Last updated: 2026-07-11
This policy explains what personal information Lea collects, how we use it, and your rights under the New Zealand Privacy Act 2020. It covers agents who create a Lea account, and the buyers and sellers whose details reach us through a campaign.
For agents: name, email, phone, sign-in provider identifiers where used, and any listing profile URL you connect, used to pull in supported current listings. Lea uses magic links and Google sign-in; Microsoft sign-in may be available where enabled. We do not offer password sign-in.
For buyer and seller leads: whatever they submit through a campaign's lead form — typically name, email, phone, and property address.
Payment details are collected and processed directly by Stripe — we never see or store your card number.
To run your account, build and manage your ad campaigns, deliver leads to your inbox and console, process payments, and email you about your campaigns. We don't sell personal information to third parties.
Service providers who process data on our behalf: Stripe (payments), Google (sign-in, if you choose it), our email delivery provider (sending lead and account emails), Meta (Facebook/Instagram — the platform your ads run on and through which buyer/seller leads are captured), and an AI provider (accessed via OpenRouter) that helps us draft ad copy from your listing and campaign details. We do not send buyer or seller lead contact details to the AI provider. Each provider only receives what it needs to do its job.
We keep account, campaign and lead data while your account is active. If you delete your account, Lea deletes your profile, listings, campaigns, captured leads and uploaded media from the app, and cancels active subscriptions.
We may keep minimal records where needed for legal, tax, billing, security or abuse-prevention reasons. Support enquiries, chat transcripts, unattributed webhook leads and operational logs are automatically removed or redacted after their retention window so names, emails, phone numbers and free-text messages are not kept indefinitely.
We use a single essential cookie to keep you signed in to the console. We don't run third-party advertising or analytics trackers on this site.
We do measure our own pages so we know which ones are useful — the page visited, the site that linked to you, and general device type and country. This is done on our own servers without any cookie or third party. We don't store your IP address: it's combined with your browser details into a one-way code that changes every day, so repeat visits can be counted for a single day but you can't be identified or followed over time.
Under the Privacy Act 2020, you can ask to see the personal information we hold about you and ask us to correct it. Email [email protected]and we'll respond within a reasonable time.
Sessions are stored as hashed tokens, provider tokens are encrypted, and payment data never touches our servers directly. No system is perfectly secure, but we take reasonable technical steps to protect what we hold.
We may update this policy from time to time — the date above reflects the latest version.
Questions about this policy or your data? Email [email protected].