Privacy Policy

One Life Leads, LLC d/b/a Lead Suite OS

Effective date: October 27, 2026

Previous versions of this policy are available on request at legal@onelifecrm.com.

Summary of Key Points

• Who we are. One Life Leads, LLC, doing business as Lead Suite OS, is a Connecticut company. We provide a CRM, calling, texting and AI agent platform, and a lead store, for licensed U.S. life insurance agents ("Customers").
• Whose data this covers. It covers:
  • our Customers and their team users;
  • visitors to our website and to pages hosted on our platform;
  • consumers whom our Customers contact through the platform.
• Lead forms and lead products have their own privacy policies. See Section 6.
• We collect sensitive personal information. This includes Social Security numbers, financial account and payment card numbers (through Secure Forms), health information (such as medical conditions and medications), date of birth, veteran or military status, and call recordings. See Section 3.
• We do not sell or share your information. We do not sell the personal information of our Customers, their team users or our website visitors, or share it for cross-context behavioral advertising. You can still record a Do Not Sell or Share choice, and we honor Global Privacy Control. See Section 6.
• We use AI. AI models from OpenAI and, through Telnyx, Moonshot AI and Deepgram, process messages, calls and other content to power AI texting, AI voice calls and an underwriting assistant. See Section 7.
• Calls and texts may be recorded and stored. See Section 8.
• Your rights. Depending on where you live, you may access, correct, delete or port your information, opt out of sale, sharing and targeted advertising, withdraw consent, and appeal our decisions. See Section 11.
• Contact: legal@onelifecrm.com, or One Life Leads, LLC, 50 Cockle Hill Rd, Salem, CT 06420, United States.

1. Introduction and Scope

This Privacy Policy explains how One Life Leads, LLC d/b/a Lead Suite OS ("we," "us," "our") collects, uses, discloses and protects personal information. It covers:

• https://www.leadsuiteos.com;
• the Lead Suite OS application;
• pages, forms, funnels, booking pages and websites hosted on our platform;
• our communications.

It is written to meet:

• the California Consumer Privacy Act as amended by the CPRA (CCPA);
• the Connecticut Data Privacy Act (CTDPA), including its consumer health data provisions;
• other U.S. state comprehensive privacy laws;
• the Washington My Health My Data Act and similar consumer health data laws;
• Canada's PIPEDA, where it applies.

Pages published by our Customers. Our Customers publish lead forms, funnels, booking pages, websites and SMS-program pages using our platform. When you give information on a Customer's page, that Customer is responsible for it. The Customer's own privacy notice governs its use, and we process the information on the Customer's behalf (see Section 4). Lead forms and lead products, including our lead store and real-time lead products, are governed by the privacy policy shown on each form or product (see Section 6).

2. Our Roles

When a Customer buys a lead from us, the Customer becomes an independent controller of that lead's information in its own account.

3. Personal Information We Collect

3.1 From Customers (insurance agents and agencies)

• Identifiers and contact information: name, email, mobile phone number (verified by text message), business name, mailing address.
• Professional and licensing information: insurance license numbers and states, NPN, license images, carrier appointments.
• A2P 10DLC registration information: legal business name, EIN or tax ID, business address, and authorized representative name, email and phone. We submit this to our telecom carrier and The Campaign Registry to register your messaging brand and campaigns.
• Account and security data: login credentials, multi-factor authentication settings, legal-acceptance receipts (document version, time, IP address, user agent, timezone), audit logs.
• Billing and commercial information: subscriptions, wallet balance, top-ups, auto-recharge settings, lead orders, usage of calling, texting and AI features, invoices. Card data for your Lead Suite OS billing is collected and stored by Stripe, not by us. (Card data entered by your clients in Secure Forms is handled as described in Section 3.3.)
• Connected-account data: information from Google, GoHighLevel, Zoom, Meta or Sendblue accounts you connect (see Section 9).
• Support communications and uploaded files.

3.2 From consumers whose information is in the platform

This includes consumers our Customers contact through the platform, and consumers whose information Customers upload, collect or buy. Information collected on a lead form is also governed by the privacy policy shown on that form.

