Privacy Policy
Last updated: November 8, 2026 · Effective: November 8, 2026
1. Who is responsible
FreshLeads (freshleads.cc) is a service of Lil Slice of Eden Gardening Inc., the controller of the data in this policy. Write to operator@zoom-gtm.com about any privacy question or request.
This policy covers all FreshLeads services, applications and platforms: the websites freshleads.cc and freshleads.app, the web app, the REST API, and the FreshLeads connector for AI assistants (section 5).
2. Data about you, our member
| Category | What | Why | How long |
|---|---|---|---|
| Account | Email, name, username, password hash | Sign-in and contact about your account | While the account is open, then deleted within 30 days |
| Your work | Filters, prompts, saved contacts, tags, notes, chats, emails you write or receive in the app | To run the service you asked for | While the account is open, then deleted within 30 days |
| Connections | Sender domains, Gmail accounts and third-party API keys you connect. Secrets are encrypted with AWS KMS. | To send email and run AI tasks on your behalf | Until you disconnect them or close the account |
| Billing | Plan, billing status, card brand and last 4 digits (Stripe holds the card) | Payment, fraud prevention, tax | As long as tax and accounting law requires |
| Product use | Pages opened, buttons clicked, account events (PostHog analytics on freshleads.cc). Never the content of your emails or your contacts' addresses. | To improve the product | Up to 12 months |
3. Data about businesses in our leads
A lead is a business. We collect only what a business publishes about itself in public:
- Sources: public records of newly registered domain names and newly launched websites, the public website on each domain, product launch sites, app stores, public posts, and open business directories.
- Fields: business name, website, description, business email, phone, postal address, location, social profile links, and the public registration date of the domain.
- What we never collect: domain registrant contact data from WHOIS or RDAP (names, emails, phones or addresses of the registrant), data from behind a login, special categories of personal data, or data bought from list brokers. A domain with WHOIS privacy protection is treated in the same way as any other domain, because we do not read registrant fields.
A business email can name a person, for example a founder. We treat it as business contact data and use it only to show the business to members whose filters match it.
Our business directory uses data from Overture Maps Foundation places, under the CDLA-Permissive-2.0, Apache-2.0 and CC0-1.0 licences of its sources. © Overture Maps Foundation and its contributors.
Legal basis: legitimate interest in business-to-business contact, balanced by the right to object and the right to removal. When a website says it wants no unsolicited email, we tag the lead warning:no_solicitations for our members.
Removal: a website owner can ask us to remove a website. After a one-time email code, we remove the website and its subdomains from member views and stop sharing them. We keep the domain name on a suppression list so we do not collect it again.
Retention: see the retention table in section 6a.
4. How we use data
- To run the service: find and score leads, match them to filters, deliver them, and send the emails you write.
- To bill you and to prevent fraud and abuse.
- To keep the service secure and to answer support requests.
- To improve the product, with aggregated or pseudonymous usage data.
We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We do not use member data, lead data or connector data to train AI models.
5. AI connectors (Claude, ChatGPT and other assistants)
You can connect FreshLeads to an AI assistant that supports remote MCP servers (https://freshleads.app/mcp). When you do:
- Sign-in: you sign in to FreshLeads with OAuth and approve the access the assistant asks for. We store the OAuth tokens encrypted and use them only to answer that assistant's requests for your account.
- Data we receive: the tool requests the assistant sends for you, such as a search query, a filter, or a contact you want to save. We do not receive your full conversation with the assistant.
- Data we return: only the results of each request, from your own FreshLeads account (for example matched business leads, filters or saved contacts). The AI platform's own privacy policy covers what it does with those results.
- Business contacts only: through the connector and on freshleads.app, a lead shows business contact data only. We leave out email addresses on personal webmail services (for example Gmail or Outlook), personal social profiles, and street addresses. The city, region and country stay. The connector does not look up, identify or profile individual people.
- Logs: we keep connector request logs (time, tool name, account, result status) for 30 days for security and troubleshooting.
- Actions: tools that change data are marked as write tools, and the assistant asks you before it uses them.
- Disconnect: you can disconnect at any time in FreshLeads → Settings → Connected apps, in the assistant's settings, or by writing to us.
The connector does not collect government identifiers, payment card data, health data, or passwords for other services.
6. Who we share data with
Only the processors that run the service for us, under contract:
| Processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, encryption keys | United States |
| Stripe | Payments | United States |
| Resend, Google | Sending the email you write, from your connected sender | United States |
| PostHog | Product analytics (freshleads.cc only) | United States |
| AI model providers | Scoring leads and writing drafts. They get only the text needed for each task. | United States |
When you connect an AI assistant (section 5), you choose to send results to that assistant's provider. We give data to authorities only when the law requires it.
6a. How long we keep data
| Data | How long |
|---|---|
| Your account, your work and your connections | While your account is open. Deleted within 30 days after you ask us to close it. |
| Sign-in codes and links | 15 minutes |
| Browser sessions | 30 days, or until you sign out |
| OAuth access tokens / refresh tokens (AI connectors) | 1 hour / 60 days, or until you disconnect the app |
| OAuth authorization codes | 10 minutes, and used once |
| AI-written email drafts you did not save | 30 days |
| Connector and API request logs | 30 days |
| Product analytics (freshleads.cc) | Up to 12 months |
| Database backups | 35 days, then overwritten |
| Billing records | As long as tax and accounting law requires (in the United States, up to 7 years) |
| Business records in our lead data | For as long as we operate the service. We refresh each record from its public source, and delete it when the owner asks for removal. |
| Removal requests | The removed domain stays on our suppression list permanently, so we never collect it again. |
6b. AI and automated processing
FreshLeads uses AI models to read public business websites, score how well a business matches a member's filter, and write draft emails that the member reviews. These scores are about businesses, not about people. They do not make legal or similarly important decisions about any person. A member decides what to do with each lead.
7. International transfers
We store and process data in the United States. When we transfer personal data from the EU, the UK or Switzerland, we rely on the safeguards that the law allows, such as standard contractual clauses.
8. Your rights and controls
You can ask for a copy of your data, a correction, deletion, or a limit on its use, and you can object to its use. Residents of California and other US states with privacy laws have the same rights, and we will not treat you differently for using them. Write to operator@zoom-gtm.com. We answer within 30 days. You can also complain to your local data protection authority, for example the Office of the Privacy Commissioner of Canada, or the authority of your country in the EU or the UK.
Controls you can use at any time:
- Disconnect an AI assistant: FreshLeads → Settings → Connected apps → Disconnect.
- Revoke an API key: FreshLeads → Settings → API key → Reset.
- Close your account and delete your data: write to operator@zoom-gtm.com from your account email.
- Remove a website from our leads: use the removal form. No account is needed.
9. Security
We protect data with TLS 1.2 or later for all traffic, encryption at rest for all stored data, AWS KMS encryption for stored secrets such as connected email and AI keys, hashed storage of passwords, API keys and OAuth tokens, per-account access checks on every request, and restricted production access. If a breach affects your personal data, we tell you and the authorities as the law requires. Read more on our Security page.
10. Children
FreshLeads is a business service for people 18 and older. We do not knowingly collect data from children.
11. Cookies and storage
The app keeps your sign-in and settings in your browser's local storage. freshleads.cc uses PostHog analytics. This site (freshleads.app) uses no analytics and no cookies. We do not use advertising cookies.
12. Changes
We will post changes on this page and update the date at the top. For a large change, we tell members by email or in the app before it applies.