Privacy Policy

1) Who we are

Leedo ("we", "us", "our") provides tools that help recruiters identify likely hiring managers and draft outreach messages using public business data and AI-assisted workflows.

2) Scope

This Policy explains how we handle personal data when you:

• visit our website,
• use our product (Leedo),
• use the Leedo Job Extractor Chrome extension,
• receive outreach generated through Leedo,
• interact with us by email, social, or support.

3) What data we collect

a) You provide to us

• Account & profile: name, email, company, role, language preferences.
• Billing: company billing details, VAT/tax IDs.
• Content you submit: search criteria, job links, message templates, feedback/support.

b) Collected automatically

• Device/usage: IP address, browser type, pages visited, timestamps, approximate location.
• Cookies/SDKs: analytics and site functionality.

c) From third-party sources (public/business data only)

• Public web: company pages, job boards, LinkedIn public profiles, news, career sites.
• Data partners & tools you connect: Apollo.io, Hunter.io, Salesforce, Make.com, cloud AI providers (e.g., OpenAI).
• Customers: where a customer uploads or syncs business contacts.

d) From the Chrome Extension

When you use the Leedo Job Extractor Chrome extension, we additionally collect:

• LinkedIn job data - job title, company name, job URL, and job ID from the LinkedIn job posting you are actively viewing
• Submission timestamps - when a job was sent to your Leedo account

The extension does not collect your LinkedIn credentials, your LinkedIn profile data, browsing history, or any data from pages other than LinkedIn job postings (linkedin.com/jobs/*).

Your Leedo session token is stored locally on your device using Chrome's chrome.storage.local API and is never shared with third parties.

We do not knowingly collect sensitive categories (e.g., health, biometrics). We focus on business-context contact details relevant to B2B outreach.

4) Purposes & legal bases

We process personal data to:

For B2B prospecting, we rely on legitimate interests and provide an easy opt-out.

5) How we use AI

We may use vetted AI providers to:

• classify roles, match likely hiring managers, summarize job posts,
• draft message suggestions,
• score relevance/confidence.

We do not train models on your identifiable data. Provider settings prevent training where possible.

6) Sharing & processors

We share personal data with:

• Hosting & infrastructure: cloud providers, CDNs.
• Data enrichment/verification: Apollo.io, Hunter.io.
• CRM & email: Salesforce, transactional email services.
• AI vendors: for content generation/scoring.
• Payments: payment gateway and billing tools.
• Compliance & legal: auditors, advisors, authorities.

7) International transfers

We may transfer data outside your country (e.g., EU ↔ US/JP). We use recognized safeguards (Standard Contractual Clauses, etc.).

8) Retention

We keep data only as long as needed, then delete or anonymize. Typical:

• Account & billing: contract + up to 7 years.
• Leads/contacts: up to 24 months from last activity.
• Logs/analytics: 12–24 months.

9) Your rights

EEA/UK

Access, correction, deletion, restriction, portability, objection. Withdraw marketing consent anytime. Complaint rights with your authority.

California

Access, deletion, correction, know categories/sources/purposes. We do not sell/share personal information. Contact privacy@leedo.app.

Japan (APPI)

Rights: notification, disclosure, correction, suspension of use/provision. Foreign transfers are safeguarded.

10) Your choices & opt-out

• Marketing: unsubscribe links or email privacy@leedo.app.
• Prospecting emails: every message includes opt-out.
• Cookies: manage via banner or browser.
• Chrome Extension: uninstall the extension at any time to stop all data collection via the extension. To request deletion of data collected via the extension, contact privacy@leedo.app.

11) Security

We use encryption, access controls, logging. No method is 100% secure.

12) Children

Not intended for under 16. We do not knowingly collect children's data.

13) Third-party links

Our site may link to third parties. Their privacy practices apply.

14) Changes

We may update this Policy. New effective date will be posted; major changes get extra notice.

