What LeadGlue holds, where it goes, who can see it, and how long it stays.
LeadGlue is owned and operated by Wemark Tech Pty Ltd (ABN 33 702 092 966) of Adelaide, South Australia.
Privacy questions go to inquiry@leadglue.com.au. We will give you a postal address on request.
A business turning over $3 million or less is currently exempt from the Privacy Act 1988 (Cth). We have chosen not to rely on that. We handle personal information as though the Australian Privacy Principles bind us, and this policy is written to them.
LeadGlue holds information about two very different groups of people, and our responsibility is not the same for each. It matters, so it is worth two paragraphs.
The agents, property managers and owners who log in. We deal with these people directly, we decide what the software needs from them, and we are answerable to them for it. Sections 3 and 18 are for you if you are one of them.
The vendors, landlords, buyers and tenants whose details an agency records. The agency collected that information and the agency is answerable for it. We hold and process it on their instruction and for no purpose of our own. If you are a member of the public asking what a particular agency holds about you, ask that agency. Section 18 explains how to reach them if you do not know who to contact.
When an agency sets someone up in LeadGlue, or that person fills in their own profile, we hold:
We do not record IP addresses, device fingerprints or location.
On behalf of the agency, LeadGlue holds:
LeadGlue does not record phone calls. There is no audio, no transcript of a call, no biometric data and no location tracking anywhere in the system.
We do not ask for sensitive information and no field in LeadGlue is designed to hold it.
We are not going to pretend that settles it. Call notes, enquiry text and lost-reason details are free text, and real estate conversations wander into illness, death, separation, financial trouble and other things the Privacy Act 1988 (Cth) treats as sensitive. Whatever an agent types is stored.
So we tell every agency plainly: do not record sensitive information in LeadGlue. We hold agencies to that in our Terms of Service, and if you are an agency owner reading this, please pass it on to your team. Anything of that kind that ends up in a note is there because someone typed it, not because we asked for it, and it gets the same protection as everything else rather than the extra protection sensitive information deserves.
We do not buy lists, we do not scrape, and we do not enrich records from data brokers.
For agency staff, so we can give them an account, let them sign in, show them their work, notify them, send email as them if they have asked us to, support them, and bill their agency.
For leads, only to provide the service the agency is paying for: keeping the record, prompting the agent to call, sending the emails the agency asks us to send, booking the appraisal, producing the proposal or letter, and reporting to the agency owner.
We also keep de-identified usage statistics, such as how many leads arrive each day across all agencies and how quickly calls are made, to run and improve LeadGlue. Nothing in those statistics identifies a person or an agency.
We do not use anyone's information to market to them, we do not sell or rent it, we do not share it between agencies, and we do not use it to train artificial intelligence models.
LeadGlue is built on services run by other companies. Here is every one of them and exactly what reaches it. Nothing goes anywhere else.
