Privacy Policy

1. Who We Are

LeadSweep is a CRM and email outreach platform built for solo sellers and small teams. We are based in Annapolis, Maryland. References to "LeadSweep," "we," "us," or "our" in this policy refer to the LeadSweep service and its operator.

Questions? Email us at privacy@leadsweep.ai.

2. Information We Collect

We collect only what we need to provide the service:

• Account information: your name, email address, and a hashed password when you register.
• Lead data: contact names, companies, email addresses, phone numbers, notes, and any other details you enter into LeadSweep about your prospects.
• Usage data: pages visited, features used, and actions taken within the app (e.g., emails sent, leads created). This helps us understand how the product is used and where to improve it.
• Email interaction data: open and click events for emails sent through LeadSweep, tied to the specific lead record.
• Session data: a signed session cookie that keeps you logged in. No third-party tracking cookies.
• Technical data: IP address, browser type, and referring URL logged at the server level for security and debugging.

3. How We Use Your Data

We use the data we collect to:

• Provide and maintain the LeadSweep service.
• Authenticate you and keep your account secure.
• Send transactional emails (password resets, account notifications). We do not send marketing emails without your consent.
• Analyze aggregate, anonymized usage patterns to improve the product.
• Respond to support requests or inquiries you send us.
• Comply with legal obligations where required.

4. Cookies

LeadSweep uses a single session cookie to keep you logged in between page loads. This cookie is HTTP-only and signed with a server-side secret. It contains no personal information beyond an encrypted session reference.

We do not use third-party tracking cookies, advertising pixels, or analytics cookies from platforms like Google Analytics, Meta, or similar services.

Session cookies expire after 14 days of inactivity or when you log out.

5. Data Storage and Security

Your data is stored on servers hosted by Render (render.com) in the United States. We apply the following security measures:

• Passwords are hashed using PBKDF2-SHA256 — we never store plaintext passwords.
• All data is transmitted over HTTPS/TLS.
• Session cookies are signed and HTTP-only.
• API webhook endpoints are protected with a shared secret and constant-time comparison to prevent timing attacks.
• All database queries are tenant-scoped — your data is strictly isolated from other users' data.

No system is perfectly secure. If you discover a potential security issue, please disclose it responsibly to privacy@leadsweep.ai.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, your data (leads, emails, sequences, calendar events, and account information) is permanently deleted from our systems within 30 days.

You may also request deletion of specific data without closing your account by emailing privacy@leadsweep.ai.

7. Your Rights

You have the following rights over your data:

• Access: you can view all your data by using the app. We also provide a full CSV export of your leads from the app at any time.
• Rectification: you can update your account information and lead data directly in the app.
• Erasure: you can delete individual leads, or delete your entire account and all associated data.
• Data portability: export your leads to CSV at any time from the leads view. No lock-in.
• Withdraw consent: you can stop using the service and delete your account at any time.

To exercise any right or make a data request, email privacy@leadsweep.ai. We will respond within 30 days.

8. GDPR (European Users)

If you are located in the European Economic Area (EEA), the following additional rights apply under the General Data Protection Regulation (GDPR):

• Right to access: request a copy of the personal data we hold about you.
• Right to rectify: request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): request deletion of your personal data.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.

Our legal basis for processing your data is (a) performance of a contract (providing the service you signed up for) and (b) legitimate interests in operating and improving the service.

To exercise any GDPR right, contact privacy@leadsweep.ai. You also have the right to lodge a complaint with your local data protection authority.

9. Third-Party Services

LeadSweep integrates with the following third-party services when you configure them:

• Gmail / Zoho Mail / SMTP: used to send emails on your behalf. Credentials are stored encrypted and used only to send the emails you initiate.
• SendGrid: optional email delivery provider. If configured, SendGrid processes emails you send through LeadSweep under their own privacy policy.
• Render: our hosting provider. Render has access to infrastructure-level data. See render.com/privacy.

We do not integrate with advertising networks, social media tracking pixels, or data brokers.

10. Children's Privacy

LeadSweep is not intended for use by children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe a minor has created an account, please contact us and we will delete the account promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify registered users by email.

Continued use of LeadSweep after changes are posted constitutes acceptance of the updated policy.