Privacy Policy

We collect the following information when you use LeadScout:

• Account information (name, email) provided during registration via our STEPlus Identity service.
• Workspace, team membership, and role data.
• Ideal Customer Profiles (ICPs) you define — industries, job titles, keywords, and your offer description.
• Lead records sourced on your instruction from publicly available profiles and posts on LinkedIn, Reddit, and X (see section 2).
• Message drafts you generate, edit, and finalize.
• Source credentials and AI provider API keys you add — encrypted at rest, never displayed back (see section 5).
• Audit logs of workspace actions and aggregate AI usage metrics (tokens, estimated cost) for your usage dashboard.

LeadScout searches publicly available professional information — names, headlines, companies, locations, public posts, and profile images — on your behalf, using either your own source credentials or the platform's. This data is collected only when you run a search, is scoped to your workspace, and is never pooled across customers or resold.

People who appear as leads can be suppressed permanently: opt-outs are irreversible, apply across all sources by handle, and prevent a person from being re-collected in future searches. Individuals may request removal of their information via the contact link below.

We use collected information to:

• Provide and maintain the lead discovery service.
• Score leads against your ICP and generate personalised message drafts (see section 4 on AI processing).
• Produce CSV exports you request.
• Show workspace-level usage and cost dashboards.
• Improve the Service and develop new features.

We do not sell your data or your leads' data.

ICP enrichment, lead scoring, and message generation send relevant lead and ICP content to the AI provider configured for your workspace — OpenAI, Anthropic, Google Gemini, or DeepSeek. If your workspace supplies its own API key, requests are made with that key; otherwise the platform's key for the selected provider is used. AI providers process this data under their own terms; we do not use it to train models.

All secrets — AI provider keys, source credentials, and tokens — are encrypted at rest using AES-256-GCM. Data in transit is protected via TLS. Workspace access is enforced through role-based permissions (Owner, Admin, Editor, Viewer), and access to production systems is restricted to authorised personnel.

Leads, messages, searches, and ICPs are retained for the lifetime of your workspace and deleted when the workspace is deleted. Opt-out suppression records are retained indefinitely by design, so suppressed individuals stay suppressed. Account data is retained for the lifetime of your STEPlus account.

We do not share your data with third parties except:

• AI and data providers you configure (section 4), and scraping providers used to run your searches (official platform APIs or Apify).
• Service providers who assist in operating the platform (e.g. database hosting, object storage).
• When required by law or legal process.
• To protect the rights, property, or safety of STEPlus, our users, or the public.

You may request access to, correction of, or deletion of your personal data at any time. Workspace owners can delete a workspace — and all leads, messages, and credentials in it — from Settings. Individuals who believe their public information appears in a LeadScout workspace may request suppression via the contact link below.

LeadScout uses browser local storage for authentication tokens and interface preferences (theme, sidebar state). We do not use third-party tracking cookies.

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notification.

For privacy-related inquiries, including data subject removal requests, contact us.