Privacy Policy

This explains what LeadFinder does with personal data. There are two very different groups of people involved, and the answers differ, so they are kept separate below: customers who hold an account, and business contacts who appear in search results.

1. If you have an account

We collect only what running the service needs:

• Your email address — to identify your account and send service messages such as password resets.
• Your password — stored only as a salted scrypt hash. We cannot read it, and neither can anyone who obtains the database.
• Your searches and saved leads — so the app can show them back to you.
• A session cookie (lf_session) — a random token that keeps you signed in. It is strictly necessary for the service to work, contains no tracking, and is not used for advertising.

We do not use analytics, advertising or third-party tracking cookies. We do not sell your data.

2. If you appear in search results

LeadFinder collects business contact details from two kinds of public source: mapping databases (Google Places, OpenStreetMap) and businesses' own websites. Where a name, role or email of an individual appears — for example a founder listed on an About page — that is personal data, and this section explains how it is handled.

What is collected:

• business name, address, phone number and website
• a published email address, where one exists
• a contact name and job title, where the business publishes one
• links to public social media profiles the business links to itself
• the exact page each detail came from, and the date collected

What is never done:

• Addresses are never guessed or generated. If a business publishes none, the field stays empty.
• Nothing behind a login is accessed. Social profiles are links the business published on its own site — we do not sign in to LinkedIn, Facebook or anything else to collect data.
• No special-category data, and no data about consumers, is collected.

Lawful basis. Where the UK or EU GDPR applies, the basis is legitimate interests: making publicly published business contact details findable for business-to-business contact. That interest is balanced against the rights of the people involved, which is why sources are recorded and removal is honoured promptly.

3. Having your details removed

Email privacy@joinleadfinder.com with the business name and email address, and we will remove it and add it to a permanent suppression list so it is not collected again by anyone using the service. No account is needed and no reason is required.

Depending on where you live you may also have the right to access, correct, or object to processing of your data, and to complain to a data protection authority.

4. Who else sees the data

We use a small number of providers, each for one job:

• Vercel — hosting and serving the site
• Neon — the database
• Google Places — business search
• Resend — sending account emails such as password resets

We do not sell personal data or share it for advertising. Data may be stored or processed outside your country, including in the United States.

5. How long it is kept

• Your leads — until you delete them or close your account.
• Your account — until you ask us to delete it.
• Sessions — 30 days, then removed automatically.
• Suppression list — kept indefinitely, on purpose: it is the record of who must not be contacted again.

6. Security

The site is served over HTTPS. Passwords are hashed with a per-user salt. Session cookies are HttpOnly and same-site. Every query is scoped to the account that owns the data, so one customer cannot read or delete another's. No system is perfectly secure, but these are the basics and they are in place.

7. Children

LeadFinder is a business tool and is not intended for anyone under 16.

8. Changes

If this policy changes, the date at the top will change with it, and account holders will be emailed about anything significant.

9. Contact

Privacy questions and removal requests: privacy@joinleadfinder.com.