Privacy Policy

We process data about customers(people with Unilead accounts) and, on customers’ behalf, about business contacts their outreach addresses. This policy covers both, separately and plainly.

We process:

• account data — your email, name, and workspace settings;
• workspace content — your company profile, campaign briefs, copy edits, and reply activity;
• billing data — handled by Stripe; we never see or store card numbers;
• usage and technical logs — to operate, secure, and improve the service;
• support communications.

Legal bases: performing our contract with you, our legitimate interest in operating and securing the service, and legal obligations (tax, accounting).

To run a customer’s campaign, the service compiles professional contact information— name, role, company, business email address, and public information about the company — from public sources and licensed data providers, verifies it, and uses it solely to enable that customer’s outreach. Replies a contact sends are processed to organize the conversation.

The legal basis is legitimate interest in business-to-business communication. Every message carries a working opt-out. When someone opts out, we record the minimum needed to suppress them and never contact them again from that workspace — suppression records are kept indefinitely because deleting them would risk re-contacting someone who asked us not to.

If you are a business contact and want your data removed or want to know what a workspace holds about you, email hello@unileadlabs.com — we will suppress you across the platform and delete sourced records not needed to honor that suppression.

We use a small set of providers to run the service:

• hosting and delivery — Vercel;
• database and authentication — Supabase;
• payments — Stripe;
• email sending and mailbox infrastructure providers;
• email verification providers;
• AI model providers (including Anthropic and routed model providers) — content sent for processing is not used by them to train their models under our agreements;
• transactional email — Resend;
• optional integrations you connect, such as Calendly.

Where transfers leave your region, we rely on appropriate safeguards such as Standard Contractual Clauses.

Account and workspace data is kept for the life of the account and deleted or anonymized within a reasonable period after closure (you can request export for 30 days). Logs are kept on a short rolling window. Suppression records are kept indefinitely, as above.

Traffic is encrypted in transit; workspaces are isolated per organization; production access is restricted and credentialed. No system is perfectly secure — report concerns to hello@unileadlabs.com.

Depending on where you live, you may have rights to access, correct, delete, export, or object to processing of your personal data, and to complain to a supervisory authority. Write to us and we will act on the request within the legally required time.

The product uses session cookies for sign-in only. We do not run advertising trackers.

We will update this policy as the service evolves and announce material changes by email or in the product.