Privacy Policy

Last updated: July 2026

1. Who we are

LeaderCues is the service operated at leadercues.com and, for the product itself, at app.leadercues.com. This policy covers both surfaces. For any privacy question, write to support@leadercues.com.

2. Scope: two surfaces

Marketing website — leadercues.com. Public pages, product information and analytics.

Web app — app.leadercues.com. The signed-in product that engineering managers use to keep notes on the people they manage and prepare 1-on-1s.

3. Data we collect

Marketing website. When you contact us or sign up for product updates we store your email address, the page you came from and the timestamp. If you accept analytics cookies, Google Analytics 4 also collects an approximate, anonymised location and basic usage information.

Web app — account data. Your name, email, time zone, language and a hashed password (we never see or store your password in the clear).

Web app — customer content. The notes, person first names (last name optional), meeting entries and AI-suggested "cues" that you create about the people you manage.

Web app — usage and billing metadata. Sign-in timestamps, basic product usage needed to run the service, and billing metadata received from Paddle (such as subscription status and invoice references — we do not receive full card numbers).

4. Our role: controller and processor

LeaderCues is the data controller for account data (name, email, sign-in credentials) and for marketing data (contact requests and analytics on the marketing site).

For customer content — the notes a manager keeps about the people they manage — LeaderCues acts as a data processor on behalf of the manager (or their organisation), who is the controller of that content.

5. Why we collect it (legal bases under GDPR)

  • Consent — for marketing emails and for optional analytics cookies.
  • Performance of a contract — to provide the LeaderCues service to you.
  • Legitimate interests — for security, fraud prevention and service improvement.
  • Legal obligation — for tax and accounting records, handled via Paddle as merchant of record.

6. Hosting and data residency

LeaderCues is hosted on Amazon Web Services in the EU (Frankfurt, eu-central-1), with Cloudflare in front for content delivery, DNS and security. Customer content stays in the EU.

7. Sub-processors

We rely on the following sub-processors to run the service:

  • Amazon Web Services — hosting, database and object storage, EU (Frankfurt).
  • AWS Bedrock — AI model processing. When you ask for AI help, the relevant text is sent to a large language model (Anthropic Claude, accessed through AWS Bedrock on an EU inference profile) to suggest follow-ups and draft 1-on-1 preparation. This data stays in the EU and is not used to train models.
  • Cloudflare — content delivery, DNS and security.
  • Paddle — payments, billing and merchant of record.
  • Google Analytics 4 — analytics on the marketing website only. Not used in the app.
  • Transactional email provider — for verification and password-reset emails. This may not be active yet.

8. AI features

AI in LeaderCues only proposes suggestions — follow-ups, discussion topics, 1-on-1 preparation — that you review and decide on. It does not rate, score or monitor employees, and there is no automated decision-making producing legal or similarly significant effects in the sense of GDPR Article 22.

9. Sensitive data

You must not store special-category or otherwise sensitive personal data about the people you manage — for example health, religion, political views, biometric or financial data. This matches our Terms of Service.

10. Security

Security controls include two-factor authentication (TOTP), encryption in transit (TLS) and at rest, key management via AWS KMS, and strict per-manager data isolation so no other customer can see your data.

Privacy invariant. An organisation's billing admin never sees a manager's notes or people. Billing admins only see billing and seat information.

11. Retention and deletion

We keep your data while your account is active. When you delete a person, or when your account is deleted, the related data is erased (cascading deletion). Backups rotate out on a rolling basis and are then purged.

12. Your rights

You have the right to access, rectify, erase, export (portability), restrict or object to the processing of your personal data, and to withdraw consent at any time. Write to support@leadercues.com and we'll respond within 30 days. You may also complain to your local data-protection supervisory authority.

13. Data processing agreement (DPA)

A data processing agreement is available to business customers on request. Write to support@leadercues.com.

14. Cookies

See our Cookie Policy for what is set on the marketing site and inside the app.

15. Changes to this policy

If we update this policy, we'll change the "Last updated" date above. If a change materially affects your data, we'll tell you by email or in-product notice.

16. Contact

Questions? Write to support@leadercues.com.