Privacy policy

Last updated on October 31, 2026

This privacy policy applies to Heap Lead Capture (also referred to as "Heap"), the mobile app published on Google Play and the Apple App Store, and to the Heap marketing website at getheap.app. The app and website are provided by Kyte Software, based in the United Kingdom ("Kyte Software", "we", "us").

1. Contact information

If you have any questions about this privacy policy or wish to exercise your data rights, please contact us at:

Developer / data controller: Kyte Software
Email: [email protected]

2. Data collection

2.1. Data collected on the Heap Marketing Website

User data: Email address.
Purpose of collection: To send updates related to Heap Lead Capture and notify users of updates to the privacy policy and terms of service.

2.2. Data collected in the Heap Lead Capture mobile app

Account data: Name and email address, used to create your account and sign you in.
Profile data: Details you choose to add to your profile, such as your job title, company, industry, goals, LinkedIn URL and calendar or call links, used to personalise the app and the follow-up messages it drafts for you.
Lead data: Information you capture about your leads, such as names, job titles, companies, email addresses, phone numbers, websites and notes. This is personal data about other people that you enter into the app (see section 6).
Photos: If you allow camera access, photos you take in the app (for example of business cards) are uploaded to our servers so the lead details they contain can be extracted.
Location: If you allow location access, the app records the precise location (GPS coordinates) where each lead is captured and stores it with that lead, so you can see where you met them. The coordinates are converted into a street address using Google's Geocoding service. Location is collected only while the app is in use, never in the background, and you can turn it off at any time in your device settings.
Purchase data: Your subscription status and purchase history. Payments are handled by Google Play or the Apple App Store; we never receive your card details.
Usage and diagnostics: Events describing how you use the app, crash and error reports, and device information such as phone model, OS version and app version, linked to your user ID.
Push notification token: Used to send you notifications about your leads, for example when a photo has been processed.
Feedback: Any feedback or bug reports you send us, with the device information above.
Storage: Data is stored locally on your device and on AWS servers. You can export your lead data using the app's export functionality.

2.3. Cookies and tracking

Marketing website: No cookies or tracking technologies are used.
Mobile app: No cookies are used, and we do not track you across other companies' apps or websites or use your data for advertising. The app uses product analytics and error tracking as described in section 3.3.

3. Data use and sharing

3.1. How we use data

To provide the app's features: extracting and organising lead details from your notes and photos, finding your leads' public LinkedIn profiles and profile pictures, recording the address where each lead was captured, and drafting follow-up messages, using AI models.
To manage your subscription and credits.
To provide and improve Heap Lead Capture via bug fixes and feature updates.
To communicate updates and respond to user inquiries.

3.2. Data sharing

We do not sell your data or share it for advertising. We share data only with the service providers listed below, which process it on our behalf to run Heap Lead Capture; with services you choose to connect, such as your CRM; and where required by law.

3.3. Service providers

Amazon Web Services: Hosting, storage and processing of all app data.
OpenRouter and the AI model providers it connects to: Lead notes, photos and profile details are sent to AI models to extract lead details and draft follow-up messages.
Microsoft Azure (AI Document Intelligence): Photos of business cards and documents are analysed to extract the text and contact details they contain.
Langfuse: Monitoring and quality checks of AI requests, which can include lead data.
Google (Custom Search API): A lead's name and company are used to search for their public LinkedIn profile.
Google (Maps Platform Geocoding API): The coordinates where a lead was captured are converted into a street address.
Gravatar: A one-way hash (SHA-256) of a lead's email address is used to look up their public profile picture. The email address itself is not sent.
RevenueCat: Subscription and purchase management, linked to your user ID.
Mixpanel: Product analytics, linked to your user ID and email address.
Sentry: Crash and error reporting, linked to your user ID.
Axiom: Server logging and monitoring.
Expo, Google Firebase Cloud Messaging and Apple Push Notification service: Delivery of push notifications.
HubSpot and other CRMs: Only if you connect your CRM account, your leads are sent to it.
Simple Analytics: Cookieless analytics on the marketing website.
Buttondown: To send updates related to Heap Lead Capture.

4. Data storage and security

Storage locations: Data is stored locally on the user’s device and on AWS servers.
Retention period: User data is retained as long as the account is active. Data will be deleted after one year of inactivity, or when you delete your account, except for the limited records described in section 5.2.
Security measures: Data is encrypted in transit (HTTPS) and at rest, and access is restricted using standard AWS security tools and access control.

5. User rights

5.1. Your rights

Opt-out: You can unsubscribe from mailing lists at any time.
Access and modify data: You can update your details from within the mobile app. You can also contact us to access, update, or delete your data.
Data Export: You can export your data from the app at any time.
Account and data deletion: You can delete your account and its associated data at any time.

5.2. Deleting your account and data

To delete your Heap Lead Capture account, open the app, tap your profile icon on the home screen, then tap Delete account. Your account and personal data are deleted immediately, and the leads you captured shortly after. If you can't access the app, email [email protected] from your account's email address. Full steps, and the data we keep after deletion, are described on Deleting your Heap Lead Capture account.

5.3. How to exercise your rights

To exercise your rights, contact us at [email protected].

6. Export and responsibility for third-party data

Export functionality: Users can export third-party contact data as a CSV file from the app at any time.
User responsibility: Once exported, users are solely responsible for safeguarding and managing the contact data.

7. Legal compliance

Global operations: Heap Lead Capture operates globally and complies with applicable privacy laws, including GDPR and CCPA.
Age restriction: The mobile app is intended for users aged 18 and older. By using our services, you confirm that you meet this age requirement.

8. Policy updates

We may update this privacy policy from time to time. Significant changes will be communicated via email. The effective date of the policy will always be updated at the top.

9. Governing law

This Privacy Policy is governed by the laws of the United Kingdom.