Privacy Policy

LeadScouter (leadscouter.app) is operated by Filip Brády, a sole trader established in Slovakia, European Union. Registered business address: Čergovská 7258/24, 080 01 Prešov, Slovakia. Registered in the Trade Register of the District Office Prešov (Okresný úrad Prešov). Company ID (IČO): 55584268. Tax ID (DIČ): 1082754090. VAT ID (IČ DPH): SK1082754090, registered under §7a of the Slovak VAT Act (Act No. 222/2004 Coll.) for cross-border services only; not a VAT payer for domestic supplies. In this policy, "we", "us" and "LeadScouter" mean Filip Brády as the operator of the service.

We are the controller of the personal data described in this policy. For any privacy question or request, write to privacy@leadscouter.app. We have not appointed a data protection officer because the law does not require one for a service of our size and type.

This policy covers the website at leadscouter.app, the LeadScouter web app, the transactional emails we send, and the public read-only report links our customers create.

LeadScouter is a business tool. Our customers (usually agencies and freelancers) use it to find local businesses and to prepare audits for their own sales outreach. When a customer contacts a business using information from LeadScouter, that customer decides how and why it contacts them and is responsible for that outreach as an independent controller. Section 12 explains what we expect from customers.

Account data: your email address, an optional name, a hash of your password (passwords are hashed with bcrypt; we never store them in readable form), whether your email is verified, your language preference and account timestamps.

Billing data: your plan, subscription status and renewal date, the Stripe customer and subscription identifiers, your credit balance and credit history, checkout sessions and any promotion code you redeemed. Payments are handled by Stripe. Stripe collects your card details, billing name and address, and VAT ID if you give one; we never receive or store your full card number.

Service data: the searches you run (niche and location, or a business name, Google Maps link or website), the results and audits you generate, saved lists, notes, tags and pipeline status you add, a record of each export (format, scope and time; export files are generated when you download them and are not stored by us), and the report share links you create (we store only a hash of the link token, plus a view count and the time of the last view).

Visitors to a shared report: we count how many times a link was opened. To avoid counting the same visitor twice, we keep a one-way hash of the link, the visitor's IP address and browser type for 12 hours on our servers. We do not identify visitors, do not store anything on their device for this, and do not show the customer who opened the link.

Technical data: your IP address and request details, which we use briefly to rate-limit requests and prevent abuse; server logs kept by our hosting provider; and error reports sent to our error-monitoring provider. Error reports are filtered before they leave our servers so that passwords, tokens and similar secrets are removed, and the monitoring tool is configured not to attach personal data by default.

Communications: messages you send to us, and delivery information for the transactional emails we send you (email verification, password reset and billing notices).

Cookies and similar technologies: see our Cookie Policy. Analytics data from Google Analytics 4 is collected only if you consent.

To show search results and generate audits, we process information about businesses from public sources: Google Places (business name, address, phone number, website, category, rating and number of reviews), the business's own publicly accessible website (page content, technical signals, and contact email addresses, phone numbers and social profile links that the business publishes there), and Google PageSpeed Insights (website performance measurements). AI-generated summaries and pitch suggestions are then produced from these signals.

Most of this is information about businesses, not about people. It can still be personal data where it relates to an identifiable person, for example a sole trader trading under their own name, or a named email address such as firstname@company.example.

Legal basis: our legitimate interests and those of our customers in identifying businesses whose online presence could be improved and in offering them relevant services (Art. 6(1)(f) GDPR). We consider these interests are not overridden by the rights of the people concerned because we only use information the business has published for business contact purposes, we do not collect special categories of data or private social media content, and we use it only in a business context. Anyone can object at any time (see below).

We do not contact these businesses ourselves. Because we do not hold contact relationships with them and informing each of them individually would require disproportionate effort, we make this information public through this policy instead (Art. 14(5)(b) GDPR).

