Privacy

This summary describes how AutoLead handles data. It is not a substitute for the data processing agreement signed with each customer.

Roles

Each customer company is the data controller of the leads it collects and contacts. Hey.AI acts as processor: it stores and processes that data only to provide the service.

What is stored

Account data (name, email, password hash, sessions, IP and browser for security), the leads each company collects from public business sources (company name, published contact details, website, location), outreach emails and replies, and an audit log of actions.

Where and how

Data is stored in the EU (Frankfurt). Companies are isolated from each other at database level (row-level security). Connection secrets — AI keys, mailbox passwords — are encrypted with AES-256-GCM. Passwords are hashed and checked against known breaches.

Rights of the people contacted

Every outreach email identifies the sender and contains a one-click unsubscribe link; unsubscribing blocks the address for that company permanently. Companies can export everything held about a lead and delete it. Leads untouched for the retention period chosen by each company (2 years by default) are deleted automatically.

Sub-processors

Vercel (hosting), Neon (database, EU). AI and email-finding providers are chosen and connected by each customer with its own account.