Privacy
Last updated 13 September 2026
We build systems that handle other businesses’ customers, so this page is specific rather than reassuring. Everything below is checkable, and where we made a deliberate choice we say what it was and why.
Who we are
Automate Leverage, based in Phnom Penh, Cambodia. We design and run automated lead handling for businesses, mostly on Telegram. For anything on this page you can reach a person at customerservice@automateleverage.com.
We do two different jobs, and your rights differ
This distinction matters more than anything else here, so it comes first.
When you contact us about our own services, we decide what happens to your details. We are the controller. This policy is the full description, and you exercise your rights directly with us.
When you are a customer of a business that uses our system, that business decides what happens to your details, not us. We operate the machinery on their instructions. We are their processor. We do not sell, share, mine or reuse their customer data, and we never move it between clients. If you want your record changed or deleted, ask that business: they can do it from their own dashboard, and we will help them if they ask. If you are not sure who holds your data, write to us and we will tell you.
What we collect
If you fill in a form on this site: the name, phone number, email address and message you type. Nothing is required beyond a way to reply to you.
If you message us on Telegram: your Telegram display name, username and chat ID, and whatever you send, including voice notes and photo captions.
If you book a meeting: your name, the contact detail you give the booking page, and the time you chose.
If you only read the site: your IP address and request headers reach our host in ordinary web server logs, and the advertising cookie described below is set in your browser.
We never ask for, and have no use for, identity documents, payment card details, bank details or any financial information. If you send them anyway we will delete them and tell you we have.
Why we use it, and on what basis
| What for | Basis |
|---|---|
| Replying to your enquiry, and following it up | You asked us to. In GDPR terms, the steps before a contract |
| Running the automated reply and the booking link | The same. It is how we reply at all |
| Keeping the system secure, and keeping backups | Our legitimate interest in a service that works and does not lose your message |
| Advertising measurement | Your consent, asked for first if you appear to be in the EU, UK or EEA |
| Keeping a record that you opted out | Our obligation not to message you again |
You will be talking to an automation first
Our first reply is generated by software, usually within seconds, and it will tell you so if you ask. It answers from a written document about our business and nothing else. It is not permitted to invent a price, a date or a commitment, and anything it was not taught is passed to a person instead of guessed at.
To produce that reply, the text of your conversation is sent to Anthropic, which runs the model. Your messages are not used to train any model. No decision with a legal or financial effect on you is made automatically: a person decides whether we work together, and a person can take over the conversation at any point, which switches the automation off for you.
Voice notes
If you send a voice note, the audio goes to Google Cloud Speech-to-Text and comes back as words so it can be answered. We do not keep the audio, and we do not keep the text as a second separate record: the words live in your conversation history and nowhere else. That is deliberate. A second copy on a different clock is how a promise to delete quietly becomes untrue.
Where it is stored
On a server we rent and administer at Hetzner in Nuremberg, Germany, in a database only we can reach. Submissions go from your browser to that server directly. They are not loaded into a third-party CRM or a marketing platform, and there is no data broker anywhere in this.
Because the server is in Germany and some of the services below are in the United States, your data crosses borders. Where those transfers fall under the UK or EU rules, the providers we use operate under Standard Contractual Clauses or an equivalent approved mechanism.
Who else can see it
This is the complete list. Each one is a supplier acting on our instructions, not a party we sell anything to.
| Who | What they get | Why |
|---|---|---|
| Telegram | Messages, your Telegram name, username and chat ID | It is the channel you chose to talk to us on |
| Anthropic | The text of your conversation, plus the knowledge base it answers from | It generates the automatic reply. Your messages are not used to train models |
| Google Cloud (Speech-to-Text) | The audio of a voice note, only if you send one | To turn speech into text so it can be answered. We keep no copy of the audio |
| Google Workspace | Email you send us, and email we send you | It is our mail provider |
| Hetzner Online GmbH | Everything, at rest. Nuremberg, Germany | They provide the server. They do not access the data |
| Vercel | Your IP address and request headers, in ordinary web server logs | They serve this website |
| Meta | That a visit or an enquiry happened, and the click ID from the ad | Advertising measurement. Only after you consent, if you appear to be in the EU, UK or EEA |
| TikTok | The same, when the TikTok pixel is switched on | Advertising measurement. Not currently enabled on this site |
Our booking page runs on software we host ourselves on the same server, so booking does not hand your details to another company. If a meeting uses video, the call itself is carried by Daily.co.
