Privacy Notice

The operator is Jordan Boyce, sole trader, trading as Lead Reclaimer.

Email: hello@leadreclaimer.com

Lead Reclaimer acts as a controller for information about website visitors, customers, account users, billing contacts, support requests, service administration and security. This means we determine why and how that information is used.

For a defined historical-lead recovery campaign only, the customer business and Lead Reclaimer are joint controllers. Our Recovery Joint Controller Arrangement sets out how responsibility is shared:

• The customer business is responsible for its source CRM or list, its authority and lawful basis to re-contact each lead, truthful business and offer facts, the sending mailbox, final message approval and sales activity after a reply.
• Lead Reclaimer is responsible for the standardized recovery workflow, sending pace and delivery safety, stop-on-reply and bounce controls, suppression, reply qualification, provider configuration, platform security and coordinating rights requests for recovery records.

This does not make the parties general partners, agents or joint controllers for unrelated activity. The customer is the sole controller of its source CRM or list before it is transferred to us and of its post-reply sales records.

• Optional marketing measurement data: only if you allow marketing cookies in Cookie settings on our public website, the Meta Pixel collects browser and device details, IP address, Meta cookie identifiers and the public pages you visit, so we can measure our advertising. It does not run on admin or product pages, does not receive form entries, lead data, mailbox details or email addresses, and we do not use advanced matching or send purchase or lead events from this website.
• Website and device data: IP address, browser and device details, pages viewed, traffic source, country, and visit or session information collected through hosting, security and operational analytics.
• Account and business data: name, work email, business name, role, business contact details, customer business postal address, access records and service preferences provided by customers or account users.
• Billing data: purchase, payment status, transaction references, refund status and tax information received from you or Stripe. Lead Reclaimer does not store card numbers.
• Customer lead data: raw lead CSV files, normalized historical lead names, contact details, campaign-level approximate source, YYYY-MM last interaction, stages, notes and related records uploaded by the customer.
• Mailbox and campaign data: connected mailbox identity, Google app-password credentials or OAuth authentication handled for the enabled connection route, three reviewed and approved email messages, sending status, replies, reply summaries, unsubscribe requests, suppression records, delivery events and mailbox health information.
• Support and security data: messages, troubleshooting details, audit events, abuse reports and information needed to protect accounts and the service.

• Provide accounts, checkout, onboarding, recoveries, reporting and support under our contract with the customer.
• Run the recovery campaign as a joint controller with the customer, under the Recovery Joint Controller Arrangement and our legitimate interests in operating a safe, lawful recovery service.
• Administer billing, keep business records and meet tax, accounting and legal obligations. This includes administering refunds and verifying Reply Guarantee claims using existing purchase records, campaign contact, bounce and reply counts, and only the relevant records necessary to review a claim within existing lawful access limits.
• Protect recipients, customers and the service, prevent fraud and abuse, enforce policies, troubleshoot and maintain security based on our legitimate interests and legal duties.
• Operate and improve the website and service using proportionate operational analytics based on our legitimate interests.
• Send service communications and respond to requests under the contract or our legitimate interests. Where consent is required, we rely on consent and it may be withdrawn.

We disclose information only as needed to operate, secure and support the service, complete transactions, follow customer instructions, or meet legal duties.

For recovery campaigns, recovery records are available to both joint controllers: the customer business sees approved messages, reply information and outcomes for its own leads, and Lead Reclaimer holds the recovery workflow, suppression and delivery records.