| Service | What it does | What reaches it | Where |
|---|---|---|---|
| Cloudflare | Runs the application and stores the database | Everything. This is where LeadGlue lives. | Database in the Oceania region; the application runs at edge locations worldwide |
| Cloudflare Browser Rendering | Turns proposals and letters into PDFs | The finished page: client name, property address, figures, notes, agent name, photo and signature, agency logo | Cloudflare network |
| Resend | Sends the system's email | Recipient address, subject, and the full message. Depending on the email, that includes a lead's name, phone, suburb and enquiry, an appraisal time and address, task details, or an attached proposal PDF. | United States |
| Google (Calendar) | Puts appraisals in the agent's calendar | Event title with the lead's name, and in the description the lead's phone number, the enquiry text and the source; the appraisal address as the location. LeadGlue also reads that calendar's events back. | United States |
| Google (Gmail send) | Sends an email from the agent's own address, where they have connected it | The entire email, including recipient, subject, body and any PDF attached | United States |
| Google (Firebase Cloud Messaging) and Apple (push) | Delivers notifications to the phone apps | A device identifier, and the notification text, which routinely contains a lead's name and phone number, an appraisal address, or the first line of a team message. See section 11. | United States |
| Meta (Facebook, Instagram) | Delivers leads from an agency's lead-ad forms, and lets an owner see and launch the agency's ads, where connected | Meta sends us the form answers. Where an owner connects an ad account, we read each campaign's spend and results. When an owner launches an ad from LeadGlue we send Meta what they chose: the photo, the words, the suburbs, the budget and the form questions. We send Meta nothing about any lead. | United States |
| Google (Ads lead forms) | Delivers leads from an agency's Google Ads lead forms, where the agency has set that up | Google sends us the form answers. Nothing is sent back to Google. | United States |
| Meta (WhatsApp link) | Opens WhatsApp with a message ready to send, when an agent chooses that button | The lead's phone number and the draft message, passed to WhatsApp on the agent's own device. Nothing sends until the agent presses send. | United States |
| Komoot (Photon address search) | Suggests addresses as an agent types one | The partial address text being typed. The request goes through our server, so the person's own device is never exposed to Komoot. | Germany |
| Google Fonts | Supplies two typefaces when a PDF or preview is drawn | A request for a font file. No personal information. | United States |
There is no analytics, no advertising pixel, no tracking script, no crash reporting service and no artificial intelligence service anywhere in LeadGlue. We checked, rather than assumed.
Beyond that list, we disclose personal information only where the law requires it, for example under a court order or a warrant, or where it is needed to deal with a serious threat to someone's life, health or safety.
If we ever add a service that receives personal information, we will update this page and tell agency owners before it starts.
The LeadGlue database, which holds every lead, note, proposal and staff record, sits in Cloudflare's Oceania region. It is not copied to any other region.
The application itself runs on Cloudflare's global network, so a request may be handled at an edge location outside Australia, but the data it reads and writes stays in the Oceania database.
The services in section 8 are a different matter. Sending an email means the email reaches Resend in the United States. Booking an appraisal in Google Calendar means those details reach Google in the United States. Typing an address means the partial text reaches Komoot in Germany.
Under Australian Privacy Principle 8 we take reasonable steps to make sure overseas recipients handle personal information consistently with the Australian Privacy Principles, including by relying on their contractual commitments and published privacy terms. We cannot guarantee that an overseas recipient will always do so, and you may not be able to enforce Australian privacy law against them.
An agent can connect their own Google account. It is optional, it is theirs to decide, and it can be undone at any time.
When they connect, LeadGlue asks Google for two permissions:
Two things worth being clear about. First, the calendar permission means LeadGlue reads the titles, locations and times of other events on that calendar. If the agent uses one Google account for work and personal life, their personal appointments are read. They are shown only to that agent inside LeadGlue and to nobody else. Second, the send permission lets LeadGlue send mail as that agent for as long as the connection lasts.
An agent can disconnect from their profile in LeadGlue at any time, and separately revoke LeadGlue's access at myaccount.google.com/permissions. We recommend doing both.
LeadGlue's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
There are two kinds, and they are not equally private.
In a web browser, LeadGlue deliberately sends an empty notification. The browser's push service is told only that something happened, never what. The app then fetches the details from us directly. No lead information passes through the push service at all. We built it that way on purpose.
In the iPhone and Android apps, the notification text itself is sent through Google's Firebase Cloud Messaging and, for iPhones, on through Apple. That text routinely contains a lead's name and phone number, an appraisal address, or the opening line of a team message. Those companies handle it under their own privacy terms. If that concerns your agency, use LeadGlue in a browser rather than the app.
LeadGlue lets an agent dictate a call note instead of typing it. That uses the speech recognition built into their browser. In Chrome and Safari that is a cloud service, which means the audio of what they say goes to Google or Apple to be turned into text.
We neither receive the audio nor control what those companies do with it. We only ever see the text that comes back. Agents who would rather not have that happen should type the note.
We run LeadGlue as one system serving every agency, so our administrators can reach any agency's account. That includes the staff list, lead names and contact details, and call notes. We can also sign in as one of an agency's people in order to see exactly what they see.
