1. Who We Are
LedgeSpace is operated by LEDGESPACE PRIVATE LIMITED (CIN U58202KA2026PTC221276), a company incorporated in India on 20 May 2026. Our registered office is 725/9, G. Floor, 3rd Cross, Near Ashraya Mane, Bogadi, Mysore, Mysore - 570026, Karnataka, India. In this policy, "LedgeSpace", "we" and "us" mean that company.
Privacy and legal contact: hello@ledgespacehq.com
Grievance Officer: Puneeth H B, hello@ledgespacehq.com. We acknowledge requests within 48 hours and aim to resolve them within 30 days.
General and support: hello@ledgespace.com
2. Our Role: Controller and Processor
- For your account (your name, email, agency name, billing and usage details), LedgeSpace is the controller.
- For your clients' data that you connect and report on (analytics, advertising, email and CRM metrics), you are the controller and LedgeSpace is your processor. We handle it only on your instructions.
This policy applies to agencies that use LedgeSpace and to visitors to our website. It does not cover your own clients' customers, whose data you control.
3. What Data We Collect
We collect the minimum amount of data required to provide you with automated reporting services:
- Account Information: your name, work email address and agency name. You sign in with your Google account, so we do not hold a password for your account. Billing details are handled by our payment provider (see section 9); we do not store your card number.
- OAuth Tokens: we request read-only access to platforms like Google Analytics 4, Google Ads and Meta Ads. Tokens are stored encrypted.
- Performance Snapshots: aggregated metric summaries from the platforms you connect (for example total sessions, total spend, top campaigns).
- Client Details You Enter: client names and the email addresses you ask us to send reports to.
- Report Metadata and Link Activity: your report layouts and settings, logs of generated reports, and when a report link is opened (see section 8).
- Usage Data, Logs and Error Reports: used for security, support and fixing bugs.
- Messages You Send Us: so we can reply to you.
4. Google and YouTube User Data
LedgeSpace requests access to your Google account data solely to connect your Google Analytics 4, Google Ads, and YouTube integrations to generate client reports on your behalf.
YouTube API Services: LedgeSpace uses YouTube API Services to authenticate and pull read-only analytics data. By authenticating your YouTube account with LedgeSpace, you are agreeing to be bound by the YouTube Terms of Service, which can be reviewed here: https://www.youtube.com/t/terms. The data we access is also strictly governed by the Google Privacy Policy, which can be reviewed here: https://policies.google.com/privacy.
The specific Google user data we access includes your Google account email address (used for authentication), OAuth access tokens (used strictly to fetch read-only performance data for report generation), and the aggregated performance metrics from the Google services you connect.
We do not sell your Google or YouTube user data. We do not use it for advertising purposes. We do not use it to develop, improve or train generalized artificial intelligence or machine-learning models. We share it only with the service providers listed in section 9, and only to the extent needed to provide the features you asked for (including AI insights, described in section 5), to comply with the law, or for security. We do not allow humans to read your Google user data except where you have given us explicit permission or where it is necessary for security purposes such as investigating abuse.
Google and YouTube user data is stored securely in our database solely for the purpose of providing your reports and maintaining your integration connection. You may revoke LedgeSpace's access to your Google and YouTube data at any time by disconnecting the integration from your LedgeSpace dashboard or by visiting your Google account permissions page at https://myaccount.google.com/permissions. Upon disconnection, your OAuth tokens are deleted from our database immediately.
LedgeSpace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
LinkedIn User Data
LedgeSpace requests access to your LinkedIn account data solely to connect your LinkedIn Company Pages and LinkedIn Ads integrations to generate client reports.
We use the LinkedIn Community Management API and Advertising API strictly to pull read-only performance metrics (such as page followers, impressions, ad spend, and clicks). The specific data we access includes your LinkedIn profile email (for authentication) and OAuth access tokens (to fetch performance data).
We do not sell or disclose your LinkedIn user data to third parties, other than the service providers listed in section 9 that process it on our behalf. We do not use your LinkedIn data for our own advertising or sales purposes. We do not allow humans to read your LinkedIn data except for security or abuse investigations. You can permanently revoke LedgeSpace's access at any time through your LinkedIn account settings. Upon disconnection, your OAuth tokens are immediately deleted from our database.
Meta Ads Data
When you connect a Meta Ads account, we request read-only access via the ads_read permission. We store aggregated campaign performance metrics (spend, impressions, clicks, conversions, ROAS) as normalized snapshots tied to your agency account. We do not store individual user data, audience data, or any Meta user's personal information. To request deletion of all Meta-related data we hold for your account, visit https://ledgespace.com/data-deletion or email hello@ledgespacehq.com.
HubSpot Data
When you connect a HubSpot account, we request read-only access to your CRM data (contacts, deals, and owners). We use this data strictly to generate aggregated reports for your clients. We do not sell, transfer, or use this CRM data for any external marketing purposes. For more information regarding our HubSpot data privacy practices or to submit a data privacy request, please visit our HubSpot Data Privacy Request Page.
