Privacy Policy

NeuraLeads (“we”, “us”) is operated by legal entity name, registered at registered address. This policy explains how personal data is handled across the NeuraLeads website and platform.

Almost every privacy question about this service depends on whose data is being discussed, because we act in two capacities:

Where we act as a processor, we handle prospect data only on the documented instructions of the customer who put it into their workspace. That customer decides who to contact, on what legal basis, and for how long the data is kept. We do not sell personal data, and we do not use one customer’s data for another customer’s benefit.

When you visit our site, trial the product, or hold an account, we collect:

• Account data — name, work email address, hashed password, workspace name, role, and email-verification status.
• Billing data — billing name, billing email, billing address, tax rate, plan, invoice history and payment records. Card details are handled by our payment processor and never reach our servers.
• Configuration data — settings you choose, including credentials for the third-party providers you connect. These are encrypted at rest and are never displayed back to you.
• Usage and security logs — sign-in attempts with their outcome, IP address, browser user agent, actions taken in the product, background job runs, and errors. We use these to run, secure and debug the service.
• Support correspondence — what you send us when you ask for help.

Our legal bases are performance of our contract with you, our legitimate interest in operating and securing the service, and compliance with legal obligations such as tax record-keeping.

When a customer uses the platform, personal data about the people they intend to contact is stored in their workspace. Typically this is:

• Business contact details — name, work email address, job title, and employer.
• Company information — industry, size, website, location and timezone.
• The opportunity that prompted the outreach — for example a public job posting, with its title, location and salary range.
• Outreach and engagement records — messages sent, opens, clicks, replies, bounces, unsubscribes, and any notes or deal records the customer creates.

Each workspace is isolated. Data in one workspace is never visible to another customer, and there is no shared pool of contacts between customers.

The customer is the controller of this data. They are responsible for having a lawful basis to contact each person, for honouring opt-outs, and for responding to requests from the people concerned. We assist them — the product includes tooling to export everything held about one email address and to erase it on request.

We think people are entitled to know how their details reached a system they never signed up for. Prospect data in a customer workspace originates from:

• Public job postings and company websites, retrieved through job-board and job-search providers.
• Business contact databases operated by third-party providers, which the customer connects using their own account with that provider.
• Public registries and public signals — for example professional registries, company records, public code repositories, published news, and technology or performance characteristics of a public website.
• The customer’s own records, including data they import or create.
• Interactions with the customer’s outreach — whether a message was opened, clicked or replied to — and, where the customer has installed the visitor script on their own website, visits to that site.

The platform is intended for business-to-business outreach to people in a professional capacity. It is not designed for, and must not be used for, marketing to consumers at their personal addresses.

• To provide, operate and maintain the platform and the website.
• To authenticate users, enforce plan limits, and prevent abuse of the service.
• To protect sending reputation — for example applying rate limits, throttles, bounce handling and complaint monitoring.
• To bill for the service and keep the records the law requires.
• To provide support and respond to what you ask us.
• To measure and improve the product in aggregate.
• To send service messages such as verification, password resets, invoices and important notices.

We do not sell personal data. We do not share customer or prospect data with advertising networks or data brokers.

The platform uses AI models to draft and rewrite outreach copy, classify inbound replies, score leads, enrich company records and suggest next actions. This has two consequences worth stating plainly.

Content is sent to an AI provider. To generate or classify text, the relevant content — which may include a prospect’s name, job title, employer and the text of their reply — is transmitted to the AI provider configured for that workspace.

In most cases that provider relationship is the customer’s, not ours. Customers connect their own AI provider accounts using their own keys. Where that is the case, the customer’s agreement with that provider governs how the provider may use the content, including whether it may be retained or used for model training. We encourage customers to review those terms and to select providers and settings that match their own commitments to the people they contact.

Within our own systems: inbound message content is sanitised before it reaches a model, no model is given authority to send an email on its own, every AI decision is logged with its reason, and we do not use customer or prospect data to train our own models.

Running the platform means data passes through other organisations. Two categories, with an important difference between them:

Providers we engage

These support the service itself and act as our sub-processors: cloud hosting and infrastructure, database and backup storage, our payment processor, and the mail provider used for transactional messages such as verification and invoices.

Providers the customer connects

The platform integrates with providers that a customer enables using their own account and credentials. Where a customer does so, that provider is the customer’s vendor, and the customer’s agreement with them applies. Categories and examples:

A current list of the sub-processors we engage is available on request from privacy address.

On this website

We use cookies and equivalent browser storage that are necessary to run the site and the application — keeping you signed in, remembering your session, and holding interface preferences such as a collapsed sidebar. These are required for the service to function.

Tracking inside customer outreach

The platform can add an open-tracking pixel and click-tracking redirects to emails a customer sends, and offers a script a customer can install on their own website to record visits. Where these are used, the customer is the controller of the resulting data and is responsible for disclosing it in their own privacy notice and for obtaining any consent their jurisdiction requires. Customers can disable tracking and can route it through their own domain.

We and the providers described above may process data in countries other than your own, including outside the European Economic Area and the United Kingdom. Where personal data is transferred internationally, we rely on an appropriate safeguard such as an adequacy decision or standard contractual clauses. The governing jurisdiction for our own processing is jurisdiction.

• Passwords are stored using a modern memory-hard hashing algorithm and are never recoverable.
• Provider credentials are encrypted at rest and are never displayed back after saving.
• Traffic is served over HTTPS with strict transport security and a content security policy.
• Every workspace is isolated, and every query is scoped to the workspace of the person making it.
• Role-based permissions control what each user can see and do.
• Sign-in, configuration changes and administrative actions are recorded in an audit trail.
• Sensitive endpoints are rate-limited, and accounts lock after repeated failed sign-ins.
• Data is backed up daily.

No system is perfectly secure. If we become aware of a breach affecting personal data, we will notify affected customers and the relevant authorities as the law requires.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable form, and complain to your data protection authority. You can exercise most of these directly in the product, or by contacting us.

If your request concerns data in a customer’s workspace rather than your own account, see the next section — we will route it to the customer responsible.

NeuraLeads is a tool. We did not choose to contact you and we are not the sender. The business whose name is on the message decided to contact you, wrote it, and is the controller of your data. That said, here is exactly what you can do.

• To stop the emails: use the unsubscribe link in the message. It is honoured immediately and permanently, and the address is added to a suppression list so further campaigns cannot reach it. Replying to say you are not interested also stops the sequence.
• To ask what data is held about you, or to have it erased: contact the sender directly — they control the data and can action it. The platform gives them one-click tooling to export or erase everything held about an address.
• If the sender does not respond: contact us at privacy address with a copy of the message. We will identify the customer responsible and require them to act.
• To report abuse of the platform: email privacy address. Sending unlawful or unsolicited mail breaches our Terms of Service, and we suspend accounts that do it.

You can also complain to your local data protection authority. Erasing your details does not remove your address from the suppression list, because that record is what prevents you from being contacted again.

The service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached the service, contact us and we will remove it.

We may update this policy as the product and the law change. The effective date at the top of this page always reflects the current version. If a change materially affects how we handle personal data, we will tell account holders before it takes effect.

For privacy questions, data-subject requests, sub-processor lists or a copy of our data processing agreement, contact privacy address, or write to registered address. General enquiries are answered through the contact page.