Data protection
Subprocessors
These providers support the delivery, security and operation of Lead Reclaimer.
Last updated: October 21, 2026
Effective date: October 15, 2026
Current provider list
The generally available connection still uses a Google app password with SMTP and IMAP through Smartlead. Google OAuth is limited to accounts where it is enabled; it is not generally available and is not represented as Google verified. Existing purchase compatibility checks and app-password requirements remain unchanged.
Where Google OAuth is enabled for your account, Google's permission flow connects the intended Google Workspace or Gmail mailbox. You must own or be authorized to connect and operate that mailbox. Lead Reclaimer does not request your normal Google password or a Google app password for this OAuth connection.
Lead Reclaimer uses the providers below where their services are needed. A provider may not receive every listed category for every customer.
Provider contract terms, processing locations, backup cycles and restricted-transfer safeguards are under verification unless this page expressly states otherwise. This list does not claim that a particular DPA or transfer mechanism has been signed or completed.
| Provider | Purpose | Data |
|---|---|---|
| Bouncer | Selected email-address verification provider: address deliverability and safety checks. Only addresses explicitly returned as safe and valid are eligible, subject to other eligibility and mailbox safety controls | Email addresses only are submitted, not CSV filenames, local lead IDs, names, reply bodies or credentials. Lead Reclaimer receives address deliverability and safety results |
| Cloudflare | Product hosting, compute, database and object storage | Account, imported lead, campaign, mailbox-derived, support and security data when the product service is used |
| Stripe | Checkout, payment processing and purchase confirmation | Customer and business details, billing details, payment status and transaction information. Stripe acts as an independent controller for payment processing where applicable |
| Resend | Passwordless sign-in and transactional customer email | Account email, sign-in or service-message content, delivery status and related technical data when a transactional message is sent |
| Eligible Google Workspace and Gmail mailbox services, including custom business domains hosted by Google. Generally available connection uses app-password SMTP/IMAP. Where enabled for an account, Gmail Direct uses Gmail API OAuth and Google Cloud Pub/Sub change notifications | Mailbox identity, app-password or OAuth authentication for the enabled route, campaign messages and replies, Gmail History and notification metadata needed for sending, reply monitoring, unsubscribe handling and mailbox operation. The customer also has its own direct contract with Google | |
| Lovable | Marketing-site hosting, frontend delivery and operational analytics | Website usage, device and request data. Customer service data only if it passes through a Lovable-hosted frontend or related operational service |
| Smartlead | Lead Reclaimer's email-delivery processor for the existing app-password route: isolated Google mailbox connection, recovery delivery and reply events. Customers enter a Google app password in Lead Reclaimer after onboarding verification and receive no Smartlead campaign, lead or billing access. Each isolated workspace is controlled by Lead Reclaimer and never reused across customers | Mailbox connection information, app-password credentials needed for the connection, approved campaign, recipient, send, reply, unsubscribe and mailbox-health data. Gmail Direct OAuth tokens are not sent to Smartlead |
Bouncer verification cleanup
Lead Reclaimer requests deletion of submitted addresses and verification results from Bouncer after checks. Failed cleanup is retried, and unresolved submissions or cleanup block account erasure. This does not promise immediate deletion of provider logs, backups or metadata. Account-specific provider agreements and transfer terms remain under verification, as described above.
Changes to this list
Where required by the Recovery Joint Controller Arrangement, this list will be updated before a new material subprocessor is used. Customers may send a reasonable, documented data-protection objection to hello@leadreclaimer.com.
Provider products and processing arrangements can change. This page identifies the provider, purpose and relevant data without promising a fixed provider location or retention period.