Privacy Policy

Last updated and effective: October 18, 2026

Lead with How is built on the belief that your stories belong to you. This policy explains what we collect, how we use it, and how we protect it.

What We Collect

Your name and email address when you create an account
Impact stories, narratives, and professional content you enter into the app
Photos and videos you upload
Organization profiles and team member information you add
Basic usage data (which features you use, when you log in)

We do not collect payment card information. All payments are processed by Stripe, which has its own privacy and security practices.

How We Use Your Data

To provide and improve the Lead with How service
To generate AI-assisted story prompts and impact summaries using your content
To send transactional emails (account verification, team invites, weekly digests)
To display your stories and impact model within the app

We will never sell your data. We will never use your stories or personal content to train AI models without your explicit consent.

Sub-Processors

Lead with How uses the following third-party services (sub-processors) to operate. Each one receives only the data necessary for its function, never sells your data, and is contractually bound by their own privacy commitments.

Sub-processor	Purpose	Data shared	Location
Anthropic	AI text generation (Claude). Powers the How Agent and content drafting.	Story content, notes, articles and conversation context, when you use an AI feature and when features you've turned on run in the background (your daily question, digests, and what the How Agent remembers). Anthropic does not train on API data.	United States
OpenAI	Voice transcription (Whisper) and optional spoken responses.	Audio files only when you record a voice memo or use spoken agent mode.	United States
ElevenLabs	Text-to-speech for the spoken How Agent. One consistent voice is used for every user — not personalized per user.	The text the agent is about to say. No user voice samples are sent today.	United States
Cloudflare R2	Media storage for photos, videos, and document uploads.	Media files you upload. Encrypted at rest by default.	United States (multi-region edge)
Stripe	Payment processing. We do not see your card number.	Billing email + subscription tier. Stripe holds the card data, not us.	United States
Resend	Transactional email delivery (welcome, digest, etc.).	Recipient email + the email content we send.	United States
Railway	Application hosting and managed Postgres database.	Application data and user records. Encrypted in transit and at rest.	United States
CloudMailin	Inbound email parsing (forwarding notes to your library by email).	Only the emails you specifically send to your LWH-issued inbox.	United States
Backblaze B2	An encrypted second copy of every photo, so one failure cannot lose the only copy.	Photos you upload.	United States
Sentry	Error reports so we can find and fix problems.	Error details and request metadata. Personal details are removed before sending.	United States
Tavily	Web search for the How Agent, and fetching articles you save.	Search terms and the addresses of pages you save.	United States
Google	Fonts on our web pages; email for hello@leadwithhow.com.	Your IP address when a page loads fonts; messages you send us.	United States

We notify users by email at least 30 days before adding a new sub-processor that receives personally identifiable data. If you want a written Data Processing Agreement (DPA) for your organization, email hello@leadwithhow.com.

What the How Agent Remembers

The How Agent keeps short notes about you from your conversations so it can pick up where you left off. You can see and delete every one in My Account, under "What How remembers about you". Deleting a conversation also deletes what was learned from it. Sensitive topics (health, money, legal matters, grief, relationships, anything you say is confidential) are never raised unprompted. We never keep anything about a crisis.

Team Spaces

Content you add to a team's space is visible to that team according to its roles. Your How Agent conversations and what it remembers about you stay private to you on every team, including from Team Leads and owners.

Data Retention

We keep your data only as long as it serves you and only as long as we are required to.

Active accounts: All your stories, photos, and impact-model content are retained for as long as your account is active.
Inactive accounts: If you do not log in for 36 consecutive months, we will email you and, if there is no response within 30 days, archive your account. Archived accounts can be restored on request within the following 12 months, after which the data is permanently deleted.
Deleted accounts: When you delete your account, your stories, profile, and personal content are removed from the live database within 7 days and from our backups within 365 days, which is how long a backup is kept before it is pruned.
Billing records: Stripe retains subscription and payment history for legal/accounting purposes (typically 7 years). We keep only the receipt metadata Stripe pushes to us.
Operational logs: Error logs, request logs, and audit events are kept for 90 days then pruned, unless they are needed for an active security investigation.
Media in Cloudflare R2: When you delete your account or specific files, R2 objects are removed within 7 days.
Photo mirror at Backblaze B2: Every photo is also kept as a second, encrypted copy at a different provider, so that one failure or one mistake cannot take the only copy. When a photo stops being referenced — because you deleted your account, a story, or the file itself — that copy is marked and then permanently removed 30 days later. The delay is the recovery window: it is what lets us put a photo back if something was deleted by accident.

You can export your data at any time from My Account → Export my data, or by emailing hello@leadwithhow.com.

Your Rights

You can request a copy of your data at any time
You can request deletion of your account and all associated data
If you are in California, you have additional rights under the CCPA (see below)
If you are in the European Union, you have rights under GDPR

To exercise any of these rights, email us at hello@leadwithhow.com.

Your California Privacy Rights

We do not sell or share your personal information. Lead with How has never sold personal information and does not share personal information with third parties for cross-context behavioral advertising. There is therefore no Do-Not-Sell or Do-Not-Share request to make — but you may still exercise the other rights below.

In the last 12 months we have collected the following categories of personal information from California residents:

Identifiers (name, email address, account ID).
Customer records (billing email, subscription tier — held by Stripe, not by us).
Internet activity (which features you use, log-in timestamps, IP address for security).
Audio / visual content (photos, voice memos, video you upload).
Professional or employment-related information (your role, organization affiliations).
Inferences drawn from your stories (e.g., AI-generated summaries and Key Move suggestions).

We disclose these categories only to the third-party service providers listed above (Anthropic, Cloudflare R2, Stripe, Resend, Railway), strictly for the purposes of operating the service. We do not disclose for any other purpose.

Under the CCPA you have the right to: (a) know what personal information we collect, (b) request deletion of your personal information, (c) correct inaccurate personal information, (d) opt out of the sale or sharing of your personal information (not applicable to us — see above), (e) limit our use of sensitive personal information, and (f) not be retaliated against for exercising any of these rights. To exercise these rights, email us at hello@leadwithhow.com from the address on your account, or have an authorized agent contact us on your behalf.

Security

We use industry-standard practices to protect your data, including encrypted connections (HTTPS), secure credential storage, and access controls. No system is perfectly secure, but we take reasonable steps to protect your information.

Children

Lead with How is for people 18 and older. We do not knowingly collect data from anyone under 18, and we delete any account we learn belongs to someone younger.

Changes to This Policy

We may update this policy as the product evolves. We will email active users at least 30 days before adding a service that receives personal data, and before other material changes take effect.

Contact

Questions about this policy? Email us at hello@leadwithhow.com, or write to Lead With How LLC, 4025 Dobbs Drive SE, Huntsville, AL 35802.