Privacy Policy

1. Introduction

LSA Escale ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the LSA Escale platform at https://lsaescale.com and related services. It is designed to align with the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and with generally accepted US privacy practices. [[Counsel should confirm whether other state comprehensive privacy laws — e.g. Virginia, Colorado, Connecticut, Utah, Texas — also apply and require additional disclosures.]]

2. Who we are and how to contact us

LSA Escale is the business responsible for personal information processed about our account holders. For privacy questions or to exercise your rights, email support@lsaescale.com. [[Add legal entity name and US mailing address.]]

When an agency uses our public intake form to collect information from its own prospects, that agency is the business responsible for that information and LSA Escale acts as its service provider. See Section 4.4.

3. Personal information we collect

In the past 12 months we may collect these CCPA categories of personal information:

3.1 Identifiers and account data

• Email and password (stored only as a bcrypt hash)
• Optional notification email
• Account and audit-log activity

3.2 Commercial and billing information

• Subscription and transaction records
• Payment information — processed directly by Stripe; we do not store card numbers

3.3 Internet/network and technical data

• IP address and User-Agent (access logs and acceptance records)
• Essential session and authentication cookies

3.4 Integration and lead data

• Google Ads OAuth access and refresh tokens (to integrate with the Google Local Services API)
• Accessible Google Ads customer identifiers
• Lead data obtained via Google Ads (consumer phone number, call status, call recordings/transcripts, and feedback)
• Public intake form data submitted by an agency's prospects (name, email, selected services) — see Section 4.4

4. How we use personal information

4.1 Business purposes

• Authentication and account management
• Providing the Service (lead lookup, Google Ads integration, call feedback and ratings, reports, automations)
• Subscription billing via Stripe
• Operational and support communications
• Fraud prevention and platform security
• Compliance with legal obligations

4.2 Call recordings and AI processing

Where enabled, we process call recordings and transcripts to generate AI feedback and ratings for our account holders. Our customers are responsible for the legality of recording and for any required consent. See AI & Call Recording.

4.3 Marketing email and CAN-SPAM

Any commercial or report email we send will identify the sender, include a valid physical postal address, and offer a working unsubscribe mechanism, consistent with the federal CAN-SPAM Act. Honoring opt-outs does not affect transactional/service messages. [[Confirm sender identity, postal address, and opt-out flow.]]

4.4 Third-party data via the public intake form

When a prospect completes an agency's public form (/f/:token), LSA Escale acts only as that agency's service provider and processes the data on the agency's instructions. The agency is responsible for notices and consumer-rights handling.

5. How we disclose personal information

We disclose personal information only to service providers that help us deliver the Service, under contracts that restrict their use of the information:

• Stripe — payment processing (receives email and identifiers for billing).
• Google (Ads & Local Services API) — integration; we access your Google Ads accounts on your behalf.
• Infrastructure and CDN providers (e.g. Cloudflare, jsDelivr) — hosting and delivery; may log IP at the origin.

We do not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We also do not use marketing or third-party tracking technologies. [[Counsel to confirm this determination against current CPRA definitions and the actual data flows.]]

6. Your privacy rights

Subject to applicable law, California residents (and residents of other states with comprehensive privacy laws) have the right to:

• Know / access the personal information we collect and how we use and disclose it
• Correct inaccurate personal information
• Delete personal information, subject to legal exceptions
• Opt out of any "sale" or "sharing" of personal information (note: we do not sell or share)
• Limit the use of sensitive personal information
• Data portability
• Non-discrimination for exercising your rights

To exercise these rights, contact support@lsaescale.com. We will verify your request and respond within the timeframe required by law (generally 45 days under the CCPA/CPRA, extendable once). You may use an authorized agent to submit a request. [[Confirm verification procedure and authorized-agent handling.]]

7. Data location and transfers

We and our service providers (such as Stripe and Google) may process information on servers in the United States and other countries. We rely on appropriate contractual safeguards for any cross-border processing.

8. Data retention

• Account data: retained during your subscription term.
• Billing and tax records: retained as required by applicable US federal and state law. [[Confirm retention periods with counsel — the Brazilian 5-year tax rule does not apply.]]
• Acceptance and consent logs: retained as proof of agreement for the relationship duration plus a reasonable period.
• When a retention period ends, data is deleted or anonymized.

9. Security

• HTTPS (TLS) for all transport
• Passwords stored only as a bcrypt hash
• Authentication and role-based access control
• Audit logs and continuous monitoring

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Cookies

We use only essential cookies required for the platform to function:

• _lsaescale_session — authenticated session
• "Remember me" cookie — when you choose to stay signed in

We do not use marketing, analytics, or third-party tracking cookies.

11. Children's privacy

LSA Escale is a business-to-business service intended for users 18 and older. We do not knowingly collect personal information from anyone under 16, and we do not sell or share the personal information of minors.

12. Changes to this Policy

We may update this Policy to reflect legal or operational changes. Each new version is identified by the version label above, and prior versions are preserved. For material changes we will provide notice and may request renewed acceptance at your next sign-in.

13. Contact

LSA Escale — Email: support@lsaescale.com. [[Add registered US legal entity name and mailing address.]]