Privacy Policy

1) Scope and roles

Depending on the context, Leadpoet may act as:

• Controller for information we process to operate the Website, run our sales and marketing, and maintain Leadpoet's business contact database and service features (where applicable).
• Processor / service provider for information a customer submits or connects to the Services (for example, ICP criteria, uploaded lists, internal notes, or HubSpot CRM data), where we process that data on the customer's documented instructions and under applicable agreements and the applicable DPA.

2) Information we collect

A. Information you provide to us

We may collect information you provide directly, including:

• Account and profile information: name, work email, password or authentication details, company name, role, billing contact details.
• Communications: if you contact us, request a demo, or otherwise communicate with us, we collect your contact details and the contents of your message and any attachments. We may track email engagement (for example, opens and clicks) to improve communications and the Services.
• Customer inputs to the Services: ICP definitions, targeting criteria, prompts, preferences, uploaded lists, notes, and other content submitted through the Services.
• Billing information: subscription details and transaction records. Payment card information is typically handled by our payment processors, not stored directly by Leadpoet (depending on integration and configuration).
• Careers: if you apply for a job, we collect the information you submit, such as your resume, employment history, education, and contact details.

If you do not provide certain information, you may not be able to access some or all of the Services where that information is required to provide them.

B. Information collected automatically (cookies and similar technologies)

We and our partners may automatically collect information about your device and how you use the Website and Services, including:

• IP address, device identifiers, browser type, operating system, language, approximate location derived from IP address
• Pages viewed, features used, timestamps, clickstream data, and referral URLs
• Log and diagnostic data (including for debugging, security, and performance)

Cookies and similar technologies. We may use cookies, pixels, SDKs, and similar technologies for:

• Strictly necessary functionality (for example, authentication, session management, and security)
• Analytics to understand usage and improve the Services
• Advertising (where enabled) to measure campaigns and show relevant ads

Your ability to opt out of certain cookies depends on your location and the controls we provide (for example, a cookie banner) and your browser settings.

Website visitor identification. Where enabled, we use B2B visitor-identification providers, including Snitcher and Leadpipe, to infer a visiting company and, in some cases, receive provider-resolved professional details such as a name, work email, job title, company, or professional profile. We label provider-resolved identity separately from identity that a visitor verifies directly with Leadpoet. Provider-resolved identity does not by itself authorize automated outreach.

C. Information from other sources (business contact data and enrichment)

Leadpoet is a B2B platform. We may obtain professional contact details and related business information from third-party sources such as data providers, public sources, and enrichment vendors. This information may include:

• Name, business email, business phone, job title, employer/company, location, professional profiles, and other business-related attributes
• Signals used for relevance and ranking (for example, firmographic attributes or publicly available indicators)

We use this information to build, verify, maintain, and improve our databases and deliver intent and fit outputs to customers.

D. Integrations and single sign-on

If you register or log in using a third-party provider (for example, Google), we may receive certain profile and authentication information from that provider, such as your name and email address, subject to the provider's settings and policies. If you connect third-party apps to the Services, we may collect data from those integrations as required to provide the features you enable.

E. HubSpot CRM data

If you connect HubSpot, Leadpoet acts as your processor or service provider for the connected CRM data and processes it on your documented instructions to provide the features you enable. Leadpoet receives HubSpot account metadata needed to confirm compatibility, OAuth permissions and tokens, and data needed for safe matching and Leadpoet-linked outcome reporting. To prevent duplicate contacts, Leadpoet reads the minimum contact field needed to check whether a Leadpoet-generated email already exists. Depending on your settings and granted permissions, other data can include company domains, owner-directory entries, deal pipelines, associated deals, and outcomes for records linked to Leadpoet.

Leadpoet can create a contact for a Leadpoet-generated lead. If you enable the related features, Leadpoet can also create a company after an exact-domain check, create a Leadpoet-managed deal, add permitted associations only among records it creates, and create Leadpoet-namespaced contact properties used for mapping and traceability. Leadpoet does not update, overwrite, merge, archive, reassign, or delete existing HubSpot records.

When Leadpoet CRM Sync is enabled, Leadpoet retrieves and stores HubSpot fields returned for the enabled objects in a tenant-scoped cache for matching, outcome reporting, idempotency, and audit. Push Only does not retrieve non-privacy webhook records. The cached data is subject to Section 6 and the applicable agreements.

