Privacy & Cookie Policy

1Controller

1. The controller of the personal data of users of the LeadScout Service (the browser extension, the leadscout.pl website and the Dashboard) within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) is , a natural person conducting unregistered business activity under the name “LeadScout”, correspondence address: (the “Controller”).
2. For all matters concerning personal data, you can contact the Controller at kontakt@leadscout.pl or by post at the address in section 1.
3. The Controller has not appointed a data protection officer, as it is not required to do so under Article 37(1) GDPR.
4. Capitalised terms have the meaning given to them in the Terms of Service.

2What data we process

• Account data: email address, password (stored only as a cryptographic hash), Account ID, creation and last sign-in dates, and your chosen language (to send system emails in that language).
• Google or Microsoft sign-in data: if the User chooses this sign-in method, we receive from Google or Microsoft the email address, name and profile picture (if shared) and the account ID with that provider. We never receive the Google or Microsoft account password.
• Configuration data: the content of the “What do you sell?”, “Ideal customer (ICP)” and “Disqualifiers” fields, Extension settings (language, tone, modules, theme, webhook URL), your Plan and Quota usage.
• Analysis data: the address and domain of the Target Website, the page content sent for Analysis, the generated Report, the Lead Score, the Analysis date and the content of Deep Scan questions.
• Mail data: the address and display name of the connected Mailbox, an encrypted refresh token for the access granted by the Mailbox provider, the daily limit and time of the last send; recipients' email addresses and names, subjects and content of messages in the Outbox with their schedule, status and sending result; the signature (name, job title, company, phone, website, logo, note), time zone and confirmation that the sending rules were read; the list of addresses that opted out of the User's messages. We have no access to the content of the User's inbox, contacts or calendar — the basic permissions cover only sending messages and reading the profile (address and name). If the User turns on “Reply tracking”, we additionally read metadata of messages in the inbox and sent items (sender, subject, date, thread ID) — never content or attachments — and store only what relates to messages sent through LeadScout: the fact and date of a reply, the sender address and subject of the reply, and information about non-delivery or auto-replies (thread history). Addresses where a message could not be delivered are added to the User's block list. For a Mailbox connected via SMTP/IMAP we also store the server settings (hosts, ports, username) and an encrypted password (app password), deleted when the Mailbox is disconnected; from the IMAP server we fetch only the headers of new messages (sender, subject, date, thread identifiers), and content only of automatic non-delivery reports, and we store only data relating to messages sent through LeadScout. For A/B tests we record which subject variant was sent; sending statistics are calculated from the same data.
• Prospecting data: lists of company website addresses submitted for a background scan, with their status and result (company name, Lead Score); the content of public company websites fetched by our server solely for the Analysis; the name and job title of a person for whom the User looks up an e-mail address, and the suggested addresses (not stored permanently — the result goes back to the User only); company data from its LinkedIn page (name, website, industry, size, headquarters, description), read by the Extension after the User clicks “Scan”. To check whether a domain accepts mail we use public DNS services (Google Public DNS, Cloudflare) and pass them only the domain name. In this respect we act on the User's instructions as a processor; the User is the controller of the data of people whose addresses they look up.
• CRM data: the stage, tags and lists assigned by the User to lead domains, the content of notes, tasks (title, linked lead, due date, completion status, whether a reminder is on and was sent). Notes and tasks may contain third-party data entered by the User — in that respect we act as a processor (section 4).
• Billing data: customer and Subscription IDs in the Payment Operator's system, the Subscription billing period (monthly or yearly), payment and invoice history, purchased Top-ups (date, number of Analyses, payment ID) and the balance of unused Top-up Analyses, invoicing details provided by the User; in the Dashboard we only show the card brand, last four digits and expiry date provided by the Payment Operator — we never receive or store the full card number or CVC.
• Contact form data: name, email address, message content and the sender's IP address.
• Technical data: IP address, timestamps, request type and error messages in server logs, as well as the number of tokens and the cost of language-model calls attributed to the Account (billing and abuse prevention).
• Data used to protect the free Plan: a random Extension installation ID (not linked to the device or browser beyond the installation itself) and a cryptographic hash of the IP address — we do not store the IP address itself for this purpose.

3Purposes, legal bases and retention

Providing data is voluntary but necessary to conclude and perform the contract (an Account can't be created without an email address, and a Subscription can't be concluded without payment details). Providing data in the contact form is voluntary but necessary for us to reply.

We do not send marketing messages without prior, separate consent within the meaning of Article 398 of the Polish Electronic Communications Law. We do not sell personal data or share it with third parties for marketing purposes.