• Identifiers and contact information: name, phone, email, postal address, state, ZIP code.
• Insurance-interest information: coverage type, amount, current coverage, beneficiaries, and answers to qualifying questions.
• Sensitive personal information (see Section 3.4): date of birth or age, health conditions, medications, height and weight, tobacco use, veteran or military status and branch, disability rating.
• Consent records: the consent language shown, checkbox state, timestamp, page URL, IP address, user agent, timezone, and a "consent certificate." The certificate records form-interaction events (mouse movement and click positions, scrolls, keystroke counts, not the keystroke contents) to show that a real person submitted the form.
• Communications: content and metadata of text messages, MMS, iMessages, AI chat conversations, call logs, call recordings, transcripts and voicemails.
• Opt-out and do-not-contact status.
• Fraud and verification results: IP risk score, VPN or proxy flags, approximate location from IP, phone line type and activity score, email validity.
• Device data: IP address, browser and device type.

3.3 Secure Forms

Our Customers can send their clients a "Secure Form" to complete insurance applications. Secure Forms may collect:

• Social Security number;
• driver's license number;
• bank routing and account numbers;
• payment card information;
• date of birth;
• beneficiary and policy draft details.

Secure Form data is:

• encrypted with AES-256-GCM envelope encryption;
• protected by a PIN and one-time reveal;
• automatically purged within about 60 minutes after it is retrieved or the form expires.

We process Secure Form data only as a service provider to the Customer who requested it.

3.4 Sensitive personal information and consumer health data

We collect the following categories, which are "sensitive" under the CCPA, the CTDPA and other laws:

• Government identifiers: SSN, driver's license.
• Financial account and payment card numbers.
• Health information: medical conditions, diagnoses, medications, height and weight, tobacco use. This is "consumer health data" under Connecticut and Washington law.
• Veteran or military status.
• Account login credentials.
• The contents of messages and calls where we are not the intended recipient.

We use sensitive information only to:

• provide the services the consumer or Customer requested;
• give insurance agents what they need to discuss coverage eligibility;
• prevent fraud and secure accounts;
• comply with law.

We do not use sensitive information to infer characteristics for advertising. Where the law requires consent to collect sensitive information or consumer health data, the Customer or the lead vendor that collects it is responsible for obtaining that consent.

3.5 Automatically collected information

IP address, device and browser information, pages and features used, timestamps, approximate location derived from IP, and error diagnostics. Our error monitoring (Sentry) runs with personal-data collection disabled and without session replay. The Lead Suite OS application itself does not use third-party analytics.

4. How We Use Personal Information

• Provide the platform: CRM, calling, texting, iMessage, AI agents, scheduling, forms, websites, integrations and support.
• Operate the lead store: deliver leads that Customers buy, and handle replacements.
• Verify and prevent fraud: screen lead submissions and logins (see Section 9), and keep consent records to prove consent.
• Communicate:
  • verification codes and security alerts;
  • billing and payment-failure notices;
  • new-lead and order alerts (which may include the consumer's name, phone, email and state);
  • service announcements.
• Process payments and keep financial records.
• Improve our services. This includes improving AI agents, as described in Section 7.
• Comply with law and enforce our terms: respond to TCPA, carrier, regulator and law-enforcement requests, and defend legal claims.

5. How We Disclose Personal Information

5.1 Service providers and sub-processors

We disclose personal information to the vendors below, who process it on our behalf under written agreements.

5.2 Lead store

When a Customer buys a lead through our lead store or real-time lead products, we deliver that lead's information to the Customer. Leads come from lead vendors and lead forms, which are governed by the privacy policy shown on each form or product (see Section 6).

5.3 Integrations and destinations chosen by Customers

At a Customer's direction, we send Customer Content to the services the Customer connects or configures:

• Google Calendar and Google Sheets;
• GoHighLevel/LeadConnector;
• Ringy;
• Discord;
• the Customer's own webhooks or API clients.

These recipients are governed by their own terms and by the Customer.

5.4 Advertising platforms

We do not disclose the personal information of our Customers, their team users or our website visitors to advertising platforms. Lead forms may use advertising tags as described in the privacy policy shown on each form.

5.5 Telecom carriers and registries

Phone numbers, message content needed for delivery, and 10DLC registration data are disclosed to carriers and to The Campaign Registry.