We use it to set an agency up, to provide support that has been asked for, to investigate a fault, or to meet a legal obligation. When we act inside an agency's account, LeadGlue stamps the entry in that agency's own history as via LeadGlue, so it is visible to them and never mistaken for their agent's work.
We tell you this because you cannot make an informed decision without it. Any cloud software works this way. Most privacy policies do not say so.
LeadGlue measures individual agents, and their employer sees it. If you are an agent using LeadGlue, you should know exactly what your principal can see.
The system emails the agency owner when someone is falling behind, and the owner can send a nudge that vibrates that agent's phone. This is workplace monitoring, and in some states it carries its own notice obligations for the employer. Agencies are responsible for telling their staff, and for anything their employment agreements or awards require.
No system is completely secure and we will not claim ours is. If you find a weakness, please tell us at inquiry@leadglue.com.au before telling anyone else, and we will not take action against you for reporting it responsibly.
| What | How long |
|---|---|
| An agency's data, after the agency cancels | 90 days, so they can export it, then permanently deleted. Backups holding it are overwritten within a further 30 days. |
| A lead the agency deletes | Deleted straight away, along with its call history, notifications and proposals. Team chat messages that happen to mention the person are not automatically found and removed. |
| A staff member who leaves | Their login is switched off immediately. Their record and the history of their work stays, because the agency's lead history would otherwise have gaps. An agency can ask us to delete a former staff member's profile details and we will. |
| A lead the agency keeps | As long as the agency wants it. They decide, not us. |
| Sessions | 30 days, then the login expires. |
Anyone can ask us to delete information about them sooner. If you are a lead, ask the agency first, because it is their record. If you cannot get anywhere with them, write to us and we will help.
LeadGlue sets two cookies, both strictly necessary, both first-party.
lg_session keeps you signed in. It lasts 30 days.lg_master appears only when a LeadGlue administrator is providing support inside an account, and lasts 2 hours.The app also remembers your light or dark theme choice in your own browser. That never leaves your device.
There are no analytics cookies, no advertising cookies, no third-party cookies and no tracking of any kind. Nothing about your use of LeadGlue is shared with an advertising network, because there is no code in LeadGlue that could do it.
Write to inquiry@leadglue.com.au and we will give you a copy of what we hold about you, or correct it, within 30 days. There is no charge. We may ask you to confirm who you are first. If we cannot give you something, we will tell you why in writing.
The agency you dealt with holds the record and controls it, so ask them. They can find, correct or delete it in LeadGlue themselves.
If you do not know which agency, or they will not respond, write to us at inquiry@leadglue.com.au with enough detail to identify the record. We will pass your request to the agency and require them to act on it, and we will tell you we have done so. We will not hand over the contents of an agency's records to a third party without the agency's authority or a legal obligation, because the record is theirs and we cannot verify your identity against it.
If personal information held in LeadGlue is accessed by someone who should not have it, we will investigate at once and contain it.
We will tell the affected agency within 48 hours of becoming aware, and give them what they need to work out whether the Notifiable Data Breaches scheme obliges them to notify the individuals and the Office of the Australian Information Commissioner. Where the breach is ours rather than an agency's, we will notify the Commissioner and affected individuals ourselves where the law requires it.
We will tell you what we actually know, when we know it.
LeadGlue is a business tool and is not intended for anyone under 18. We do not knowingly collect information about children. If a child's details end up in an agency's records, that is a matter for the agency, and we will help them remove it on request.
We may update this policy. The current version always lives at leadglue.com.au/privacy with its version and date at the top.
If a change materially affects how we handle personal information, we will email agency owners at least 30 days before it takes effect and put a notice in the app.
Tell us first. Email inquiry@leadglue.com.au with what happened and what you would like done. We will acknowledge within 5 business days and give you a written answer within 30 days.
If you are not satisfied, you can take it to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5218, Sydney NSW 2001.