Objection and removal: if you represent a business, or you are a person whose data appears in LeadScouter, email privacy@leadscouter.app with the business name and website address. We will stop processing and delete the data we hold about that business, and, where technically feasible, prevent it from being audited again. We reply within one month.

Recipients: business data is shown to LeadScouter customers who search for or audit that business, and is processed by the service providers listed in section 7. We keep one central record per business (name, address, phone number, website, rating, and the contact details and audit signals published on its website) so that results stay consistent across customers, and we refresh it when the business is searched or audited again.

Retention: public audit signals are reused for up to 24 hours before they are fetched again. The central business record is kept while customers continue to search for or audit the business, and is deleted when a valid objection is received. Audit reports remain in the account of the customer who created them until that customer deletes them, their account is closed, or a valid objection is received.

The table lists each purpose, the data involved and the legal basis under the GDPR.

Lead scores and audit findings are automated assessments of businesses' websites. They do not produce legal or similarly significant effects for individuals, so we do not carry out automated decision-making within the meaning of Art. 22 GDPR.

We do not sell personal data and we do not send marketing emails without your consent.

Audit summaries, pitch suggestions, draft email and call openers, and copy rewrite suggestions are generated with the OpenAI API. We send OpenAI the audit signals and website text needed to write that text for the business concerned. We do not send your account details, billing data or notes.

Under OpenAI's API terms, data submitted through the API is not used to train OpenAI's models by default and is kept by OpenAI for up to 30 days for abuse monitoring. AI-generated text is labelled as such in the app. It can be inaccurate; see the Terms of Service.

We use the following providers to run LeadScouter. They process personal data on our behalf under data processing terms, or as independent controllers where noted.

We may replace or add providers as the service develops. When we do, we update this list and the date at the top of this page.

Some providers process data outside the European Economic Area, mainly in the United States. Where that happens, we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for certified providers, or on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), together with additional safeguards where needed.

You can ask for more information about these safeguards, or a copy of the relevant clauses, at privacy@leadscouter.app.

We keep personal data only for as long as we need it for the purposes above.

Under the GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict how we use it; receive the data you gave us in a structured, machine-readable format (portability); object to processing based on our legitimate interests; and withdraw consent at any time, without affecting processing that happened before the withdrawal. You can withdraw analytics consent under Cookie settings in the footer.

To use any of these rights, including closing your account, email privacy@leadscouter.app from the address linked to your account. We may ask you to confirm your identity. We reply within one month; for complex requests we may extend this by up to two further months and will tell you why.

You also have the right to lodge a complaint with a supervisory authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. You can also complain to the authority in the EU country where you live or work. We would appreciate the chance to deal with your concern first.

We protect data with encryption in transit (HTTPS), hashed passwords, hashed tokens for share links, password resets and email verification, access controls on every account and admin action, redacted logging, and providers that maintain recognised security certifications.

No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the supervisory authority and, where required, you, as set out in Articles 33 and 34 GDPR.

If you use LeadScouter to contact businesses, you act as an independent controller for that outreach. You must have your own legal basis, respect the rules on unsolicited electronic communications in the recipient's country (ePrivacy rules), identify yourself clearly, offer an easy way to opt out and honour objections promptly.

When you first contact a person using data from LeadScouter, you must give them the information required by Art. 14 GDPR, including where you obtained their data (for example "from public sources, via LeadScouter") and how they can object. In several EU countries, including Slovakia (Act No. 452/2021 Coll. on Electronic Communications), unsolicited marketing emails can require prior consent even when they are sent to business addresses.

For the notes, tags, pipeline status and lists you add about people, you are the controller and we act as your processor; the Terms of Service contain our data processing terms.

Do not store special categories of personal data (for example health data) or other sensitive information in notes or tags.

LeadScouter is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy when the service or the law changes. The date at the top shows when it last changed. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect.

For any question about this policy or your personal data, write to Filip Brády at privacy@leadscouter.app.