1. Who we are

Leads Hub, . Contact: .

This policy covers two different kinds of personal data, and the distinction matters: data about you, our customer, and data about the people in the lead lists you build.

2. Data about you

• Account: your name, email address and authentication identifier, held by Firebase Authentication.
• Usage: credit transactions, search history, and logs of actions taken in the app.
• Billing: PayPal order identifiers and amounts. We never see or store your card details - PayPal handles payment entirely.
• Sending credentials: the SMTP app passwords and API keys you add. These are encrypted with AES-256-GCM before storage, and the interface only ever shows you a masked preview.

We use this to run the service, meter usage, prevent abuse and provide support. We do not sell it.

3. Data about your leads

When you search for businesses and enrich them, the service collects business details and, where available, information about owners - names, email addresses, phone numbers, social profiles and approximate location - from third-party sources and public listings.

For that data, you are the data controller and we are your processor. It is stored in your account, is not shared with other customers, and is deleted when you delete it or close your account.

You are responsible for having a lawful basis to process it and for honouring requests from the individuals concerned. If someone asks you to delete their data, you can do so from the All Leads page, and adding them to your suppression list prevents any future contact.

4. Mailbox access

If you enable reply and bounce tracking, the service reads the mailbox of each sending account over IMAP.

It stores a message only if it is a bounce notification or can be matched to something you sent through the service. Your other mail is read past and never written to our database.

5. Where data is held

Google Cloud Platform (Firestore and Cloud Run). Google acts as our sub-processor. Data may be processed in regions where Google operates.

Third parties that receive data in the course of providing the service include the mapping, search, enrichment and email-delivery providers configured for your account.

6. Retention

• Lead and campaign data: until you delete it or close your account.
• Send logs and inbox records: until account closure.
• Suppression list: retained after account closure where required, because keeping a record of who asked not to be contacted is itself a compliance obligation.
• Billing records: retained as long as tax and accounting law requires.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict its processing.

Export and deletion are self-service on your Profile page. Export returns your account data and leads as JSON; deletion removes your account and its data and cannot be undone.

For anything else, or to complain, contact .

8. Security

Traffic is encrypted in transit. Sending credentials are encrypted at rest with a key held separately from the database. Access to your data is scoped to your account at the database level.

No system is perfectly secure. If a breach affects your data we will notify you without undue delay.

9. Cookies

We use a single session cookie to keep you signed in. It is essential to the service, is not used for advertising, and there is no third-party tracking on the application.