15) Cookie Policy

16) Google API Disclosure (Google User Data)

Leedo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This section describes specifically how Leedo accesses, uses, stores, shares, retains, and deletes Google user data when you connect your Google (Gmail) account.

a) Data Accessed

When you choose to connect your Google account to Leedo, we request the following Google OAuth scopes only:

• openid, email, profile - to identify your Google account and display your email address inside Leedo.
• https://www.googleapis.com/auth/gmail.send - to send outreach emails from your Gmail address that you have explicitly drafted and approved inside Leedo.

From these scopes, the only Google user data Leedo accesses is:

• Your Google account email address and basic profile (name, profile picture URL).
• The Gmail message ID and thread ID returned by Gmail after Leedo sends an email on your behalf, used to track that specific outreach.

Leedo does not request gmail.readonly, gmail.modify, gmail.metadata, or any other Gmail scope. Leedo cannot read your inbox, your sent folder, your contacts, your drafts, or any other content of your Google account.

b) Data Usage

Google user data is used solely to provide the user-facing features of Leedo that you have asked for:

• To send outreach emails and follow-up sequences from your own Gmail address, only after you create or approve the message inside Leedo.
• To display which Google account is currently connected to your Leedo workspace.
• To associate sent messages with the correct lead in your Leedo dashboard via Gmail's returned message and thread IDs.

Leedo does not use Google user data for advertising, does not sell Google user data, and does not use Google user data to train, fine-tune, or improve any generalized or third-party AI/ML models. AI features in Leedo (e.g. drafting message suggestions) operate on data you provide inside the product, not on data read from your Gmail account.

c) Data Sharing

Leedo does not sell or rent Google user data. We share Google user data only with the limited categories of service providers strictly required to operate the product, and only to the extent needed to deliver the feature you requested:

• Supabase (hosted on AWS) - encrypted storage of your OAuth tokens and the metadata of messages Leedo has sent on your behalf.
• Google (Gmail API) - to actually transmit the email you authored.

Google user data is never shared with advertisers, data brokers, AI model providers (such as OpenAI), enrichment vendors (such as Apollo.io or Hunter.io), or any other third party. We may disclose data only when legally required (e.g. valid court order) or to protect the rights, property, or safety of Leedo, our users, or the public.

d) Data Storage & Protection

• OAuth access and refresh tokens are encrypted at rest using AES-256-GCM with a key held in Supabase secrets, separate from the database, before being written to our database.
• All data is transmitted over TLS 1.2+ between your browser, Leedo's edge functions, Google APIs, and our database.
• Database access is protected by Supabase Row-Level Security so that only your authenticated Leedo account can access tokens and message metadata associated with your user ID.
• Our infrastructure is hosted on SOC 2 Type II certified providers (Supabase / AWS).
• Access to production systems is limited to a small number of authorized engineers, protected by SSO and multi-factor authentication, and logged.
• Leedo staff do not read your Google user data. Logs do not contain the body of emails you send. We will only access your data to investigate a specific support issue you raise, to fix a security incident, or where required by law.

e) Data Retention & Deletion

• OAuth tokens: retained while your Google connection is active. Deleted within 30 days after you disconnect Gmail in Leedo, revoke access at myaccount.google.com/permissions, or delete your Leedo account.
• Sent-message metadata (Gmail message ID, thread ID, send timestamp, recipient lead ID): retained as part of your Leedo CRM history for up to 24 months from last activity, then deleted or anonymized. You may request earlier deletion at any time.
• Account-wide deletion: you can request deletion of all Google user data and your full Leedo account by emailing privacy@leedo.app or by using the in-app "Disconnect Gmail" and "Delete account" options. We will action verified deletion requests within 30 days and confirm completion by email.
• Backups containing encrypted tokens are rotated and fully purged within 35 days.

f) Limited Use Affirmation

Leedo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties for serving advertisements, do not use it for advertising purposes, do not allow humans to read it (except as described above), and do not use it to develop, improve, or train generalized AI/ML models.

17) Chrome Extension - Leedo Job Extractor

18) Contact