Privacy Policy

Effective November 9, 2026

Draft: some company details are still being finalised and this document is awaiting legal review.

This policy explains how [Company legal name] (“Varilead”, “we”, “us”) handles personal data. It covers two groups of people: our users, who have Varilead accounts, and the people whose business contact details appear in our users' lead lists. If you're in the second group and want your details removed, you can ask here.

1. Information about users

Account details: your name, email address, a one-way hash of your password (never the password itself), and your Google account ID if you sign in with Google.
What you put into Varilead: lead lists you import, notes, outreach settings, mailing address, drafts and CRM history.
Usage and technical data: IP address, browser type, the pages and actions you use, and request logs we keep for security and troubleshooting.
Sign-up checks: when you create an account, Cloudflare Turnstile checks your browser to stop automated sign-ups.

We don't collect payment details today. If paid plans launch, payments will be handled by a payment processor and we won't store full card numbers.

2. Information about people in lead lists

Varilead users research local businesses. Doing that involves some personal data about people who work at those businesses:

What: business names, addresses, phone numbers and websites; business email addresses and the names of owners or staff published on the business's own website; automated findings about the website and a screenshot of it; and notes our users add.
Where it comes from: lists our users upload, public web search results, and the business's own public website, read by VarileadBot.
Why: so our users can find businesses that might need their services and contact them about it. Each user decides which businesses to contact and is responsible for doing so lawfully; for this data, we act on our users' behalf.

We don't sell this data, combine it across accounts, or use it to market our own services to those businesses. Each user's lead data is visible only to that user.

3. How we use information

To run Varilead: find websites, check them, find contact details and draft emails.
To keep it secure and prevent abuse, including rate limits and the do-not-contact list.
To send account emails such as verification, password resets and important notices.
To understand, in aggregate, how Varilead is used so we can improve it.
To meet legal obligations and enforce our terms.

AI drafting. When you ask Varilead to write an email, the lead's details and your outreach settings are sent to our AI provider, Anthropic, which processes them under commercial terms that don't allow them to be used to train its models.

Service providers that run parts of Varilead for us, listed on the Subprocessors page, bound by contracts to protect the data.
Authorities, when the law requires it, or to protect rights, safety or property.
A buyer or successor, if Varilead is sold or merged, under this policy.

We don't sell personal data and don't share it for targeted advertising.

5. Cookies

Varilead uses only the cookies it needs to work, such as the one that keeps you signed in. There are no advertising or analytics cookies. Details are on the Cookies page.

6. How long we keep it

Account data: until you delete your account.
Leads: deleted automatically after 24 months with no activity, or earlier when you delete them or your account. Screenshots are deleted with their leads.
Search logs: 180 days. Older versions of website audits: 30 days.
Server logs: a short period, typically no more than 30 days.
Do-not-contact entries (an email address and the date): kept for as long as needed to keep honouring the request.
Deleted data can remain in encrypted database backups for up to 30 days.

7. Security

Data is encrypted in transit, passwords are stored as one-way hashes, third-party API keys you save are encrypted at rest, and access to production systems is limited. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires. Security researchers can find our contact details in security.txt.

8. Your choices and rights

Users can export their data and delete their account from the Account page, and update their details at any time. We only send account emails, not marketing.

People in lead lists can ask us to remove their email address. Once you confirm by clicking the link we send, we delete that address from every Varilead account and stop it from being added again. To ask about other details, write to privacy@varilead.com.

Depending on where you live, you may have rights to access, correct, delete or get a copy of your personal data, and to appeal a decision about a request. We honour these requests from everyone, wherever they live. Write to privacy@varilead.com; we'll reply within 30 days and may need to confirm your identity first.

9. Where data is stored

Varilead is offered in the United States, and data is stored and processed there.

10. Children

Varilead isn't for anyone under 18, and we don't knowingly collect their data.

11. Changes

We'll update the date at the top when this policy changes, and email users before material changes take effect.

12. Contact

[Company legal name], [Business mailing address]. Privacy questions: privacy@varilead.com.