How long we keep it
| What | How long |
|---|---|
| Your enquiry and our conversation | While we are in contact, and for 24 months after the last message. Sooner if you ask |
| Voice note audio | Not stored. It is sent for transcription and discarded |
| Automation run logs, which can contain message text | 7 days, then deleted automatically |
| Database backups on the server | 14 days |
| Encrypted off-site backups | 3 days |
| The al_attr advertising cookie | 90 days, in your own browser |
| Opt-out records | Your contact detail and the date you opted out, kept indefinitely so that a STOP stays honoured. Your name, your messages and the rest of the record are deleted with everything else |
What you can ask us for
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable file, object to us using it, or withdraw consent you gave for advertising measurement. You do not need a reason and it costs nothing.
Email customerservice@automateleverage.com. We reply within 7 days and finish within 30. We confirm in writing when a deletion is done, and we will tell you plainly if some part of it cannot be honoured, for example a record we keep in order to know not to message you again.
If you are in the EU, UK or EEA you can also complain to your national data protection authority. We would rather you told us first.
Making the messages stop
Reply STOP to any message, or send /stop to our Telegram bot, and every automated message ends at once. Nothing further is sent while you are opted out.
For context on what would otherwise arrive: an immediate acknowledgement, and if we hear nothing back, up to six follow-ups spread over two weeks. They are only ever sent between 7am and 9pm local time, and they stop permanently the moment a person replies to you.
Cookies and measurement
We set one first-party cookie, al_attr, for 90 days. It records which advertisement or link brought you here, including the click identifier the ad platform adds to the URL, so that we can tell which of our own ads produce enquiries. We use it for that and nothing else: we do not build a profile of you from it, and we do not share it. A click identifier can in principle be linked back to you by the platform that issued it, which is why we treat this as advertising and ask for consent where consent is required.
We use the Meta advertising pixel for the same purpose. The TikTok pixel is supported and is not currently switched on. Both are set by Meta and TikTok and are governed by their own privacy policies. They do not load while you are reading: they load only after you scroll or tap, and never before.
If you appear to be visiting from the EU, UK or EEA we ask you first, and nothing loads unless you agree. We work that out from your device’s timezone, because this site is served as static files and we never see your location. That is a guess rather than a measurement, and it is deliberately a cautious one: if we cannot tell, we ask.
Nothing here has to be accepted in order to read the site, and declining changes nothing about what you can see or do.
How we protect it
Traffic is encrypted in transit. Backups leave the server over an encrypted connection and are stored encrypted off-site, and a copy is restored and tested on a schedule, because an untested backup is a hope rather than a backup. Access to the dashboard is by named account with a role attached, every sign-in is logged, and removing someone takes effect on their next click. There is no shared password and no permanent link that acts as one.
If something goes wrong
If personal data is lost or exposed in a way that could affect you, we will tell you and the relevant authority without undue delay, and within 72 hours where that deadline applies. We will say what happened, what we know, and what we are doing about it, rather than a sentence with no facts in it.
Children
This is a service for businesses. It is not aimed at children and we do not knowingly collect anything from anyone under 16. If you believe a child’s details have reached us, tell us and we will delete them.
If you are our client
Your customer data is yours. We hold it as your processor, and in practice that means it lives in a separate stack and database per client, it is never mixed with another client’s, it is never used to train anything, and we act on your instructions rather than our own judgement. Some clients share a machine, always with their own stack, their own database and their own credentials. If you need the machine to yourself, that is an option we offer rather than an assumption we let you make.
If we stop working together you get a full export in an open format, and your data is destroyed from our systems and from our backups on the schedule above. If you own the server outright, we hand over every key and keep nothing. We will sign a data processing agreement if you need one for your own compliance.
The law this sits under
We are a Cambodian business, so the Law on Electronic Commerce (2019) applies to us: it requires us to protect what we store and to have your consent to store it. Cambodia’s dedicated Law on Personal Data Protection was still in draft when this page was written, and we intend to meet it when it takes effect rather than afterwards.
We also hold ourselves to the GDPR standard, because our servers are in the EU and some of the people who contact us are too. Where this page gives you a right, you have it regardless of where you live. That is a choice, not an admission.
Changes to this page
If what we do changes, this page changes with it and the date at the top moves. We will not quietly widen what we are allowed to do with data we already hold. If a change is significant and we have a way to reach you, we will tell you.
Who to contact
Automate Leverage, Phnom Penh, Cambodia. customerservice@automateleverage.com. We answer privacy questions on the same terms as everything else: quickly, and from a person.