• Bouncer: the selected email-address verification provider. We submit email addresses only, not CSV filenames, local lead IDs, names, reply bodies or credentials, and receive address deliverability and safety results. Only addresses explicitly returned as safe and valid are eligible for scheduling; other eligibility and mailbox safety controls still apply.
• Cloudflare: hosting, compute, database and object storage for the product service.
• Stripe: checkout, payment processing and entitlement confirmation. Stripe handles payment information under its own privacy terms where applicable. Lead Reclaimer does not store card numbers.
• Resend: passwordless sign-in and service email delivery.
• Meta Platforms: optional advertising measurement through the Meta Pixel on public marketing pages, only after you accept marketing cookies. Meta processes this data under its own terms; see Meta's Privacy Policy. You can withdraw consent at any time with Cookie settings in the website footer; nothing further is sent after you withdraw. A Global Privacy Control signal is treated as a refusal.
• Lovable: marketing and customer frontend hosting, builds and operational analytics.
• Google: eligible Google Workspace and Gmail mailbox services, including custom business domains hosted by Google. The generally available connection uses a Google app password with SMTP and IMAP access. Where enabled for an account, Gmail Direct uses Gmail API OAuth and Google Cloud Pub/Sub change notifications.
• Smartlead: Lead Reclaimer's email-delivery processor for the existing app-password recovery route, covering isolated mailbox connection, recovery delivery and reply events. Gmail Direct OAuth tokens are not sent to Smartlead. Customers do not buy or administer Smartlead and do not receive campaign, lead or billing access; they enter a Google app password in Lead Reclaimer after onboarding verification for the mailbox connection. Each customer's isolated Smartlead workspace is controlled by Lead Reclaimer and never reused across customers.

The current provider list is available on our Subprocessors page.

We may also disclose information to professional advisers, authorities, courts, or a buyer or successor where reasonably necessary and legally permitted.

Connect an eligible Google Workspace or Gmail mailbox. Custom business domains are supported when hosted by Google.

The generally available connection still uses a Google app password with SMTP and IMAP through Smartlead. Google OAuth is limited to accounts where it is enabled; it is not generally available and is not represented as Google verified. Existing purchase compatibility checks and app-password requirements remain unchanged.

You need 2-step verification, the ability to generate a Google app password, and permission for SMTP and IMAP access. Organizational restrictions may prevent connection, so compatibility is not guaranteed. Microsoft, Outlook and other non-Google mailboxes are not supported at launch.

Create an app password on Google's secure page, then enter it in Lead Reclaimer after onboarding verification. We never ask for your normal Google password. An app password still grants mail access and can be revoked in your Google account. Do not provide mailbox credentials before payment.

The customer must own or be authorized to use the mailbox. On the existing app-password route, credentials are used for SMTP sending and IMAP mailbox access, including connection processing by Smartlead as described on our Subprocessors page. Do not send an app password to support by email.

Where Google OAuth is enabled for your account, Google's permission flow connects the intended Google Workspace or Gmail mailbox. You must own or be authorized to connect and operate that mailbox. Lead Reclaimer does not request your normal Google password or a Google app password for this OAuth connection.

We do not request permission to modify or delete Gmail messages. Google's read-only permission can read mailbox messages; Lead Reclaimer checks message headers for campaign matches and reads matched campaign reply bodies for the purposes below.

For Gmail Direct where enabled, we request the following scopes for the stated purposes. We do not request the broad https://mail.google.com/ scope:

• openid: Verify the selected Google mailbox identity.
• email: Verify the selected Google mailbox email address.
• https://www.googleapis.com/auth/gmail.send: Send only reviewed and approved recovery messages after customer approval and final Lead Reclaimer owner-admin release.
• https://www.googleapis.com/auth/gmail.readonly: Read matched campaign replies and unsubscribe requests using Gmail History and change notifications, reconcile delivery, and stop follow-ups.

Gmail Direct OAuth access and refresh tokens are AES-GCM encrypted and stored server-side in Cloudflare D1. Google Cloud Pub/Sub carries mailbox change notifications, and server-side Gmail History processing reads matched campaign events. Gmail-derived mailbox and reply content is held server-side for campaign operation, delivery reconciliation and suppression, subject to the existing retention and deletion terms in section 9. Approved messages and campaign reply information are available to the customer business as described in section 5. Google and Cloudflare process the information needed for this route; Gmail Direct OAuth tokens are not sent to Smartlead. Smartlead remains the provider for the existing app-password route.

Google mailbox data is used only to connect and operate the customer's selected mailbox, send the customer's reviewed and approved messages, monitor replies and unsubscribe requests, stop later follow-ups, maintain suppression and support mailbox health. It is not sold, used for advertising, or used to train general-purpose AI models.

