Draft — not yet reviewed by a lawyer. Written from what the software actually does, and accurate on that. It is not in force and must not be relied on until it has been reviewed and published deliberately.
Privacy Policy
What Lead Opportune collects, why, who else sees it, and how long we keep it.
- Registered legal entity name and company number
- Registered business address (required for most privacy laws)
- State of incorporation
- Privacy contact address, if different from support
1. Who we are
Lead Opportune is a business-to-business prospecting platform operated by EYLYR. This policy explains what we collect, why, and what we do with it.
It covers the Lead Opportune application and marketing site only.
Needs: Registered legal entity name and company number; Registered business address (required for most privacy laws); State of incorporation.
2. What we collect about you
When you create an account we store your email address, your name if you give one, a one-way hash of your password (never the password), your role, the organisation you belong to, when the account was created, and when you last signed in.
We record failed sign-in attempts so an account can be locked briefly after repeated failures. That count is reset on a successful sign-in.
We do not collect analytics about how you use the product, and we do not run third-party trackers or advertising pixels on the application.
3. Payment information
Payments are processed by Stripe. Card numbers, expiry dates and security codes are entered on pages hosted by Stripe and are never sent to, logged by, or stored on our servers.
We store the identifiers Stripe gives us — a customer id and a subscription id — along with your plan, its status, the current billing period and the amount you are charged.
4. Business data in your workspace
The businesses you discover, the records you save to your CRM, your call queue and your notes are yours. They are stored in a workspace private to your organisation; no other customer can read, export or search them.
Business records come from public sources, principally OpenStreetMap and public business registers. They describe organisations rather than private individuals, though a business contact may be a named person.
You are the controller of the contact data you collect through the platform and are responsible for how you use it, including under marketing and telephone-contact rules that apply where you and the business you contact are located.
5. Third parties who process data for us
Stripe — payments and subscription billing.
Railway — hosting and storage of the application and its data.
Hunter — used to look up business email addresses from a company domain, when you run enrichment. We send the domain, not your personal information.
Apify — used to check whether a business is advertising, against the Meta Ad Library. We send the business name or page, not your personal information.
We do not sell your personal information, and we do not share it for advertising.
6. Cookies
One cookie, named aip_session. It holds a signed token identifying your session and nothing else. It is HTTP-only, restricted to this site, and marked Secure in production.
There are no advertising or analytics cookies, so there is no consent banner to click through.
7. How long we keep things
Your account and workspace data are kept while your account exists.
If you cancel, your records remain readable and exportable for 90 days so you can take them with you. After that period you may ask us to delete them, and we will.
Sessions expire after 14 days by default, or sooner if you sign out everywhere.
8. Your rights
You can export your CRM and call-queue records at any time from within the application, without asking us.
You can ask us to correct or delete your personal information by writing to the support address below.
Depending on where you live you may have further rights — for example under the GDPR or the CCPA — including access, portability, and objecting to certain processing.
Needs: Privacy contact address, if different from support.
9. Security
Passwords are hashed with scrypt. Sessions are signed and verified on every request, and are invalidated immediately when a password changes or an account is disabled.
Each customer organisation's data is stored separately, and the application is built so that a request can only reach the organisation it is authenticated for.
No system is perfectly secure, and we do not claim otherwise. We have not yet commissioned an independent penetration test.
10. Changes
If we change this policy materially we will tell account holders by email before the change takes effect.