Privacy policy.

Who we are

LeadsAfterDusk.com is run by LeadsAfterDusk Ltd, a company registered in England and Wales (company number 17488984) with its registered office at 66 Paul Street, London EC2A 4NA. We are registered with the Information Commissioner's Office as a data controller (registration reference ZC283895). We provide an out-of-hours enquiry assistant for UK estate and letting agencies. Questions, requests and complaints about your data: email us.

If you sent an enquiry to an estate or letting agent

Some agencies use LeadsAfterDusk to answer enquiries sent to their branch inbox. The agency decides how your enquiry is handled and is responsible for it (the controller); we handle it only on its instructions, under a written data processing agreement (we are its processor). The agency's own privacy notice applies, so contact the agency first. We will pass on anything you send us.

For the agency we read new emails in its branch inbox to find property enquiries. Emails that are not enquiries are checked automatically; we keep none of their content, only the message's reference number and the result for up to 30 days, so it is never processed twice. Two kinds of email are kept even though they are not enquiries, because someone at the agency needs to act on them: a report of an urgent problem with a property (for example no heating, a leak or a smell of gas) and a complaint. If you ask not to be contacted, your email address goes on that agency's do-not-contact list, whatever your email was about.

For an enquiry we keep your name, email address, phone number, the property, your messages and the agency's replies, the time the agency's team first replied, and anything the agency records about viewings and outcomes. A reply may be written by an automated assistant using the facts and rules the agency gives it, and it is sent or saved for the agency's staff according to the agency's settings. An agency can also start in a watch-only mode ("Shadow mode"), usually for up to a week: we then record each enquiry as above and the time the agency's own staff first replied to it, but send and draft nothing; we do not keep the content of the staff's replies. Where one inbox serves several branches, we remember which branch your enquiries go to, so your next email reaches the same team.

If a reply offers you viewing times, we note for 12 hours that they were offered to you, so they are not offered to someone else at the same time. If you pick or suggest a time, it is passed to the agency's staff, who confirm it with you; the assistant never books a viewing itself. It does not make decisions about you that have legal or similarly significant effects: whether you can view or rent a home, and on what terms, is always decided by the agency's staff. Anything about valuations, fees, legal matters or complaints is handed to a person at the agency. Like any AI, the assistant can occasionally get something wrong, for example misreading what you asked or which area a property is in. If a reply you receive looks wrong, reply to it or contact the agency and a member of its team will put it right; you can also ask the agency for a person to deal with your enquiry instead.

Look Back reports. An agency can ask us for a one-off report on the enquiries its inbox received in the 60 days before, to see how many arrived while it was closed and how quickly it answered. For that report we read those emails in the same way, and for each enquiry we keep only when it arrived, its type, when the agency first replied, and the sender and subject line as they appeared. We do not keep the message itself, and nothing is sent to you.

How long: enquiries (including urgent problems and complaints) are deleted 24 months after they arrive unless the agency sets a different period, and within 30 days of the agency leaving us; Look Back records after 90 days; offered viewing times a week after the 12 hours are up; a remembered branch 24 months after your last email. If you ask not to be contacted, your email address stays on that agency's do-not-contact list so that you are not contacted again.

If you run or work at an agency that uses LeadsAfterDusk

We hold your name and email address and your sign-in account, whether we created it for you or you signed up yourself (your password is stored only as a secure hash by our authentication provider; we never see it), your role and the branches you work on, and what you change in the dashboard. If you use two-step sign-in by email, we keep only a one-way hash of each code, for a day after it expires. When an owner accepts our terms and data processing agreement, we record who accepted which version, when, and the IP address and browser used, as evidence of the contract. We use all of this to provide the service under our contract with your agency (lawful basis: contract, and our legitimate interest in running and securing the service). Accounts are deleted within 30 days of your agency leaving or removing you. Invoices, contract records and records of acceptance are kept for six years, as UK tax and contract law requires; our log of the account emails we sent you is kept for 24 months; unanswered invitations to join a team are deleted after 90 days.

Payments. Card payments are taken by Stripe. You type your card details into Stripe's own payment page; they go straight to Stripe and we never see or store them. From Stripe we receive the name, email address and business name given at checkout, the plan, the payment status and Stripe's reference numbers, which we use to switch your plan on and off and to keep accounting records (lawful basis: contract and legal obligation). Stripe also acts as an independent controller for its own purposes, such as fraud prevention and meeting financial regulation; its privacy policy explains that.

Emails about your account. We email owners about their trial and plan: a welcome, a summary of results during the trial, a reminder before it ends, and notices about payments and cancellation, and we send sign-in codes to anyone who uses them. These are part of providing the service, not marketing, and come from a leadsafterdusk.com address.

