Privacy Policy

This policy explains what personal data FirmLead (firmlead.io) collects, why, and what you can do about it. We are the controller of this data, unless this policy says otherwise. Contact: info@firmlead.io.

Company

FirmLead

Email

info@firmlead.io

• people who use FirmLead (our customers and their team);
• people who visit our website;
• people whose business contact details FirmLead finds (see Companies and their contacts).

If you got an email sent with FirmLead, the company that sent it is responsible for it. Each email links to that sender's privacy notice and to an opt-out page.

• Account: your email address and sign-in records. If you use a password, only a secure hash of it is stored.
• Business profile: your company name, website, what you sell and who you want to reach.
• Mailbox: the address, server settings and password (or app password) of the mailbox you connect. The password is stored encrypted. We keep the emails sent through FirmLead and the replies to them. To find replies, we check the headers of new messages. Other email is not downloaded in full, not stored and never sent to the AI.
• Leads and campaigns: the companies and business contacts in your workspace, files you upload, your drafts, sent emails and replies.
• Billing: your plan, invoices, billing name and address, and VAT number. Stripe handles your card. We never see the full card number.
• Usage: how much of your plan you use, and events such as "campaign launched" or "subscription started", linked to your account.
• Technical data: IP address, browser and device details in server logs, used for security.

Your cookie choice, which version of a page you saw and how you first found us. With your consent, analytics about the pages you use. If you try the demo search, we get your search text, and Cloudflare Turnstile checks that you are a person.

• To provide the service you signed up for: finding leads, writing drafts, sending and finding replies. Legal basis: our contract with you.
• For billing, invoices and tax. Legal basis: our contract and our legal duties.
• To email you about your account: sign-in links, billing, replies that need you, mailbox problems. Legal basis: our contract.
• To keep the service safe: preventing abuse, fraud and spam, and enforcing sending limits. Legal basis: our legitimate interest.
• To improve the product: account events, and browser analytics if you allow them. Legal basis: our legitimate interest for account events, your consent for browser analytics.

We don't sell your data and don't use it for advertising.

FirmLead uses Claude, an AI model by Anthropic, to summarise company websites, write email drafts and sort replies. We send it only cleaned text: facts about the company, your business profile and the text of replies to your emails. The AI is told to use only those facts and never to invent facts about a recipient. Under Anthropic's commercial terms, data sent through its API is not used to train its models. We don't train AI models on your data either.

To help businesses find customers, FirmLead collects public information about companies:

• the company name and details from public business registers;
• facts from the company's own website, such as its services and locations;
• business email addresses published on the company's website or in a public register;
• a Google Maps reference number for the company. We don't store names, addresses, phone numbers or ratings from Google Maps.

We use it to help our customers find relevant business partners and write relevant emails. Legal basis: legitimate interest. Our crawler reads at most a few pages of a company website and obeys robots.txt (how to block it).

Leads that are never emailed are deleted after 12 months. Leads that got an email and no reply are deleted 12 months after the last email. Leads that replied are kept while the conversation exists, unless the customer deletes them.

To object or to have your address deleted, use the opt-out link in any email sent with FirmLead. You can opt out of all FirmLead senders at once. Or email info@firmlead.io. After an opt-out we keep only a scrambled form (hash) of the address, so it is never emailed again.

These providers process data for us, only to run FirmLead:

• Supabase: database, sign-in and sign-in emails (servers in Frankfurt, Germany)
• Vercel: hosting the website and app
• Stripe: payments, invoices and tax
• Anthropic: the AI that writes drafts and sorts replies
• PostHog: analytics, only with your consent (EU servers)
• Resend: our own emails about your account (never your campaign emails)
• Google Maps Platform: finding companies (we send the search, not your personal data)
• MillionVerifier: checking that an email address exists before sending
• Cloudflare Turnstile: checking that a demo search comes from a person

Some of these providers are in the USA. When data leaves the EU, we rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. We also share data when the law requires it.

• Account and workspace data: while you have an account. Delete your account in Settings and it goes at once; if you ask us by email, we delete it within 30 days.
• Billing records: 7 years, because Estonian accounting law requires it.
• Leads and emails: as described in Companies and their contacts.
• Opt-outs: only the hash of the address, kept for good, so the opt-out keeps working. When you delete your account, the opt-outs from your emails are kept with a hash of your email, so they still apply if you sign up again.
• Analytics and logs: only as long as needed for the purposes above.

You can ask for a copy of your data, ask us to correct or delete it, get it in a portable format, object to how we use it, or ask us to limit its use. You can withdraw consent at any time (see Cookies below). Email info@firmlead.io. We answer within one month.

You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or the data protection authority in your country.

We use a few cookies of our own. Analytics cookies are set only after you allow them.

• sb-…: Keeps you signed in. Kept: Until you sign out.
• fs_consent: Remembers your cookie choice. Kept: 12 months.
• fs_exp: Remembers which version of a page you see when we test two versions. Kept: 90 days.
• fs_ft: Remembers how you first found us (the referring site and campaign tags). Saved to your account if you sign up. Kept: 30 days.
• fs_banner_hidden, fl_prompt, fl_success_seen: Remember a banner or message you closed in the app. Kept: 1 day to 12 months.
• ph_…: PostHog analytics. Only set after you allow analytics. Kept: Up to 12 months.

Stripe sets its own cookies on its checkout page.

FirmLead is a tool for businesses. It is not meant for anyone under 18.

When we change this policy, we update the date at the top. If a change matters to you, we tell you by email or in the app first.

Questions or requests about your data: info@firmlead.io. See also our Terms of Service.