OAuth tokens are encrypted at rest and are decrypted only when Leadpoet needs to make an authorized HubSpot request. Leadpoet currently accepts US-hosted HubSpot accounts only. This is an account eligibility limit, not a promise that Leadpoet or its service providers process or store all data only in the United States. When you disconnect in Leadpoet, Leadpoet starts token revocation. When you uninstall in HubSpot, HubSpot revokes the refresh token, but an access token issued before uninstall may remain usable until it expires. Leadpoet stops new scheduled work and marks the connection reconnect-required after a confirmed token check. Contacts, companies, deals, associations, and Leadpoet properties already created in HubSpot remain under your control.

HubSpot may send configured contact, company, deal, and privacy-deletion webhook notifications. Leadpoet uses those notifications only to maintain the integration and process outcomes for records linked to Leadpoet. For this section, HubSpot API data includes data received from HubSpot and any transformed, derived, cached, synchronized, or locally stored copy of that data. It remains subject to these HubSpot restrictions and is not reclassified as Leadpoet Data, Output Data, or Usage Data to permit generalized or cross-customer use. Leadpoet does not use HubSpot API data to train generalized or foundation models, build cross-customer datasets, or improve outputs for other customers. Leadpoet-linked outcomes are used only for targeting and reporting within the connected customer account. Leadpoet retains connection, consent, audit, and synchronized service data only as described in Section 6 and applicable agreements. You can request access, export, correction, or deletion through the controls and contact methods in Section 9.

F. Google Workspace data

If you connect a Gmail or Google Workspace mailbox, Leadpoet requests read-only access to email messages and permission to send email. We use read-only access to synchronize and display complete message and thread content, preserve conversation context, and detect replies, bounces, and out-of-office messages. We use send access to deliver outreach messages and replies through campaigns you create, approve, or configure. Leadpoet does not request permission to modify or delete Gmail messages, labels, contacts, or calendars.

If you separately enable Google Calendar, Leadpoet requests read-only access to your calendar list and events. We use the calendar list to find calendars available through the connected account. We use event times, organizer and attendee details, response status, and cancellation state to show booked, rescheduled, or canceled meeting activity. Leadpoet attempts to associate that activity with a known contact or company domain only when the match is unique; unresolved or ambiguous activity remains unassociated. Calendar approval is optional and separate from email access. Leadpoet cannot create, edit, or delete calendar events.

Unipile provides contracted mailbox connection and delivery infrastructure. When you use reply classification or drafting features, relevant message and thread context may be processed through OpenRouter using configured commercial model families from OpenAI or Anthropic solely to provide those user-facing features. These requests enforce zero-data-retention routing and route only to providers that do not collect the data for model training. Leadpoet does not use raw or derived Google Workspace data to create, train, or improve foundational or generalized AI or machine-learning models.

Synchronized message, thread, calendar-list, and event data may be stored in Leadpoet-controlled application storage as needed to display conversation and meeting history, operate connected campaigns, prevent duplicate sends, and maintain required security and audit records. Access is limited to authorized workspace users and service providers acting on Leadpoet's instructions. Disconnecting a mailbox or Calendar connection stops future access for that connection but does not automatically erase content already synchronized. A workspace owner may ask Leadpoet to delete or de-identify that synchronized content, subject to any limited retention required for security, audit, legal, or dispute-resolution records.

Leadpoet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3) How we use information

We use the information we collect for purposes such as:

• Provide and operate the Services: create and manage accounts, deliver features, generate lead outputs, and respond to requests.
• Improve and develop the Services: analytics, debugging, product research, feature development, and database quality and verification. HubSpot and Google Workspace API data are excluded from generalized or cross-customer improvement uses except for operational security, debugging, and reliability work needed to support the connected customer.
• AI-assisted features: we may use automated systems (including AI/ML) to generate rankings, summaries, explanations, and other insights. These systems may use business contact data and customer-provided inputs as feature inputs. HubSpot and Google Workspace API data are handled only as described in their provider-specific sections and are not used to train or improve generalized AI models.
• Customer support: troubleshoot issues and provide support.
• Sales and marketing: send communications about the Services, events, and updates, and run campaigns.
• Billing and accounting: process payments, manage subscriptions, and maintain transaction records.
• Security and fraud prevention: protect the Services, prevent abuse, investigate suspicious activity, and enforce our terms.
• Legal and compliance: comply with applicable laws, resolve disputes, and enforce agreements.
• Aggregated and de-identified data: create aggregated or de-identified insights and metrics for lawful business purposes, excluding HubSpot and Google Workspace API data from cross-customer datasets.

