Privacy Policy

1. Who we are

Leedrush.com (“Leedrush”, “we”, “us”) is a lead enrichment and lead sourcing service for businesses. It is run by a private individual based in Estonia, who is the controller of the personal data described in this policy, except for the contacts in our customers’ own files, which we process on the customer’s behalf (section 3).

For anything about your data, write to contract@leedrush.com.

2. Data about our customers and website visitors

The free email checker on our website checks the address on our own server (format and mail server) and does not store it.

3. Contacts in the files you upload (we act as your processor)

When you upload a file, send leads through the API, a webhook or a CRM connection, you are the controller of the people in it and Leedrush is your processor. We process those contacts only to provide the service you asked for, under our Data Processing Agreement, which is part of our Terms of Service:

• we check formats, remove duplicates and check whether email addresses can receive mail (mails.so);
• we read the public website of each lead’s company;
• we score each lead with AI (DeepSeek — without names or full email addresses, see section 5);
• we return the results to you and, when you ask, send them to your CRM or webhook.

We do not use your contacts for anything else: we do not sell them, show them to other customers or add them to our own database. If you are a person listed in a customer’s file, please contact that customer; if you write to us, we pass your request on to them. Whatever the source, Leedrush never sends email to an address on its do-not-contact list (see Remove my data).

4. Business contacts we collect for Leads as a Service

For our Leads as a Service product we look for businesses that match a customer’s description. Here Leedrush is the controller. This section is the information we must give you under Article 14 GDPR if your details are among them.

• Sources: the D7 Lead Finder business directory (Lead Platforms Ltd, Seychelles) and the public website of the business.
• Data: business name, website, category, city and address, and the email address and phone number the business publishes; sometimes the name, job title and work email address of a person named on the company website.
• Purpose: to offer our customers relevant business contacts for business-to-business prospecting.
• Legal basis: legitimate interests (ours and our customers’ interest in reaching businesses that may need their products). We keep this to business contact details, and we remove anyone who objects.
• Recipients: our customers who search for businesses like yours, and the service providers in section 6.
• Kept: search results are reused for up to 90 days; contact entries are kept until they are no longer accurate or you ask us to remove them.
• Your choice: to have your details removed or to object, use Remove my data — we confirm by a link sent to your address, then delete what we hold at once — or email contract@leedrush.com with the subject “Remove my data” (we act within 30 days). You are then on our do-not-contact list: never collected, offered to a customer or emailed through Leedrush again. For that we keep only a one-way fingerprint (SHA-256 hash) of your email address or company domain. You also have the rights in section 10.

Customers who contact you are responsible for doing so lawfully, including honouring your opt-out; our Terms require this.

5. AI processing

We use DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China) through its API to:

• score uploaded leads and qualify Leads as a Service leads — it receives the job title, company name, company website, country and the domain of the email address, never names or full email addresses;
• turn your description of your ideal customer into search terms, and draft outreach emails from your instructions;
• answer you in the support assistant — it receives your message, the recent conversation, and your plan, credits, recent file names and invoices; not your name or email address. Please do not type sensitive personal data into the chat.

Scores and suggestions are estimates that help you decide; no decision with legal or similarly significant effect on anyone is made automatically.

6. Who receives data

We do not sell personal data. We use these service providers, each only for the purpose shown:

When you connect another service — for example Pipedrive, HubSpot, Salesforce, Apollo with your own key, or a webhook — we send it the leads you choose, under your own agreement with that service. The same applies to the mailbox your sequences send from: your own SMTP mailbox, or a Microsoft 365 / Outlook mailbox you connect by signing in with Microsoft, in which case we send each e-mail through Microsoft Graph on your behalf and keep only an encrypted sign-in token. To stop a sequence when a lead answers, we also check that mailbox's inbox every ten minutes (Microsoft Graph, or IMAP with the password you saved for sending): we look at the sender address and subject of new messages to spot replies and bounces from the leads you are e-mailing. We store only that the lead replied or bounced; we keep no message text and nothing about other mail.

We may also disclose data when the law requires it, or to protect our rights in a legal claim.

7. Transfers outside the European Economic Area

Our server and database are in Germany. Some providers above are outside the EEA. Where the European Commission has found a country’s protection adequate (for example, US companies certified under the EU–US Data Privacy Framework), we rely on that decision; otherwise we rely on the European Commission’s Standard Contractual Clauses where the provider offers them. We also limit what we send: DeepSeek, for example, never receives names or full email addresses.

8. How long we keep data

9. Cookies and browser storage

Our website and app keep a few things in your browser’s local storage that they need to work: your sign-in token, your theme and language, and your cookie choice.

We load analytics and advertising measurement only if you click “Accept” in the cookie banner. Then Google Tag Manager loads Google Analytics and Google Ads measurement, which set cookies (such as _ga and _gcl_au) to count visits and see which ads lead to sign-ups and purchases. If you decline, these are not loaded.

If you accept, we also remember in your browser how you found us — the campaign tag in the link (for example utm_source=newsletter) or the website that sent you — and record it with your account when you sign up, so we can see which channels bring customers. If you decline, we record only the campaign tags in the address of the sign-up page, if any.

You can change your choice at any time: change cookie choice (the banner appears again).

10. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use (including for marketing), and to give you your data in a portable format. Where we rely on your consent, you can withdraw it at any time.

• Export: Settings → Privacy & Data → Export Your Data.
• Delete: Settings → Privacy & Data → Delete Account.
• Not a customer? Remove my data.
• Anything else: email contract@leedrush.com. We answer within one month.

You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority where you live or work.

11. Security

• All traffic is encrypted (HTTPS).
• Passwords are stored only as salted PBKDF2 hashes; two-factor sign-in with an authenticator app is available.
• Credentials of the services you connect are stored encrypted; API keys are stored hashed.
• Only the operator has access to the production systems; the database is backed up daily.

If a personal data breach affects you, we will tell you and the authority as the law requires.

12. Children, changes and contact

Leedrush is not meant for anyone under 18.

When we change this policy, we update the date above; if a change matters to customers, we also tell them by email before it applies.

Questions: contract@leedrush.com.