Privacy Policy

Effective date: 11 September 2026 · Last updated: 11 September 2026

This Privacy Policy explains what the Lead Generation Agent ("the Service") collects, why, and how it is handled. The Service is a self-hosted lead-generation dashboard: it finds public business listings, reads business websites, verifies contact emails, drafts outreach messages, and exports the results.

1. Data we collect

Account data. The sign-in email address and a scrypt hash of the password. Passwords are never stored in plain text.
Session data. A random session token stored in an HttpOnly cookie (leadgen_session) to keep you signed in, plus failed-login counters used for rate limiting.
Search inputs you provide. Business type, location, page budget, outreach settings, sender name/company, and your service description or website URL.
Public business data. Business names, phone numbers, addresses, categories, website URLs, and contact details read from Google Maps listings and the businesses' own public websites.
Integrations you connect. If you connect Google Sheets, an OAuth token (including a refresh token) is stored so exports can be written to your spreadsheet. If you configure SMTP, the mail credentials you supply are used only to send the messages you approve.
Operational logs. Run history, campaign send statuses, and server logs used for debugging and security.

2. How data is used

To authenticate you and operate the dashboard.
To run lead searches, research business websites, verify emails, draft messages, and produce workbooks and campaigns.
To write exports to your Google Sheet and send outreach emails only when you explicitly start them. Nothing is sent automatically.
To secure, troubleshoot, and improve the Service.

We do not sell personal data. We do not use your data for advertising.

3. Third-party services

Google Maps / business websites. Business discovery reads public listings; website research fetches pages the businesses themselves publish.
LLM provider. Business profiles and outreach drafts are generated by the configured language-model API. Business website text and your service description are sent to it for that purpose.
Ollama web_fetch (optional). When configured, public business pages are read through this fetch API.
Google Sheets (optional). Only if you connect an account; governed additionally by Google's privacy terms.
Your SMTP provider (optional). Only if you configure sending; messages go through your own mail server.

4. Cookies

The Service uses a single strictly-necessary session cookie (leadgen_session) for sign-in. There are no advertising or cross-site tracking cookies.

5. Data retention

Exported workbooks, run history, and campaigns are kept until you delete them.
Google OAuth tokens are kept until you press Disconnect.
Server logs rotate automatically (5 MB × 5 files).

6. Security

Passwords are stored as scrypt hashes, sessions are hashed server-side, and every /api route except sign-in requires the session cookie. No security measure is perfect; protect your credentials and keep the server and its environment updated.

7. Your rights

Depending on where you live (including under GDPR/UK GDPR where applicable), you may have the right to access, correct, export, or delete your account data and connected integrations. Because this is a self-hosted single-operator deployment, exercise these rights by contacting the site operator, who can update or delete data in the application database, exports, and logs.

8. Business contacts and outreach compliance

The Service processes publicly available business contact details at your direction. You are responsible for ensuring your outreach complies with applicable laws (such as GDPR, PECR, CAN-SPAM, and CASL), including having a lawful basis, identifying the sender, and honouring opt-outs.

9. Changes

If this policy changes materially, the effective date above will be updated. Continued use of the Service after a change means you accept the updated policy.

10. Contact

For privacy questions or requests, contact the operator of this deployment of the Lead Generation Agent.