Privacy Policy

1. Who we are

LeadScanner is operated by Philipp R. Stegmann (data controller). The full postal address and responsible-person details are listed in our Imprint.

Contact: hello@lead-scanner.com

2. Data we collect and store

• Account email address — used for magic-link authentication, billing communications, and account management.
• Scanned lead data — names, companies, titles, email addresses, phone numbers, and LinkedIn profiles collected via badge/card scanning and third-party enrichment. Stored in our EU database, isolated per account.
• Voice notes — audio recordings attached to leads (Pro plan). Stored encrypted in our database.
• Usage data — scan count, credit usage, subscription status. Used for billing and fair-use enforcement.
• Session cookie — one httpOnly, signed JWT that keeps you logged in after a magic link (90-day expiry).
• Analytics & advertising (optional, consent-based) — only if you accept the cookie banner, Google Tag Manager / Google Analytics may set analytics cookies, Google Ads and Meta (Facebook) Pixel may set advertising cookies to measure ad conversions and build audiences. Decline and none of these are loaded.

3. How we use your data

• To provide the LeadScanner service (scanning, enrichment, CRM push)
• To send you magic-link login emails
• To process your subscription and billing
• To enforce fair-use credit limits
• We do not sell your data. We never share who scanned a contact, or link a contact back to your account, with any other user. We do maintain a shared, non-attributable database of business-contact details (name, company and found business contact info) across accounts — see §8.

4. Data processors (sub-processors)

US-based processors are covered by Standard Contractual Clauses (SCC) under GDPR Chapter V.

5. Your rights (GDPR)

• Right to access — export all your data as CSV from the app at any time.
• Right to erasure — delete your account and all associated data from Settings → Account.
• Right to portability — CSV export available anytime on all plans.
• Right to object / restrict processing — contact hello@lead-scanner.com.
• You may also lodge a complaint with your national data protection authority.

6. Data retention

Lead data and account data are retained for as long as your account is active. After account deletion all personal data is removed within 30 days. Billing records (Stripe) are retained for 7 years for tax/legal compliance.

7. Cookies

Essential: one signed, httpOnly session cookie keeps you logged in after a magic link (90-day expiry, or until logout). It is required for the app to function and is not used for tracking.

Analytics (optional): we use Google Tag Manager / Google Analytics and Vercel Web Analytics to understand product usage. Google analytics cookies are loaded only after you accept our cookie banner — you can decline at any time, and Vercel Web Analytics is cookieless.

Advertising (optional): we use Google Ads and the Meta (Facebook) Pixel to measure the effectiveness of our advertising campaigns (conversion tracking) and to build advertising audiences. These cookies and tracking scripts are loaded only after you accept our cookie banner and are never set if you decline. Meta acts as a joint controller for data processed through the Pixel; see Meta's Privacy Policy for details.

8. Shared business-contact database

LeadScanner maintains a shared database of business contacts that improves results for all accounts. When any account scans or enriches a professional contact, the contact's business details — name, company, and any business email, phone, job title, LinkedIn profile or website we find — are recorded in this shared database. If a different account later encounters the same person, we can fill in what we already know without paying a data provider again, and when newer information is found for that contact it is kept up to date across the accounts that hold them. This applies to business/professional contact data only.

• What is stored: the contact's name and company plus any business email, phone, title, LinkedIn profile or website found for them. The shared record contains no account ID, team ID, or lead ID — it cannot reveal who scanned a given contact, or which contacts a given account holds.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in maintaining an accurate, non-duplicative database of professional B2B contact information — the same basis relied on by business-contact providers such as our own enrichment sources. We process business contact details, not special categories of data.
• Updates & retention: records are refreshed on demand when a contact is scanned or opened again, so information stays current rather than going stale. We keep a record while it remains useful for this purpose.
• Your right to object / erasure: if you are a person in this database (not a LeadScanner account holder), email hello@lead-scanner.com with your name and company. We will erase your record and suppress it so it is not re-added by future scans.

9. Changes to this policy

We will notify you by email and update the "last updated" date above before any material changes take effect.