Legal
How Amexa.ai collects, uses, retains, and protects information across our website and LeadOS platform. Last updated August 4, 2026.
Amexa.ai (“Amexa”, “we”, “us”) builds an AI-powered lead operating system for small businesses, starting with roofing contractors. This policy explains how we handle information collected through amexa.ai and through the services we deliver to business customers.
This page is maintained by Amexa and describes our current practices. It is not a certification or an independent audit.
Information you give us: name, business name, email address, phone number, industry, service interests, and anything else you include in a contact or demo request. Contact forms on this site are currently disabled, so no submissions are being accepted at this time.
Information collected automatically: basic technical data such as IP address, browser and device type, referring page, and pages viewed. This is used to keep the site secure and to understand which content is useful.
Customer data processed on your behalf: when Amexa operates lead capture, outreach, CRM sync, or follow-up for a business customer, we process the lead records that business provides or generates — typically name, contact details, address, and job or inquiry details.
To respond to inquiries and schedule demos; to provide, operate, and improve the LeadOS platform and related services; to send service and account communications; to protect against fraud, abuse, and security incidents; and to meet legal and record-keeping obligations.
We do not sell personal information, and we do not share it with third parties for their own advertising purposes.
For information about our own visitors and prospects, Amexa acts as the controller of that data.
For lead and customer records processed inside a business customer's LeadOS workspace, Amexa acts as a processor and handles that data only on that customer's documented instructions.
Outreach performed through Amexa on behalf of a business customer requires that customer to have a lawful basis and appropriate consent to contact each lead.
Every automated email includes an unsubscribe link, and SMS replies of STOP are honored. Opt-outs and Do Not Contact selections are recorded at the workspace level and suppress future automated outreach across channels.
Inquiry and prospect records are kept for up to 24 months from the last interaction unless you ask us to delete them sooner.
Customer lead data is retained for the life of the customer agreement and deleted or returned within 30 days of termination, except where a longer period is required by law. Backups age out on a rolling 35-day cycle.
We rely on a small set of vendors to run the platform, including cloud hosting and content delivery, managed database and authentication infrastructure, transactional email and messaging providers, and product analytics and error monitoring.
Each provider is bound by contract to process data only for the purposes we specify. A current subprocessor list is available on request via the contact details below.
All traffic to amexa.ai is served over HTTPS with TLS, and data is encrypted at rest by our hosting and database providers. Access to production systems is limited to personnel who need it, protected by individual accounts and multi-factor authentication.
No system can be guaranteed to be perfectly secure. We do not claim compliance with SOC 2, ISO 27001, HIPAA, or PCI DSS at this time.
You can request access to, correction of, or deletion of the personal information we hold about you, ask for a copy in a portable format, or object to certain processing. Depending on where you live, these rights may be granted by law; we honor reasonable requests regardless of location.
If your data sits inside a business customer's workspace, we will forward your request to that business and support them in responding.
This site uses only the cookies and local storage needed to load pages and remember basic preferences, plus privacy-respecting analytics to count page views. We do not run third-party advertising or cross-site tracking pixels.
Amexa is a business tool and is not directed to anyone under 16. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.
We may update this policy as the product evolves. Material changes will be reflected in the “last updated” date at the top of this page, and significant changes affecting business customers will be communicated directly.
Questions, privacy requests, or security reports can be sent to privacy@amexa.ai. We aim to respond within 30 days.