5.6 Legal, safety and corporate transactions

We disclose information:

• when required by law, subpoena or court order;
• to respond to carrier or regulator inquiries about messaging or calling;
• to protect rights and safety;
• in connection with a merger, acquisition or asset sale, subject to this policy.

6. Sale and Sharing; Do Not Sell or Share

We do not sell or share your information. We do not sell the personal information of our Customers, their team users or visitors to our website. We do not share it with third parties for cross-context behavioral advertising or use it for targeted advertising. Our website and the Lead Suite OS application do not use advertising cookies or tags.

Do Not Sell or Share. You can still record a choice to opt out:

• Use our Do Not Sell or Share My Personal Information page, or the same setting under Settings → Security & Privacy in the application.
• Send a Global Privacy Control (GPC) signal from your browser. We treat GPC as a request to opt out, and when you are signed in, we record that opt-out on your account automatically.
• Email legal@onelifecrm.com with the subject "Do Not Sell or Share," including the email address you use with us.

We keep a record of each choice. If our practices change, we will honor recorded opt-outs and update this policy before any sale or sharing begins.

Lead store and real-time lead products. Leads available through our lead store and real-time lead products come from independent lead vendors and from lead forms. The collection, sale and sharing of that information, including any advertising tags on those forms and the choices you have about them, are governed by the privacy policy shown on the lead form or product where the information was collected. The lead vendors and businesses that operate those forms are responsible for giving notice and obtaining any consent the law requires.

7. Artificial Intelligence

How we use AI:

• AI text agents (OpenAI models) converse with consumers by text on a Customer's behalf. They book appointments, answer questions and follow up. Customers must disclose that these agents are AI.
• AI voice calls run on Telnyx's AI assistant, which currently uses a language model developed by Moonshot AI (Kimi), Deepgram speech recognition and Telnyx voices, provided through Telnyx. AI voice calls are recorded and transcribed. Customers who place AI calls are responsible for obtaining any consent the law requires for AI and recorded calls, and for giving any required disclosures. Recordings and transcripts are retained as described in Section 10; Telnyx and its sub-processors retain call data under their own terms.
• Underwriting assistant (OpenAI) receives the health, age, height/weight and tobacco information an agent enters, and suggests carriers the client may qualify for. Its output is informational and is not an underwriting decision.
• Knowledge base: documents Customers upload are converted into embeddings (OpenAI) so AI agents can reference them.
• Quality improvement: AI conversations may be graded by an AI model and reviewed by our staff. Short excerpts of human-approved conversations, with names and other identifiers redacted, may be used as example responses for AI agents offered across the platform. Customers may opt their accounts out by emailing legal@onelifecrm.com.

Training. We use AI providers through business API terms. Under those terms, your data is not used to train the providers' foundation models. We do not train foundation models on your data.

Automated decisions. We do not make decisions based solely on automated processing that produce legal or similarly significant effects, such as approving or denying insurance, credit or employment. Our automated fraud screening may block a form submission from a high-risk network (for example, an anonymizing proxy). If that happens, you may contact us for human review.

8. Calls, Text Messages and Recordings

• Recording. Calls placed through the platform may be recorded by the Customer. AI voice calls are recorded and transcribed. Recordings, transcripts and message content are stored in our systems and with Telnyx. They are used to:
  • provide the service;
  • document consent and opt-outs;
  • support quality review;
  • defend legal claims.
• Text messages. Message and data rates may apply. Reply STOP to any text to opt out of further texts from that sender, and HELP for help. You may also revoke consent by any other reasonable means, including by emailing legal@onelifecrm.com.
• No sharing of mobile opt-in data. We do not share mobile numbers or SMS opt-in consent with third parties or affiliates for their own marketing. This does not apply to the delivery of a lead to the agent or agents named or described on the form you submitted, which is governed by that form's privacy policy, or to service providers that deliver messages.
• Customers are senders. Customers decide whom to call or text and are responsible for obtaining consent, honoring opt-outs and giving recording and AI disclosures.

9. Integrations and Google User Data

Google. If a Customer connects Google, we request these scopes:

• openid and email;
• calendar.readonly, calendar.events and calendar.calendarlist.readonly;
• drive.file, limited to files you create or select with the Picker.

We use this access only to provide the calendar-sync and spreadsheet features the Customer enables.