If you contact us, book a call or we write to you

We keep your name, business contact details and what we discuss, to reply and to decide together whether the service suits your agency (lawful basis: legitimate interests). Before we first write to an agency, we find its details in public sources: Companies House (to check it is a limited company and who its directors are), the agency's own website, its listing on property portals, and business profiles such as LinkedIn. From those we keep the agency's name and town, a director's name, the business email address or phone number published for the agency, and a short note about the business. We write about the service only to limited companies and LLPs, at their business addresses, never to sole traders, partnerships or anyone's personal address, and every email says who we are and how to opt out. You can object at any time: reply "no" or email us, and we stop and delete your details, keeping only your agency's web address on a suppression list so that we never contact it again. Otherwise we delete them two years after our last contact unless you become a customer. Messages we send on LinkedIn are also covered by LinkedIn's own privacy policy.

Mailbox and calendar access

An agency connects its branch inbox on Google's or Microsoft's own permission screen. We use it only to read new messages, write or save replies, check whether the agency's staff have already answered and, when the agency asks, produce a Look Back report of the previous 60 days; we never delete, move or archive email. We read calendar availability only to offer viewing times, and never write to a calendar. The agency can disconnect at any time from its dashboard, and we then delete our access. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: it is used only to provide the service, never for advertising, never sold, never used to train AI models, and read by a person only with the agency's permission, for security, or where the law requires.

How we protect your data

We treat mailbox access and enquiry data as sensitive, and protect it in these ways:

• Encrypted in transit. Everything between your browser, our application, Google, Microsoft and our database travels over HTTPS (TLS). We never send data over an unencrypted connection.
• Encrypted at rest. Our database and application servers store everything on encrypted disks. On top of that, the access token that lets us read and reply from an agency's mailbox is encrypted again with AES-256-GCM before it is saved, using a key held in Google Secret Manager and never stored alongside the data. Each token is tied to its own branch, so it cannot be used for any other mailbox.
• Access kept to a minimum. Each agency's staff can see only their own agency's enquiries, and only for the branches they work on; the database enforces this itself, not just the website. The keys that reach the whole database are held only by our application, in Google Secret Manager, and are never sent to a browser. Within our company, access to production systems is limited to named people who need it, and nobody reads an agency's emails except with that agency's permission, for security, or where the law requires.
• Only what is needed. We keep the content of enquiries only, plus the urgent problems and complaints described above. Emails that are not enquiries are checked automatically and their content is not kept. Our logs record one-way references instead of email addresses or message identifiers, and never message contents.
• Access removed when you leave. When an agency disconnects a mailbox, we stop reading it straight away (a message already being handled at that moment may still be completed), delete the stored token, and ask Google or Microsoft to withdraw our permission. If the provider does not confirm, the dashboard says so, so that the agency can remove LeadsAfterDusk in that account's security settings too. Enquiries are deleted on the schedule above.
• If something goes wrong. We follow a written breach procedure: we tell affected agencies within 48 hours of becoming aware, so they can meet their 72-hour duty to the Information Commissioner's Office, and where we are the controller we report to the ICO ourselves within 72 hours.

Who else handles it

Google Cloud runs our application and the AI model (Google's Gemini, in its London region); Supabase hosts our database in London; Cloudflare hosts this website and carries the encrypted traffic to our application, without storing it; Google Workspace delivers the emails we send to account holders; Stripe takes card payments. Google Cloud, Supabase, Cloudflare and Google Workspace act only on our instructions under data processing terms and may not use the data for their own purposes. Stripe processes payments for us, and also acts as an independent controller for its own purposes, as explained under Payments above. These providers are headquartered outside the UK and may give support from abroad, and Cloudflare may route traffic through another country if its London data centres are unavailable; all of this is protected by the UK's approved safeguards (the UK Addendum to the EU standard contractual clauses and, for the US providers, the UK Extension to the EU-US Data Privacy Framework). We do not sell data or share it for anyone's marketing.

Cookies

This website uses no advertising or cross-site tracking. The only cookie is a strictly necessary security cookie that our service sets while an agency connects a mailbox, to check that the connection is finished in the same browser it was started in; it lasts at most 10 minutes. Your browser remembers whether you chose light or dark mode on that device; the choice stays in your browser and is not saved to our servers or your account. When someone signs in, the dashboard keeps the session in the browser tab's own storage, which ends when the tab is closed. If they tick "Keep me signed in on this device", it is kept in the browser's storage on that device instead, for up to 30 days or until they sign out. Stripe's payment page, which opens on Stripe's own website, sets its own cookies, described in Stripe's cookie policy.

Your rights

You can ask for a copy of your data, and ask us to correct it, delete it, restrict or object to its use, or send it to you or another organisation. You can object to our use of your data for contacting you about the service at any time, and we will stop. If an agency is the controller, we will pass your request to it within 5 working days and help it answer. We reply within one month.

Complaints

If you are unhappy with how your data has been handled, email us. We will acknowledge your complaint within 30 days, look into it, and tell you what we found and what we have done. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

We update this policy when what we do changes, and show the version and date at the top. If a change affects how we use data we already hold about you, we will tell you before it takes effect where we have a way to reach you. The service is for businesses and is not intended for children.