Privacy Policy

Last updated: 17 July 2026

This policy explains how LeadSmarts (the "Service", available at leadsmarts.app and app.leadsmarts.app) collects, uses, and protects personal data. The Service is operated by AIIA CONSULTING, a company registered in Bulgaria ("we", "us"). You can reach us at hi@leadsmarts.app.

1. Our two roles

LeadSmarts handles personal data in two distinct roles:

• As a controller: for data about you and your account: registration details, billing records, usage, and communications with us.
• As a processor on your behalf: for the personal data of leads you submit for research. You (our customer) decide which leads to research and remain the controller of that data; we process it only to deliver the Service to you, following this policy and our agreement with you.

2. Data we collect

Account data (we are the controller)

• Registration: name, email address, password (stored only as a cryptographic hash).
• Billing: subscription plan, invoices, and payment status. Payments are processed by Stripe; we never receive or store your full card number.
• Business context you provide: your company profile, website, documents, and preferences used to score leads.
• Usage and technical data: log data, feature usage, research job metadata, and approximate cost/telemetry needed to operate and bill the Service.
• Communications: emails and support messages you exchange with us.

Lead data (we are your processor)

• Lead details you submit: typically a name, business email, company, job title, or LinkedIn URL.
• Research results: information our systems gather about those leads from publicly available web sources (company websites, news, job postings, public professional profiles), together with the scores and drafts generated from it.

3. How lead research works

When you submit a lead, the Service searches the public web and reads publicly available pages to assess business relevance. We do not log into gated or password-protected sources, do not buy data from data brokers, and do not build profiles beyond what is needed to produce the research result you requested. Research results are stored in your account, visible only to you, and every claim links to its public source.

If you are a lead who has been researched through LeadSmarts and want the associated data removed, contact us at hi@leadsmarts.app and we will coordinate with the relevant customer and delete the data where required.

4. Purposes and legal bases

• Providing the Service (accounts, research, scoring, drafts, CRM checks): performance of a contract (GDPR Art. 6(1)(b)).
• Billing and accounting: performance of a contract and legal obligation (Art. 6(1)(b), (c)).
• Service emails (welcome, batch-completion, billing notices): performance of a contract (Art. 6(1)(b)).
• Security, abuse prevention, and service improvement: legitimate interests (Art. 6(1)(f)).
• Processing lead data on your instructions: we act as processor; the legal basis is yours as controller, and our terms require you to have one.

5. AI processing

Lead research, scoring evidence extraction, and outreach drafts are produced using large language models provided by Anthropic. Your documents, business context, and research results are not used to train AI models, ours or anyone else's. Scores themselves are computed by deterministic rules, not by a model.

6. Who we share data with

We do not sell personal data. We share it only with service providers (processors) who help us run LeadSmarts:

• Supabase: database, authentication, and file storage.
• Netlify: web hosting and content delivery.
• Stripe: payment processing and subscription billing.
• Anthropic: AI model processing for research and drafting.
• Transactional email providers: delivery of service emails.

If you connect a CRM (HubSpot, Salesforce, Pipedrive, or a custom integration), we query it, on your instruction, to check whether a lead already exists there, and we may write qualification results back to matched records as notes. We do not otherwise modify or delete your CRM data. We may also disclose data where required by law, or as part of a merger or acquisition (in which case this policy continues to apply).

7. International transfers

We are based in the EU, but some of our providers process data outside the European Economic Area (notably in the United States). Where that happens, transfers are protected by the European Commission's Standard Contractual Clauses and/or an adequacy decision such as the EU–US Data Privacy Framework.

8. Retention

• Account and business-context data: kept while your account is active and deleted or anonymised within 90 days of account closure, except where law requires longer (e.g. invoices for accounting purposes).
• Lead data and research results: kept while your account is active so your history remains available; deleted with your account, or earlier on your request.
• Logs and telemetry: kept for a limited period appropriate for security and billing accuracy.

9. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted per account with row-level security, credentials for connected CRMs are stored encrypted, and access to production systems is limited to those who need it. No system is perfectly secure; if a breach affects your personal data, we will notify you and the competent authority as GDPR requires.

10. Your rights

Under the GDPR you can ask us to access, correct, delete, or export your personal data, to restrict or object to processing, and to withdraw consent where processing is based on it. Write to hi@leadsmarts.app; we respond within one month. You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (cpdp.bg), but you may complain to the authority in your own EU country.

If your data was submitted to LeadSmarts by one of our customers (i.e. you are a lead), we will refer your request to that customer where appropriate, and assist them in fulfilling it.

11. Cookies and local storage

The marketing site sets no tracking or advertising cookies. The app uses browser local storage strictly to keep you signed in. We do not use third-party analytics or advertising trackers.

12. Children

LeadSmarts is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

13. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced by email or in the app before they take effect. The "Last updated" date above always reflects the current version.

14. Contact

AIIA CONSULTING (Bulgaria) · hi@leadsmarts.app