Privacy Policy

About Clients. When a business signs up, we collect business name, owner name, email, phone number, and — for services that require CAN-SPAM-compliant physical-address disclosure — a mailing address.

About Contacts. When Client uses the Service to reach its own customers or to source new leads, we store the Contact's name, email, phone number, company, pipeline notes, lead status, and message/reply history. This data comes from Client's own records (e.g. quote or invoice history it imports), leads submitted through a Client landing page, or new contacts identified through third-party business data providers described below.

Connected accounts. If Client connects a Gmail or Microsoft/Outlook account to send outreach from its own address, we store encrypted authorization tokens for that connection. We do not read or store the contents of Client's broader mailbox beyond what is needed to send outreach and detect replies to it.

When sourcing new leads on Client's behalf, the Service may use:

• Business contact data providers — to search for and enrich business contact and company information.
• Email-finding and verification services, and public business websites — to locate a likely contact email and confirm it's deliverable before it's used for outreach.
• Public property and business-registry records — for Clients running property-based outreach (e.g. home services), we may source a property owner's name and address from public parcel or government filing records.
• Skip-trace and contact-resolution services — for that same property-based outreach, we may use a third-party service to resolve a property owner's name and address into a likely phone number and/or email address, so the lead can be added to an outreach sequence.

These providers process data under their own privacy terms. We use them only to identify accurate, reachable contacts for Client's outreach purpose — not to build consumer profiles unrelated to that purpose. The specific providers we use may change over time as we evaluate better options.

See Section 3 for how AI is used to process inbound replies.

Outreach emails are sent through Client's connected Gmail or Microsoft account, a connected SMTP mailbox, or, for system and transactional messages, through an email delivery service we operate. Outbound messages include click tracking on links so Clients can see engagement; we do not use open-tracking pixels.

Inbound replies are read by an automated AI-based classifier to determine whether a reply is a hot lead, a request to stop contact, an out-of-office response, or otherwise, so that Client can prioritize follow-up. Contact data processed by AI models in this way is used only for this classification purpose and is not used to train third-party models.

Every outreach email includes an unsubscribe link. We also automatically detect stop/unsubscribe/remove requests in reply text, and honor mailbox-level list-unsubscribe signals from providers like Gmail and Yahoo. Once a Contact opts out, they are suppressed from future automated outreach across the platform, not just for the Client that originally contacted them. We also track bounces and spam complaints to keep sender reputation healthy and to stop contacting addresses that are no longer valid.

Client and Contact data is stored in a Postgres database. Connected-account authorization tokens are encrypted at rest. Automated database backups are encrypted in transit and stored in a private cloud storage bucket, retained on a rolling basis to allow recovery in the event of data loss.

Our marketing website does not use analytics or advertising cookies. The Service's client dashboard uses only the technical cookies necessary to keep a Client signed in.

We do not sell personal data. We share data with the third-party providers described in this policy (lead sourcing, contact resolution, email verification, email delivery, reply classification, and cloud storage) solely to operate the Service, and with law enforcement or other parties when required by law.

For Clients running advertising campaigns through the Service, we may share hashed Contact identifiers (such as a hashed name and address) with advertising platforms (e.g. Meta) to build custom audiences for that Client's ad campaigns. This sharing is limited to Clients who have opted into advertising features and is used only to serve that Client's own ads.

We retain Client and Contact data for as long as Client's account is active, plus a limited period afterward for backup and legal-compliance purposes. Contacts who unsubscribe remain on our suppression list indefinitely so we can continue to honor their opt-out, even though we stop sending them outreach.

• Contacts can opt out of future outreach at any time using the unsubscribe link in any email, or by replying with a stop request.
• Clients can request export or deletion of their account data, subject to backup and legal-retention constraints, by contacting us.

We may update this Privacy Policy from time to time. Material changes will be communicated to active Clients by email. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

Questions about this policy, or requests to exercise the choices above, can be sent to hello@leadgineer.co.