Lead Suite OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, or use it to train generalized AI models. You can revoke access in Settings → Integrations or at https://myaccount.google.com/permissions.

Other integrations. GoHighLevel, Meta (advertising insights), Zoom and Sendblue connections use OAuth tokens or credentials that we store encrypted. We use them only to provide the integration.

10. Data Retention

We delete or de-identify information when it is no longer needed, unless a legal hold or dispute requires longer retention.

11. Your Privacy Rights

Depending on your state or country of residence, you may have the right to:

• Know or access the personal information we hold and how we use it.
• Correct inaccurate information.
• Delete your information, subject to legal exceptions.
• Port your information in a portable format.
• Opt out of sale, sharing, targeted advertising, and profiling with significant effects.
• Withdraw consent to processing of sensitive data or consumer health data (Connecticut, Washington, and other states).
• Appeal our decision on your request.
• Non-discrimination. We will not penalize you for exercising your rights.

How to submit a request:

• Email legal@onelifecrm.com.
• Use the privacy request form in the application.
• To opt out of sale or sharing, use our Do Not Sell or Share My Personal Information page.
• Mail us at the address below.

We will verify your identity by matching information you give with information we hold. You may use an authorized agent with signed permission.

Timing. We acknowledge California requests within 10 business days. We respond within 45 days, extendable once by 45 days where permitted.

Appeals. If we deny your request, email legal@onelifecrm.com with "Appeal" in the subject within 45 days. We will respond within 60 days. If you disagree with the outcome, you may contact your state Attorney General. For Connecticut residents, that is https://portal.ct.gov/ag.

Consumers contacted by an agent. If an agent contacted you, the agent controls the information it holds in its account, including leads it uploaded or bought. For a lead that came from a lead form, the privacy policy shown on that form also applies. We will forward your request to the agent and help them respond.

Consumer health data (Washington, Connecticut, Nevada). You may confirm, access and delete consumer health data we hold about you, and withdraw consent, by emailing legal@onelifecrm.com.

Canada. Canadian residents may access and correct their information and withdraw consent under PIPEDA. Our privacy officer can be reached at legal@onelifecrm.com. Information is stored and processed in the United States and may be accessed by U.S. authorities under U.S. law.

12. Cookies and Similar Technologies

The Lead Suite OS application uses only strictly necessary cookies, for login sessions, connecting integrations, logged support access and Secure Form access. Our website and the application do not use advertising cookies or tags. Lead forms may use cookies and advertising tags as described in the privacy policy shown on each form. See our Cookie Policy for details. We honor GPC signals as described in Section 6. We do not respond to "Do Not Track" signals, which have no agreed standard.

13. Security

We use administrative, technical and physical safeguards designed to protect personal information, including:

• TLS encryption in transit;
• row-level database access controls;
• AES-256-GCM encryption of Secure Form data and stored integration credentials, with key rotation;
• hashing of IP addresses and tokens where feasible;
• multi-factor authentication;
• rate limiting and bot protection;
• audit logging of administrative and support access;
• automatic purging of Secure Form data.

No system is perfectly secure. If a breach affects your information, we will notify you and regulators as required by law.

Support access. Our staff may access a Customer account to provide support, only as needed. These sessions are time-limited and logged.

14. Children

Our services are for adults and are not directed to anyone under 18. We do not knowingly collect information from children under 18. If you believe a child has provided information, contact legal@onelifecrm.com and we will delete it.

15. Data Location

We are based in the United States, and we store information in the United States. Some service providers may process information in other countries under their own safeguards. Our services are offered to U.S. insurance agents and are not directed to individuals in the European Economic Area or the United Kingdom.

16. CCPA Categories Table (past 12 months)

This table covers information we handle under this policy. Information in leads from our lead store and real-time lead products is covered by the privacy policy shown on the lead form or product where it was collected.

17. Changes to This Policy

We will post changes here and update the "Effective date". For material changes, we will notify Customers by email or in the application before the change takes effect, and may ask Customers to accept the updated policy.

18. Contact Us

One Life Leads, LLC d/b/a Lead Suite OS Email: legal@onelifecrm.com Mail: 50 Cockle Hill Rd, Salem, CT 06420, United States Website: https://www.leadsuiteos.com