What We Do Not Collect
To power automated report generation, we store normalized performance snapshots — aggregated metric summaries — from your connected platforms in our secure database. We do not store raw session-level data, individual website-visitor identities, or full historical event logs. We store only the summarized metrics required to generate your reports (e.g. total sessions, total spend, top campaigns). These snapshots are scoped to your agency and client.
5. How RUSHA AI Uses Your Data
RUSHA AI sends aggregated metrics (totals, percentage changes and daily figures from your connected platforms), your question, and the names of your connected platforms to our AI providers so they can write the insight. We do not send OAuth tokens, passwords or email addresses to them. Please do not type personal data about individuals into the RUSHA question box.
- Providers: Anthropic and OpenAI.
- No model training: we use their business API, under which your data is not used to train their models.
- Short retention by the providers: they may keep a copy for up to 30 days to detect abuse, and longer only where needed to enforce their usage policies or to comply with the law.
RUSHA output is AI-generated and may contain mistakes. It is not professional advice. Please check it before you act on it or send it to a client.
6. Cookies
We use strictly necessary cookies to keep you signed in. We use Google Analytics only if you accept analytics cookies in our cookie banner. You can change your choice at any time using "Cookie Settings" in the website footer. See our Cookie Policy for details.
7. How OAuth Processing Works
Our app connects to your agency's data sources via official OAuth2 protocols requesting read-only access. Access and refresh tokens are encrypted with AES-256-GCM before they are stored. You can revoke our access at any point directly from your Google or Meta security settings.
8. Report Delivery Emails and Report Links
When you configure a client's email address to receive automated reports, we use that email address solely to deliver the message you configured. Your clients' email addresses are kept separate for each agency and are never sold or added to our own marketing lists.
Reports are shared through links. When a recipient opens a report link, we record when it was opened and the browser or device used, so you can see whether a report was viewed. We do not use this for advertising. Some links can be set to expire, and client history pages can be protected with a password.
You are responsible for having a lawful basis and permission to email your clients, and for including an unsubscribe option in your reports where the law requires it. Our follow-up check-in emails include an unsubscribe link.
9. Who We Share Data With (Sub-processors)
We do not sell personal data. We rely on the following providers to run LedgeSpace:
- Microsoft Azure — hosts our application (Southeast Asia / Singapore).
- MongoDB Atlas (MongoDB, Inc.) — hosts our database, on Amazon Web Services in Mumbai, India.
- Vercel — hosts our website.
- Anthropic and OpenAI — AI processing for RUSHA insights (see section 5).
- Creem (Armitage Labs OÜ, Estonia) — our merchant of record for payments, tax and invoicing.
- Hostinger — support mailbox and platform emails.
- Zoho — legal and privacy mailbox.
- Sentry — error monitoring (United States).
- Google Analytics — website analytics, only if you accept analytics cookies.
- cron-job.org — triggers our scheduled jobs.
The current list is also on our sub-processors page. To receive notice of changes, email hello@ledgespacehq.com.
10. International Transfers
Our company is in India, our application runs in Singapore, our database is in India, and some of our providers are in the United States and Europe. If you are in the EU, UK, Canada, Australia or elsewhere, your data is therefore transferred and processed outside your country. For EU and UK personal data we rely on Standard Contractual Clauses where required.
11. Security
- Connection tokens and email passwords are encrypted with AES-256-GCM.
- Optional passwords on client history pages are hashed and never stored in readable form.
- Our service uses TLS (HTTPS) for data in transit.
- Our database provider encrypts stored data at rest.
- Each agency's data is kept separate, and access is limited to authorised staff.
If a breach affects your data, we will tell you without undue delay and within the time the law requires.
12. Data Retention
- Active accounts: we keep your account configuration and data while your subscription is active.
- After cancellation or expiry of a paid subscription: your account is read-only for 15 days, then it locks. We do not delete your data when the account locks, so subscribing again restores your account as you left it.
- Deletion on request: you can ask us to delete your data at any time (see section 13). We do this within 30 days and confirm by email.
- Disconnecting an integration: deletes its OAuth tokens immediately.
- Invoices and tax records: kept for as long as the law requires (currently 8 years in India).
13. Your Rights
Depending on where you live, you may have the right to access, correct, delete, export, restrict or object to our use of your personal data, and to withdraw your consent. These rights come from laws such as the EU and UK GDPR, India's Digital Personal Data Protection Act, California and other US state laws, Canada's PIPEDA and Australia's Privacy Act. We respond to requests within 30 days.
- How to ask: email hello@ledgespacehq.com with the subject "Privacy Request", or visit our data deletion page.
- Complaints: please contact our Grievance Officer first. You may also complain to your local data protection authority.
- California: we do not sell or share personal data for advertising.
14. GDPR and Data Processing Addendum
If you are an EU or UK agency acting as a controller of your clients' data, we act as your processor. Our Data Processing Addendum (DPA) applies automatically. For questions, email hello@ledgespacehq.com.
15. Children
LedgeSpace is a business-to-business platform for registered commercial agencies. You must be 18 or older to use it, and we do not knowingly collect data from children.
16. Changes to This Policy
If we make material changes, we will give 30 days' notice by email to your account administrator and by updating this page.
Contact
Privacy, legal and data-rights requests: hello@ledgespacehq.com. General questions and support: hello@ledgespace.com.
