Privacy Policy

This policy explains how EARNUNI LTD (“Leadvect”, “we”, “us”) collects, uses and protects personal data. It is written to meet the UK GDPR, the EU GDPR and the UK Data Protection Act 2018.

1. Whose data, and our role

• Customers (people with a Leadvect account): we are the controller of your account and billing data.
• Customer Data (the lists, campaigns and emails our customers create, and the replies their mailboxes receive): the customer is the controller and we are their processor, under section 4 of our Terms.
• People who appear in our business data (for example a business’s published contact email or a named company officer): we are the controller of the business directory we compile. A customer who chooses to contact you becomes a controller of that use.

2. Customers: what we collect and why

• Account: name, email, workspace name and team role. Passwords are stored only as salted PBKDF2 hashes. Sign-in sessions are random tokens of which we store only a hash. (Purpose: providing the Service — contract.)
• Billing: handled by Stripe. We store your plan, subscription status and Stripe customer and subscription IDs. We never receive or store card details. (Contract; legal obligation for tax records.)
• Usage: a record of metered actions (searches, enrichments, researched leads) to apply your plan’s limits. (Contract.)
• Connected mailboxes: if you connect a mailbox — through Google or Microsoft, or with its server settings and password / app password — we store that access credential encrypted at rest and never show it again. We use it only to send the emails you approve, to file a copy in your Sent folder, and to read the headers of incoming messages to detect replies and bounces to your campaigns. (Contract.)
• Warmup network (only if you switch it on for a mailbox): your mailbox exchanges short, automatically written warmup messages with other Leadvect customers’ mailboxes. We record each warmup message’s ID, subject, the two mailbox addresses and where it landed (inbox or spam), to move it out of spam, file it in a “Warmup” folder and show your inbox-placement rate. Warmup messages contain no Customer Data. Placement tests send a campaign's first email (rendered for one sample lead) to a few network mailboxes and delete each copy once its folder is recorded. (Contract.)
• Mailbox health checks: to check a sending domain we look up public DNS records (SPF, DKIM, DMARC, MX), the domain's registration date (RDAP) and whether your mail server's IP address appears on public blocklists (SpamCop, Barracuda). Only the domain or IP address is sent to these services. (Contract.)
• Security: IP address and request data for abuse prevention and rate limiting; rate-limit counters expire after 15 minutes. (Legitimate interest in a secure service.)

We do not sell personal data and do not use it for advertising. Leadvect uses one strictly necessary sign-in cookie and no analytics or advertising cookies. Page visits are counted with Cloudflare Web Analytics, which sets no cookies and does not identify or track individual visitors.

3. Google user data (Limited Use)

Leadvect’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Gmail access only to send the emails you approve and to detect replies and bounces to them; we do not use Gmail data for advertising or to train AI models; we do not let humans read it except with your permission, for security, or where the law requires; and we do not transfer it to others except as needed to provide this feature, for security or to comply with the law.

4. People in Leadvect’s business data

What we hold: business names, addresses, phone numbers, websites and categories; contact details a business publishes on its own website (for example a contact email); and, for some companies, officers’ names from public company registers. We do not collect sensitive data and do not profile consumers.

Where it comes from: open datasets — OpenStreetMap, Overture Maps Foundation, Foursquare Open Source Places, the French SIRENE register (INSEE) and Wikidata — the business’s own public website, and public map services queried when a customer searches.

Bounce memory: when an email to an address is permanently rejected (“hard bounce”) for any Leadvect customer, we keep a one-way hash of that address and its domain, so no Leadvect customer keeps sending to an address that does not exist. We never store the address itself for this purpose.

Why, and our lawful basis: to help businesses find and contact other businesses with relevant offers. We rely on legitimate interests. We have weighed these against your rights: the data is about businesses and people in their professional role, it is already public, we keep it to the minimum needed, Leadvect limits how much each customer can send, every email carries an unsubscribe link, and opting out is immediate and global.

Your rights: you can object at any time on the opt-out page, either for one address or for your whole company domain. You can also ask us to access, correct or delete what we hold about you by contacting us (section 9). We keep an opted-out address only as a one-way hash, so we can keep honouring it without storing it in readable form; a company-wide opt-out stores the company’s domain name.

5. Who we share data with (sub-processors)

• Cloudflare, Inc. (USA / global network): hosting, database, file storage, AI inference (Workers AI) and DNS lookups.
• Stripe Payments Europe Ltd / Stripe, Inc.: payment processing.
• Google LLC / Microsoft Corporation: only if you connect your mailbox, to send and read as described above.
• Additional AI model providers, used where enabled to research businesses and draft emails, with each task routed to one of them: Groq, Inc.; Cerebras Systems, Inc.; OpenRouter, Inc. (which passes requests to the model’s host); Mistral AI SAS; SambaNova Systems, Inc.; NVIDIA Corporation; GitHub, Inc. (GitHub Models); and Google LLC (Gemini API — used for users in the UK, EEA or Switzerland only on Google’s paid service). They receive the business information needed for the task — public facts about the business and, where found, a named contact’s name and role — never your account details, your mailbox contents or your passwords. Some of these providers’ free services may use inputs to improve their models; we send them nothing beyond what the task needs.

We will update this list before adding a sub-processor that handles Customer Data. Public data sources we query, for example map services and company registers, receive only search terms such as a business name or place — never your account details.

6. International transfers

Some providers process data outside the UK and EEA, mainly in the USA. Where they do, we rely on the UK International Data Transfer Addendum or EU Standard Contractual Clauses, or on the provider’s certification under the EU-US Data Privacy Framework and its UK extension.

7. How long we keep data

• Account and Customer Data: while your account is active. When it is deleted, we remove it from our live systems within 30 days.
• Sign-in sessions: 30 days. Team invites: 7 days. Mailbox connection requests: 10 minutes.
• Business directory: refreshed from its sources regularly. Records that disappear from the sources drop out at the next refresh.
• Opt-outs and unsubscribes: kept for as long as Leadvect operates, so we can keep honouring them.
• Billing records: kept as tax and accounting law requires.

8. Security

We use encryption in transit (TLS), encryption at rest for mailbox credentials, salted password hashing, hashed session tokens, strict separation between customer workspaces and role-based access within a workspace. No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authority as the law requires.

9. Your rights and contact

Depending on where you live, you can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Contact: use the contact link in your Leadvect account. We reply within one month. You can also complain to a data protection authority — in the UK the Information Commissioner’s Office (ico.org.uk), in France the CNIL (cnil.fr), or your local authority.

EARNUNI LTD — registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

10. Children and changes

Leadvect is a business service and is not for anyone under 18. We may update this policy; for material changes we will tell customers in advance by email or in the app.