Nose for Leads — Privacy Policy

Nose for Leads finds and verifies business leads for sale to our customers. This policy explains two different kinds of data: data about you if you use our product, and data about the people in the lead database we sell.

If you create an account, we collect your account details (email, password hash), usage data (campaigns you run, searches, exports), and payment data — payment is processed by Stripe; we don’t store your card number.

We do not sell or share our users’ personal information. That sentence is scoped to you, the customer — it does not describe the lead database, which is covered below.

When you connect an AI agent (such as Claude or Codex), you authorize it through a one-time approval that issues an access token scoped only to our lead-generation tools; it cannot reach your account settings, billing, or the rest of our API. Through that connection we receive only the requests your agent sends: the campaign parameters you ask it to run (vertical, location, refinements) and any feedback you send.

We do not access, store, or process your AI assistant’s conversation history, memory, prompts, or files. You can revoke an agent’s access at any time from your account.

We sell personal information collected for our lead database to our customers. That data is business contact information — name, business email, business phone, company, and role — compiled about people in their professional capacity. We don’t collect sensitive categories of information (health, finances, private-life details) and we don’t knowingly collect data about anyone under 16.

Our basis for processing this data is our legitimate interest in operating a business-to-business lead generation service, balanced against the limited, business-capacity nature of what we collect and the opt-out rights described below.

Lead Data is compiled from public business listings, directories, and licensed third-party data providers. We keep a record of where and when each record was found, so provenance is traceable, not asserted.

Our sourcing and collection is scoped to United States business listings; we do not target or knowingly collect data about individuals in the European Union.

We use PostHog for first-party product analytics, to help us understand how the app is used: device and browser information, in-product usage events, and pseudonymous identifiers. PostHog acts as our processor under a data processing agreement. We do not sell or share this product-analytics data, and we do not use it for cross-context behavioral advertising.

If you send a Global Privacy Control (GPC) signal, we treat it as an opt-out of sale and share: we turn off session recording. We continue to collect basic first-party product analytics, which we do not consider a sale or share. When session recording is on, we mask form inputs and lead data so they are never captured.

If you’re in our lead database (not a customer of ours), you can ask us to opt you out of sale, or to delete your record, at any time — no account needed. Two ways to reach us: our self-service removal page or email privacy@noseforleads.com. We respond within 45 days.

Suppression is permanent against re-collection: once you’re on our suppression list, our sourcing pipeline will not re-add you even if the same public listing is scraped again later.

We honor Global Privacy Control (GPC) as a valid opt-out of sale and share: it turns off session recording. Because we do not sell or share our product-analytics data, we continue to collect first-party, pseudonymous product analytics under GPC.

We register as a data broker in states that require it; registrations are listed here as they complete.

Use the Do not sell or share page to opt out of sale or request deletion without creating an account. Once processed, your suppression survives even if we re-collect the same public listing later.

We retain user account data for as long as your account is active, and for a reasonable period after closure to satisfy legal and accounting obligations.

We retain lead records for as long as they remain useful and accurate for resale, subject to suppression requests, which are permanent and immediate.

We use the following subprocessors to operate Nose for Leads: Stripe (payments), Supabase (database and auth), Railway (application hosting), Vercel (web hosting), Resend (transactional and marketing email), and PostHog (analytics).

We use industry-standard technical and organizational measures to protect data in transit and at rest, including encrypted connections and access controls limiting who can reach production data.

We may update this policy from time to time. We’ll update the date at the top of this page when we do.

Privacy questions or requests: privacy@noseforleads.com, or write to us at [Postal address — pending incorporation].