Legal bases (EEA/UK/Switzerland, where applicable)

Where required, we rely on legal bases such as:

• Performance of a contract (providing Services you request)
• Legitimate interests (operating and improving the Services, security, B2B marketing, and maintaining data quality)
• Consent (where required for certain cookies or marketing)
• Legal obligation (compliance and recordkeeping)

4) How we share information

We may share information in the following circumstances:

A. Vendors and service providers

We share information with vendors who help us operate the Website and Services (for example, hosting, analytics, customer support tooling, communications, security, and payments). These vendors are permitted to process information only to provide services to us, subject to appropriate contractual protections.

B. Customers and users of the Services

If the Services return results that include business contact data, we may disclose business contact information and related outputs to our customers and their authorized users when they use the Services.

C. Legal, safety, and rights protection

We may disclose information if we believe it is necessary to comply with law or legal process, respond to lawful requests, protect rights and safety, or prevent fraud and abuse.

D. Corporate transactions

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be shared as part of due diligence or transferred as part of that transaction, subject to standard protections.

E. With your direction or consent

We may share information when you direct us to do so or provide consent.

5) Cookies, analytics, and advertising choices

You can manage cookies in several ways:

• Cookie banner (where available): accept or reject optional cookie categories.
• Browser controls: block or delete cookies through your browser settings (note that some features may not function without strictly necessary cookies).
• Advertising opt-outs: depending on your region, you may have additional ways to opt out of interest-based advertising through industry tools and platform settings.

Do Not Track

Some browsers offer "Do Not Track" signals. Because there is no universally adopted standard, we do not respond to DNT signals at this time.

We do honor a browser Global Privacy Control signal for the Website visitor-identification trackers described above.

6) Data retention

We retain information for as long as reasonably necessary to:

• Provide and improve the Services
• Maintain accurate and reliable business contact data and service outputs
• Comply with legal, tax, and accounting requirements
• Resolve disputes and enforce agreements

Retention periods vary based on the type of data, its sensitivity, our relationship with you, and legal obligations. We may retain certain information in a suppression form to ensure we honor opt-out and deletion requests (for example, to prevent reintroduction of a record).

Provider-resolved professional details from Website visitor identification are retained for no more than 90 days after their last update. We then remove the identifying fields and keep only de-identified operational evidence. If you opt out, we may keep a one-way suppression hash for longer so the same professional details are not added again.

7) Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. However, no system can be guaranteed 100% secure. You are responsible for maintaining the confidentiality of your credentials and for using secure devices and networks.

8) International data transfers

Leadpoet may process and store information in the United States and other countries where we or our vendors operate. Where required, we use appropriate transfer mechanisms (such as contractual protections) to help protect cross-border transfers.

9) Your rights and choices

A. Marketing communications

You can opt out of marketing emails by using the unsubscribe link in our messages. You may still receive non-marketing communications (for example, billing, security, or account-related messages).

B. Account information

If you have an account, you may be able to review and update certain information through account settings (if available) or by contacting us.

C. Business contact data requests (individuals)

If you are an individual whose professional information may appear in our datasets or outputs, you can request access, correction, deletion, or suppression (depending on applicable law). In many cases, suppression is used to ensure your information is not provided through the Services going forward.

D. EEA/UK/Switzerland rights (where applicable)

You may have rights to access, correct, delete, object, restrict processing, and data portability, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data protection authority.

E. U.S. state privacy rights (where applicable)

Depending on your state of residence, you may have rights such as access, deletion, correction, and opt-out of certain targeted advertising or other processing. We may need to verify your identity before completing a request. We will not discriminate against you for exercising applicable rights.

10) Children

The Website and Services are not intended for individuals under 18, and we do not knowingly collect personal information from minors.

11) Third-party links

The Website or Services may link to third-party sites or services. Their privacy practices are governed by their own policies, not this one.

12) Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date reflects the effective date of the current version. If changes are material, we may provide additional notice (for example, via the Website or email).

13) Contact us

If you have questions or requests regarding this Privacy Policy or our privacy practices, contact us: