at hello@leadwithhow.com.

Your California Privacy Rights

We do not sell or share your personal information. Lead with How has never sold personal information and does not share personal information with third parties for cross-context behavioral advertising. There is therefore no Do-Not-Sell or Do-Not-Share request to make — but you may still exercise the other rights below.

In the last 12 months we have collected the following categories of personal information from California residents:

• Identifiers (name, email address, account ID).
• Customer records (billing email, subscription tier — held by Stripe, not by us).
• Internet activity (which features you use, log-in timestamps, IP address for security).
• Audio / visual content (photos, voice memos, video you upload).
• Professional or employment-related information (your role, organization affiliations).
• Inferences drawn from your stories (e.g., AI-generated summaries and Key Move suggestions).

We disclose these categories only to the third-party service providers listed above (Anthropic, Cloudflare R2, Stripe, Resend, Railway), strictly for the purposes of operating the service. We do not disclose for any other purpose.

Under the CCPA you have the right to: (a) know what personal information we collect, (b) request deletion of your personal information, (c) correct inaccurate personal information, (d) opt out of the sale or sharing of your personal information (not applicable to us — see above), (e) limit our use of sensitive personal information, and (f) not be retaliated against for exercising any of these rights. To exercise these rights, email us at hello@leadwithhow.com from the address on your account, or have an authorized agent contact us on your behalf.

Security

We use industry-standard practices to protect your data, including encrypted connections (HTTPS), secure credential storage, and access controls. No system is perfectly secure, but we take reasonable steps to protect your information.

Children

Lead with How is not directed at children under 13. We do not knowingly collect data from children under 13.

Changes to This Policy

We may update this policy as the product evolves. We will notify active users of material changes by email.

Contact

Questions about this policy? Email us at hello@leadwithhow.com.