Privacy Policy

• We collect the information needed to host pages, deliver emails, run selected integrations, and keep the service secure.
• We do not sell personal data, use it for advertising, or use it to train AI models.
• Signup data belongs to the account holder whose page collected it.
• Secrets such as API keys and webhook URLs are encrypted at rest when stored by LeadMagnets.
• Custom domains and custom sender domains are optional. A page can be hosted and sent from LeadMagnets by default.
• If you connect Gmail, we only use it to send the emails you set up. We never read your inbox, and our use of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements.

For account data, LeadMagnets is the controller. For signup data collected through a page created by an account holder, the account holder is normally the controller and LeadMagnets acts as a processor on that account holder's behalf. The account holder is responsible for their privacy notice, lawful basis, permissions, and the content of messages they send to their audience.

When you create or use an account, we may process:

• Your name, email address, authentication details, and account timestamps. Passwords are stored as hashes, not plaintext.
• Your chosen LeadMagnets username, custom-domain settings, brand settings, sender settings, and page configuration.
• The copy, images, resource links, email content, and follow-up sequences you create.
• Integration settings and credentials you choose to add, including email, newsletter, calendar, Slack, Pipedrive, and Zapier connections.
• If you connect a Gmail account, your Gmail address, the display name on your Google account, and the OAuth tokens Google issues to us. See section 7 for details.
• Technical and security information, including IP address information used for abuse prevention and rate limiting, request metadata, and error logs.

When a person submits a LeadMagnets form, we process the name and email address they provide, the page they signed up on, and the submission time. When a follow-up sequence is enabled, we also keep the information needed to track whether that sequence is active, completed, stopped, or failed for that email address.

Page analytics use a random browser-tab session identifier to count visits and visible-page engagement without analytics cookies or raw IP addresses. For successful signups, we may also record whether that signup explicitly started a configured post-signup video or completed a configured quiz. These outcome timestamps are used only to provide aggregate performance reporting to the account holder.

Forms can appear on a LeadMagnets-hosted URL or an account holder's custom domain. The host does not change which account owns the signup data.

We use information to:

• Provide, secure, and improve the service, including account authentication and abuse prevention.
• Host and serve lead-magnet pages, uploaded images, and the resource email requested by a subscriber.
• Run follow-up email sequences configured by an account holder and honour a recipient's request to stop those follow-ups.
• Stop a configured follow-up sequence when a connected calendar provider reports that the same person booked a call, if the account holder has enabled that option.
• Send signup data to the optional integrations selected by the account holder, such as Substack, Kit, Slack, Pipedrive, or Zapier.
• Send account holders product updates and important service notices. You can unsubscribe from product marketing emails without deleting your account.
• Respond to support requests and enforce our Terms.

LeadMagnets can deliver resource emails and follow-up sequences in one of three ways: from a LeadMagnets-managed sender address, through an SMTP server whose credentials the account holder provides, or from the account holder's own Gmail address if they connect their Google account (see section 7). SMTP passwords and Google tokens are encrypted at rest.

Optional integrations are activated by the account holder. Depending on what they connect, signup information may be sent to Substack or Kit for newsletter subscription, Slack for a notification, Pipedrive to create or update a person, or Zapier to trigger an account holder's automation. Each third party processes information under its own terms and privacy notice.

Account holders can choose to connect a Gmail or Google Workspace account so that emails are sent from their own address. Connecting is optional. When you connect, Google asks you to grant LeadMagnets the following permissions:

• Send email on your behalf (gmail.send). This lets us send the resource emails and follow-up sequence emails you configure, from your Gmail address. Messages sent this way appear in your Gmail Sent folder.
• Your email address and basic profile (userinfo.email, userinfo.profile). This lets us show which Gmail account is connected and use your name as the sender name.

What we do not do. We cannot and do not read, search, download, modify, or delete the emails in your mailbox, and we do not access your contacts, calendar, or files. We only send the messages that you have set up in LeadMagnets.

How it is stored. The access and refresh tokens Google issues to us are encrypted at rest with AES-256-GCM and are used only by our servers to send your emails. They are never shown in the browser or shared with other account holders.

Sharing. We do not sell Google user data, and we do not use it for advertising, for credit-worthiness or lending decisions, or to develop, improve, or train generalised AI or machine-learning models. We do not transfer it to third parties except as needed to provide this sending feature, to comply with applicable law, for security purposes, or as part of a merger or acquisition with prior notice. Our staff do not read Google user data unless you give us explicit permission for a specific message, it is necessary for security or abuse investigation, or it is required by law.

Limited Use. LeadMagnets' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect Gmail at any time in Settings → Email & Gmail Sync. When you disconnect, we revoke our access with Google and delete the stored tokens. Deleting your LeadMagnets account also deletes them. You can also remove access from your Google Account permissions page.

We use service providers to operate LeadMagnets. Depending on which features are used, these include:

• Vercel for application hosting, content delivery, and file storage.
• MongoDB for the hosted application database.
• SocketLabs for email delivery from LeadMagnets-managed sender addresses.
• Google for sign-in with Google and, when an account holder connects Gmail, sending email through the Gmail API.
• Substack, Kit, Slack, Pipedrive, and Zapier when an account holder elects to connect those services.

We may also disclose information where required by law, to protect the rights and safety of LeadMagnets and others, or in connection with a reorganisation, merger, or sale of the service.

We retain account data while an account is active. Deleting an account removes the active account record and its associated LeadMagnets pages, signup records, and follow-up records from our application database. Copies may remain in provider backups for a limited period under their normal backup-retention processes. We may retain limited information where necessary for legal obligations, security, dispute resolution, or enforcement.

We use reasonable technical and organisational measures to protect information, including HTTPS in transit, password hashing, encrypted storage for supported integration secrets, access controls, and rate limiting. No service can guarantee absolute security. If a security incident requires notice, we will provide it as required by applicable law.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data. Account holders can update much of their account information in the dashboard. To make a request, email info@bdatechnologies.com.

If you submitted your details through an account holder's page, contact that account holder first. They control the purpose of that collection and any messages sent to you. You can also use the stop link in an eligible follow-up email to stop that sequence.

LeadMagnets and our providers may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for international transfers.

LeadMagnets is not intended for children under 16, and we do not knowingly collect personal information from children under 16. Contact us if you believe this has happened.

We may update this Policy as LeadMagnets changes. For material changes, we will provide reasonable notice before they take effect. Questions can be sent to info@bdatechnologies.com.