We take security seriously and apply practical safeguards to protect your data. No service can guarantee perfect security, but we continuously work to improve our protections.
Security
This page describes how QuickLead protects your data across the browser extension, portfolio, AI assistant, and backend services.
1. Encryption in transit
All communication between your browser, the extension, and our servers uses HTTPS (TLS encryption). This includes listing captures, AI chat messages, billing operations, and account management.
2. Account separation
Each user account has its own isolated portfolio. Your captured listings, notes and buyer profile are only accessible to you and the family members you explicitly invite (Plus plan). Your conversation with the Decision Assistant is narrower still: it is private to you, and nobody else in the wallet can read it, family members included. Other users cannot see your data.
Account authentication uses secure session tokens with automatic expiry. Family members authenticate independently with their own credentials.
3. AI data handling
When you use the Decision Assistant, listing data and conversation context are sent to Alibaba Cloud Model Studio (Qwen) via their API. Alibaba Cloud has confirmed that data submitted through their API is not used for model training. The connection uses HTTPS and API key authentication.
4. Payment security
All payments are processed by Stripe. We never store, see, or have access to your credit card number. Stripe is PCI DSS Level 1 certified — the highest level of payment security.
5. Rate limits and abuse prevention
We enforce rate limits on account creation, captures, and chat messages to prevent abuse and protect service availability. Accounts creating excessive requests may be temporarily throttled. We also limit account creation per device and IP address.
6. Secret management
Service credentials, API keys, and encryption secrets are stored in managed environment variables and are never exposed in application logs or client-side code.
7. Logging and monitoring
We maintain operational logs for reliability, incident response, and abuse detection. Logs contain request metadata (timestamps, response codes, latency) but do not store raw personal data, passwords, or payment details.
8. Data minimisation
We aim to collect and retain only the data needed to provide the service. The daily abuse counters are deleted after 90 days, and the monthly totals derived from them after 13 months; the device identifier and IP address behind them are only ever stored as a SHA-256 hash. Portfolio data is kept while your account is active and deleted immediately when you delete your account — billing records are the only thing kept afterwards. See our Privacy Policy for full retention details.
9. Reporting security issues
If you discover a security vulnerability or have a concern, please report it to [email protected]. We take all reports seriously and will respond as quickly as possible.