4Third parties' data contained in Analyses

1. Target Websites may contain third parties' personal data, e.g. names, job titles, business email addresses and phone numbers of company representatives. This data is processed only because the User selected the website for Analysis.
2. With regard to this data, the User is the controller and the Service Provider acts as a processor under the data processing agreement in § 9 of the Terms. The information obligation towards these persons (Art. 14 GDPR) and ensuring a legal basis for processing rest with the User.
3. The Service Provider does not combine third parties' data from different Users' Analyses, does not build its own database from it, does not use it for its own purposes and does not share it with other Users.
4. A person whose data appears in an Analysis may contact the Service Provider at the address in § 1(2); the Service Provider will forward the request to the relevant User and, where possible, help them fulfil it.
5. Recipients of messages sent via Mail. Messages are sent from the User's connected Mailbox and in the User's name — the User is the sender and the controller of the recipients' data, responsible for the legal basis for sending (including consent required under Article 398 of the Polish Electronic Communications Law or equivalent rules in the recipient's country) and for giving recipients the information required by Article 14 GDPR. The Service Provider processes recipients' data solely on the User's behalf.
6. A recipient who clicks the opt-out link in a message's signature is taken to a page on leadscout.pl where they can confirm the opt-out. We then record their email address and the date on a list assigned to the sender's Account and block further messages from that Account to that address. Merely opening the page (e.g. by email security scanners) does not opt anyone out. Messages sent via Mail contain no tracking pixels or link redirects.

5Artificial intelligence and automated processing

1. To generate a Report, the content of the Target Website and the User's configuration data are sent via an API to the language model of the provider listed in § 6. Under that provider's API terms, data sent through the API is not used to train its models.
2. The Lead Score and relationship assessment are automated assessments of businesses selected by the User, prepared solely for the User. The Service Provider does not make decisions about Users or third parties based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them (Art. 22 GDPR).

6Recipients of data

Data may be shared only with providers whose services we use to deliver the Service, under data processing agreements (Art. 28 GDPR) or — to the extent indicated below — as separate controllers:

Data may also be disclosed to public authorities where required by law, and to providers of accounting or legal services to the Controller — to the extent necessary and subject to confidentiality.

7Transfers outside the European Economic Area

Where a recipient processes data outside the EEA, the transfer is based on a European Commission adequacy decision — in particular the implementing decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for organisations that have joined it — or on standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR), together with supplementary measures applied by the recipient. You can obtain a copy of the safeguards used by contacting the Controller.

8Chrome extension — permissions and limited use of data

The Extension requests only the permissions necessary for its features:

9Data subject rights

Everyone whose data we process has the right to:

• access their data and obtain a copy (Art. 15 GDPR);
• rectify their data (Art. 16 GDPR) — configuration data can be changed directly in the Dashboard;
• erasure (Art. 17 GDPR) — individual Analyses and the whole history can be deleted in the Dashboard; we delete the Account on request in accordance with § 10 of the Terms;
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR) — e.g. by exporting the Analysis history to a CSV file;
• object to processing based on legitimate interest (Art. 21 GDPR);
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in the EU country of your habitual residence, place of work or place of the alleged infringement.

Please send requests to kontakt@leadscout.pl. We reply without undue delay and within one month at the latest; in justified cases this period may be extended by two further months, and we will let you know. We may ask for additional information to confirm the identity of the person making the request.

10Cookies and similar technologies

1. Under Article 399 of the Polish Electronic Communications Law of 12 July 2024, storing information or accessing information already stored on a User's terminal device requires consent, unless it is necessary to provide an electronic service explicitly requested by the User.
2. The leadscout.pl website does not use cookies or other analytics, advertising or tracking technologies. We only use essential browser storage mechanisms, which do not require consent:

1. When displaying pages, the browser downloads fonts from Google Fonts servers and — in the Dashboard — the sign-in library from a CDN (jsDelivr); as part of that connection the provider receives your IP address and technical information about your browser. These providers do not set cookies for this purpose.
2. You can delete data stored in your browser or block it in your browser settings at any time; blocking essential mechanisms will prevent signing in to the Dashboard.
3. If we introduce analytics or marketing tools in the future, they will only run after you consent via a banner, with the option to withdraw consent at any time, and this Policy will be updated accordingly.

11Data security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), in particular:

• encryption of data in transit (TLS) at every stage of communication between the Extension, the Dashboard and the server;
• passwords stored only as cryptographic hashes by the authentication provider — the Controller does not know Users' passwords;
• authentication of every request with a session token and access to data limited to its owner;
• encryption of Mailbox access tokens (AES in the Fernet scheme with HMAC authentication) with a key kept outside the database, and requesting only minimal Mailbox permissions (sending messages without the ability to read them);
• request rate limits and anti-spam measures in the contact form;
• signature verification of notifications from the Payment Operator and of system email requests;
• data minimisation and limited access to production systems.

In the event of a personal data breach likely to result in a risk to the rights or freedoms of natural persons, we will notify the Polish supervisory authority within 72 hours and, where the risk is high, the persons concerned as well.

12Changes to this Privacy Policy

This Policy may be updated in particular in the event of changes in the law, the scope of the Service or the recipients of data. We inform Account holders of material changes by email at least 14 days in advance. The current version is always available at leadscout.pl/en/privacy.html (Polish original: leadscout.pl/polityka.html), and its effective date is shown at the top of the document.

Version 3.5 of this Privacy Policy applies from 15 October 2026.