Privacy Policy

Draft, pending counsel review. This document describes the product's intended privacy posture. It is not yet binding legal copy; substantive sections (retention schedules, sub-processor list, DPA, regional rights mechanisms) land after counsel review. What it will not change when finalized: we do not sell your data, we do not scrape, and lead data arrives through licensed provider adapters only.

What we collect

Account data: name, work email, and organization settings you give us at sign-up.
Inputs: ICP descriptions, product descriptions, uploaded CSV/domain lists, and saved search specs used to run lead research you request.
Usage telemetry: credit ledger entries, quota meters, and audit events needed to operate the product and enforce printed caps.
Contact-form submissions: name, email, and message content when you write to us.

We do not collect your browsing data, and the product never touches your LinkedIn session or any other personal-account session; there is nothing to install and nothing that rides on your credentials.

What we do with it

We use the data above to run the product: execute lead research you ask for, meter credits, monitor leads you keep, deliver exports, and prevent abuse (velocity caps, refund-fingerprint checks). We do not sell your data, and we do not use your ICP inputs or uploaded lists to train models.

What this site collects

The marketing site uses privacy-respecting, minimal telemetry: no advertising trackers, no cross-site profiling, no sale or sharing of analytics data. Product analytics tooling is configured but disabled until switched on; when enabled it will be listed here with what it captures. Functional cookies are limited to what the site needs to operate; there is no consent-banner economy here because there is nothing to consent to beyond the essentials.

Lead data

Lead briefs contain business-contact information sourced through licensed data providers; the product contains no scraping path: no browser automation, no extensions, no cookies, no personal-account credentials. Contact fields stay hidden until you spend a credit to reveal them through a metered, verified path, and only the organization that paid sees the revealed value.

Suppression and deletion. Where our providers support suppression lists, we propagate deletion requests to them, so a suppressed contact does not silently return through the next query. Lead records you suppress in the product are excluded from your views and monitoring. The underlying credit-ledger history is preserved because it is the accounting record of the action; it records the event, not the person.

What we never do

No scraping of social platforms or any other source: no crawlers, no delegated worker clusters, no browser automation, no CAPTCHA bypass, no fake accounts.
No browser extensions, no cookie collection from your browsing, no use of your personal account sessions or credentials.
No sale or rental of customer data or lead data.
No outbound messaging on your behalf. The product produces briefs and exports; sending belongs to your own tools.

Roles: who is responsible for what

For your account data and inputs, we act as the data controller. For lead data surfaced in your briefs, the precise controller/processor allocation between us, our providers, and you is part of the counsel review in progress; the DPA will spell it out. What we commit to now: lead data is licensed business-contact data, suppression propagates where providers support it, and your use of exports remains your responsibility under the laws that apply to you.

Data sharing

We share data with the processors required to run the service: hosting, email delivery, licensed data providers fulfilling your queries. A named sub-processor list ships with the counsel-reviewed version of this policy. We do not share your data with advertisers, and we do not share revealed contacts across organizations.

Retention

Account and ledger data is retained while your account is active; the ledger is the product's audit trail, so its retention is a feature, not an oversight. Suppressed lead records leave views and monitoring; ledger entries persist as the accounting record. Detailed retention schedules for inputs, briefs, and telemetry land with counsel review.

International use

CitedLeads is built global-English-first and processes data wherever its infrastructure and providers operate. Formal transfer mechanisms (SCCs, regional safeguards) are part of the counsel review in progress.

Security

Access to revealed contact fields is metered and org-scoped; audit events record credit and export activity. Formal security-review artifacts (penetration testing, certification posture) are not yet commissioned; we say so rather than badge it. Report concerns through the contact page.

Your rights

You may request access, correction, export, or deletion of your account data via the contact page. Suppression of specific lead records is available in the product. Regional-rights mechanisms (GDPR/CCPA-specific language) are part of the pending counsel-reviewed text; in the interim, the same contact path handles those requests.

How requests are handled

Requests go through the contact page or hello@citedleads.com. We verify the requester against the account or the record in question before acting: a deletion request for your account data and a suppression request for a lead record are different actions, and we will tell you which one applies and what was done. Two honest notes:

Deleting your account removes access and associated input data; the credit-ledger entries persist because they are the accounting record of what happened, not a profile of a person.
If a lead record about you appears in the product and you want it suppressed, contact us; suppression requests propagate to providers where their suppression lists support it.

Changes to this policy

When the counsel-reviewed version ships, this page is replaced and the update date changes. Substantive changes will be announced through the product where they affect how your data is handled. We will not quietly expand the scope of what we collect; the "what we never do" list above is a commitment, not a placeholder.

Contact

Questions about this policy, or access, correction, and deletion requests: use the contact page or write to hello@citedleads.com.