Trust, Security & Privacy

• Email & password sign-in with optional Google sign-in.
• Every request is checked against the signed-in user's organization membership before any data is returned.
• Database-level row-level security restricts each record to the organization that owns it; cross-organization reads and writes are denied by default.
• Administrative actions are limited to organization admins and platform super admins.
• Read-only marketer accounts see only an allowlisted summary (name, city/state/ZIP, source, status, activity dates and call recordings) — never phone numbers, emails, street addresses, notes or message text.
• Call recordings are served only through signed links that expire.

Scorching Leads runs on Lovable Cloud, which uses managed Postgres, managed authentication, and edge-deployed serverless functions. Customer data is stored in the managed database with row-level security policies enforced for every query. Lovable Cloud provides the underlying platform controls; Scorching Leads is responsible for the application-layer access rules described on this page.

• All traffic is served over HTTPS with HTTP Strict Transport Security.
• Responses send nosniff, a strict referrer policy, a cross-origin opener policy, and a permissions policy that only allows the microphone (for in-browser calling) on our own site.
• Outbound texts and calls are checked server-side for do-not-call and quiet hours.

• Account profile: name, email, and organization membership.
• CRM content created by your team: contacts, leads, notes, dispositions, call logs, SMS history, and uploaded attachments.
• Operational telemetry needed to run the product: sign-in events, audit log entries, and request error traces.

Organization data is scoped to the organization that created it and is only visible to members of that organization.

Scorching Leads relies on the following service providers to deliver core features. Data shared with each provider is limited to what that feature requires.

• Lovable Cloud — application hosting, database, authentication, file storage.
• Twilio — outbound and inbound voice calls and SMS messaging.
• Resend — transactional email delivery (invites, password resets, notifications).
• ElevenLabs — optional AI voice features used by the receptionist.
• Firecrawl — optional property research lookups.
• Meta Conversions API — optional ad-attribution events where enabled.

• Terms of Service — scorchingleads.com/terms
• Privacy Policy — scorchingleads.com/privacy

Customer data is retained for as long as your organization's account is active. To request export or deletion of your organization's data, or to make a personal data request as a seller or contact, email info@scorchingleads.com with the subject "Data request". We verify the requester, confirm scope with the owning organization, and respond within 30 days. Sellers can also reply STOP to any text or use the unsubscribe link in any email to stop further messages.

If you believe you've found a security vulnerability, please email info@scorchingleads.com. Please do not publicly disclose the issue until we have had a chance to investigate and respond.

Scorching Leads does not currently hold independent compliance certifications such as SOC 2, ISO 27001, HIPAA, or PCI-DSS. We will update this page when that changes.