Andrea Lead Alerts · Last updated 29 August 2026
This policy explains what data the Andrea Lead Alerts application accesses, how it is used, and how it is protected. It covers two distinct groups: the operator who installs the application, and prospective clients who message the WhatsApp assistant.
Andrea Lead Alerts is operated by the business identified in the contact section below. The application is an internal business tool. It is not offered to the general public and is not used to process data on behalf of unrelated third parties.
When the operator authorises this application with their Google Account, the application requests a single permission:
This scope allows sending only. The application cannot read, search, delete, or modify any message in the operator's mailbox, and cannot access contacts, Drive, Calendar, or any other Google service.
The permission is used for exactly one purpose: to send lead notification emails from the operator's own address to the operator's own inbox when the WhatsApp assistant qualifies a prospective client. No other email is sent using this permission.
The application stores an OAuth refresh token so it can continue sending without re-authorisation. This token is held as an encrypted environment variable on the hosting provider and is never transmitted to any third party. The operator can revoke it at any time at myaccount.google.com/permissions, which immediately and permanently ends the application's access.
The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, data obtained through Google APIs is not used for advertising, is not sold, is not transferred to third parties except as required to provide the service or to comply with law, and is not read by humans except with the operator's explicit consent, for security purposes, or where required by law.
When someone messages the WhatsApp assistant, the following may be recorded in order to respond to their enquiry and pass it to the advisory team:
This information is provided voluntarily by the person messaging, is used solely to respond to their enquiry and arrange follow-up, and is stored in a private spreadsheet accessible only to the operator and the advisory team.
Conversation and lead data is processed by a small number of service providers, each solely to deliver this service:
Lead information is not sold, rented, or shared for advertising purposes under any circumstances.
Conversation history is retained so the assistant can recognise a returning client and continue a prior conversation rather than starting over. A person may clear their entire conversation history at any time by sending the message /reset to the assistant, which permanently deletes the stored record of that conversation.
Qualified lead records are retained in the operator's spreadsheet for as long as the enquiry remains commercially relevant, and are deleted on request.
Under the EU General Data Protection Regulation, individuals whose data is processed have the right to request access to it, correct it, request its deletion, object to its processing, or request a portable copy. Requests can be made using the contact details below and are answered within 30 days.
All credentials are stored as encrypted environment variables and are never committed to source control. Access to the lead spreadsheet is restricted to the operator and the advisory team. All data is transmitted over encrypted connections.
Material changes to this policy will be reflected in the "last updated" date above.
Questions about this policy, or requests concerning personal data, can be sent to:
johndavid.w.whalen@gmail.com