Privacy policy

1. Who operates LeadScout

LeadScout is an independent project operated by Emmanuel Kamal Muhammed. Contact ekamcy@gmail.com for privacy questions, access or deletion requests. LeadScout is currently a private pilot; this public website explains the product and its data practices. Separate user workspaces and wider onboarding are not yet generally available.

2. Information processed

• Profile and portfolio: name, sender email, service descriptions, project experience, portfolio link, signature, message preferences and an optional uploaded PDF CV.
• Business research: public business contact details, website URLs, location, category, factual research observations and crawl history.
• Messages and activity: draft and sent pitch text, recipients, subjects, approval and suppression records, sending attempts, timestamps and message status.
• Google connection: the connected Google account email, granted scopes, OAuth access and refresh tokens, and Gmail message and thread identifiers.
• Gmail replies and temporary delivery checks: sent outreach threads and recent delivery reports, including headers and content needed to identify replies or delivery failures. Plain-text replies from tracked outreach threads, sender and subject headers, timestamps and dashboard read status are saved in the private workspace so you can read conversations in the Inbox. Images and attachments are not downloaded into the Inbox. Delivery-report content is processed temporarily.
• Website and service logs: hosting providers may process IP addresses, request timestamps, device or browser information and security logs while delivering the website and application.

3. How information is used

Information is used to operate the private workspace; research relevant businesses; prepare personalised proposals; show and send authorised messages with the chosen portfolio and CV; prevent duplicate or suppressed contact; check replies and bounces; display saved replies and unread counts in the private Inbox; maintain activity records; troubleshoot problems; and respond to support or deletion requests.

A public contact address is research information, not a claim that a business needs design work or has agreed to receive messages. The sender remains responsible for choosing appropriate recipients and messages and meeting applicable rules and provider policies.

4. Google and Gmail permissions

Google account identity permissions identify the connected mailbox. Gmail send permission allows LeadScout to send messages on behalf of that account. Gmail read-only permission supports checking tracked outreach threads and recent delivery reports, and displaying their replies in your private Inbox. Read-only access is a broad Google permission; LeadScout's implemented checks focus on these outreach and delivery workflows.

The service does not request Gmail deletion or mailbox-edit permissions. Sending is controlled by the connection, sending preference, queue approval, daily cap and suppression checks. Automatic approval can be turned on for newly researched pitches. Disconnecting Gmail stops the application using the stored connection and removes its stored mailbox tokens after revocation is confirmed.

You can also revoke access through your Google Account connections. Revoking Google access does not itself delete profile details, uploaded CV files, saved contacts or historical outreach records in LeadScout; request their deletion separately.

5. Limited use of Google data and AI assistance

Information received from Google APIs is used for the connected-account and email features described here. LeadScout does not sell Google user data, use it to target advertisements, or use it to develop or train general-purpose AI or machine-learning models.

LeadScout's use and transfer of Google API information is limited to the user-facing functionality described in this policy and is subject to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace user data policy. This is a description of data handling, not a claim of Google verification or approval.

AI-assisted pitch preparation uses the sender's supplied profile and project information and public business research. The current drafting workflow does not send received Gmail message bodies to an AI model. Reply checks save plain-text responses for the private Inbox and update contact and sending status. Delivery checks process reports to detect failures. No automated response is sent to a reply.

Human access to Google-derived information is limited to the account user's use of the service, user-authorised support, necessary security or abuse investigations, or legal requirements.

6. Providers, recipients and transfers

Information is shared only as necessary to deliver the requested features, operate hosting and storage, handle user-authorised support, protect the service, or meet legal obligations.

These providers may process information in countries outside the sender's or recipient's country. Their processing is also governed by their applicable terms and privacy practices. LeadScout does not sell personal information or provide contact lists to data brokers.

7. Storage and retention

Profile details, contacts, drafts, sent-message records, crawl activity and uploaded files remain in the private application's storage until removed through an available control or handled through a deletion request. There is currently no automatic time-based purge of all workspace records. Replacing a CV changes the active attachment; removal of older uploads can be requested.

OAuth client credentials and mailbox tokens are encrypted before database storage. Raw token values are not returned in dashboard settings responses. Plain-text replies from tracked outreach conversations are stored as private application records, including local read status, until removed through a deletion request. Delivery-report content is processed temporarily. Inbox read status does not mark messages read in Gmail.

Minimal suppression information may be retained to honour opt-outs and prevent further contact. Security, legal or provider backup records may remain for the period required for those purposes or the provider's retention process.

8. Your choices and deletion requests

• Pause sending and change the daily sending limit in the dashboard.
• Turn off automatic approval to keep newly prepared pitches as drafts.
• Edit your profile, portfolio, signature and attachment preference.
• Mark a business as do not contact. Recipients may reply “no thanks” or otherwise request no further contact.
• Disconnect Gmail in the dashboard or revoke access in your Google Account.
• Email ekamcy@gmail.com to request access, correction or deletion of your profile, CV uploads, contacts or outreach history.

For a data request, identify the account or workspace and what you want removed. Do not send passwords, API keys or Google access tokens. Reasonable identity checks may be needed before private records are disclosed or deleted. Deleting application records cannot recall copies of emails already sent or records independently held by recipients.

9. This public website

These public pages do not use advertising trackers, third-party analytics scripts, newsletter forms or marketing cookies. Selecting an email contact link opens your email application; it does not automatically send a message. The private dashboard and Google sign-in are separate services and may use essential authentication cookies. Hosting providers may keep delivery and security logs.

10. Updates and contact

We will update this page when the features or data practices materially change and show the new date above. For questions, concerns or a recipient opt-out request, contact ekamcy@gmail.com. If a request relates to an email received from another sender using the service, include the sender address and relevant message details without forwarding unnecessary personal information.