Human access to Google API data is limited to specific support or access that you consent to, security or abuse investigation, legal necessity, or policy-permitted aggregated internal operations that contain no personal data. There is no general human-access exception for routine service operations.

Lead Reclaimer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use administrative, technical and organizational measures designed to protect personal information, including access controls, authorization boundaries and service monitoring. No method of storage or transmission is completely secure, and we cannot promise absolute security.

Customers are responsible for protecting their accounts, access links, devices and connected mailboxes.

Customers must minimize uploaded information and must not include sensitive or special-category information in lead notes, replies or other free-text fields. Questions or data concerns may be sent to hello@leadreclaimer.com.

The service is operated remotely. Personal data may be processed in the United Kingdom, Thailand, the United States, and other countries where listed providers operate. Provider locations, contracts and transfer safeguards are under verification. Before relying on a restricted transfer, Lead Reclaimer will document the applicable mechanism and any required assessment rather than representing that an unverified safeguard is in place.

• We request deletion of Bouncer's submitted addresses and verification results after checks. Failed cleanup is retried, and unresolved submissions or cleanup block account erasure. This does not promise immediate deletion of provider logs, backups or metadata.
• Raw completed-import files are deleted after 30 days, or earlier after a verified deletion request when safety gates permit.
• Recovery message, reply and normalized lead content is reviewed 90 days after the campaign ends and deleted or minimized when there is no active follow-up, dispute, security or legal need.
• Smartlead workspaces are stopped at campaign end and deleted after final events, suppressions and open rights requests are reconciled. They are never reused.
• Minimum per-customer suppression data may be retained to prevent future contact. Payment, tax, security, audit and acceptance evidence may remain for applicable legal or dispute periods.
• After a verified account-deletion request, Lead Reclaimer places a deletion hold, revokes the account session, blocks local access and sending, stops provably unsent work, and removes local mailbox credentials. We attempt to revoke Google OAuth access when you disconnect or request deletion. Local connection credentials are removed and further use is blocked even if Google revocation cannot be confirmed. You can also revoke LR access in your Google account's third-party connections. For the app-password route, local credential removal alone does not revoke the Google app password; customers can revoke that app password in their Google account. These controls do not erase retained campaign or suppression records or guarantee immediate provider deletion.
• Deleted application data can remain recoverable within a provider's limited backup and restore window. After any restore, verified deletion and suppression must be reapplied before service use resumes. We do not promise immediate deletion from provider backups or physical deletion of copies outside our control.

Account users can use Settings in the Lead Reclaimer product to export available account data, disconnect the mailbox, or start the typed account deletion request. Disconnect removes the local mailbox connection credentials or stored OAuth tokens and prevents further use of that connection; it does not itself delete existing campaign records or promise immediate deletion from backups. To withdraw Google-side access yourself, use the route-specific revocation options above. As a fallback, email hello@leadreclaimer.com from the account address and identify the business and requested data. We verify authority, place the local hold, and provide available export data or begin deletion. Because the account session is revoked when the hold is placed, Lead Reclaimer does not automatically send a completion confirmation through the account. A former account user may request a status update from the former account email address. We will verify identity before sharing the status and will explain any provider reconciliation, backup process or legally required retention that remains.

Depending on where you live and the law that applies, you may have rights to access, correct, delete, restrict, object to or receive a copy of personal information, and to withdraw consent where processing relies on consent. You may also have the right to appeal a decision.

For recovery campaigns, you can exercise your rights against either joint controller. Lead Reclaimer is the practical contact for recovery records at hello@leadreclaimer.com, and the sending business remains reachable through its sending address. The parties will cooperate to respond. Nothing in the joint controller arrangement restricts your statutory rights against either controller. We may need to verify your identity and authority.

Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner's Office or another data-protection authority that is competent for your location or circumstances.

The website and product are for adults acting for businesses. They are not directed to children, and we do not knowingly offer the service to children.

We may update this notice as our practices, providers or legal obligations change. The current version and date will be posted here.

Questions or requests may be sent to hello@leadreclaimer.com or to the UK correspondence address in section 1.