Privacy Policy

LeadWithEmail requests two Gmail scopes: https://www.googleapis.com/auth/gmail.send and https://www.googleapis.com/auth/gmail.readonly. gmail.send lets us send the emails you approve from your Gmail account; gmail.readonly lets us read replies from contacts you have emailed. We do not modify, label, archive, delete, or mark your Gmail messages as read.

We use Gmail access only to:

• Send outreach emails from your Gmail account to contacts you specify
• Check whether contacts have replied (by polling your inbox for messages from tracked contacts)
• Show the reply/conversation and draft AI-assisted reply suggestions you review before sending

We do not use Gmail access to:

• Read, scan, or analyze your wider mailbox, drafts, or messages from senders you have not contacted through LeadWithEmail
• Access contacts, calendar, or any Google service other than Gmail
• Sell your email data, or share it except with the AI provider that drafts a suggested reply (see Section 7) and as needed to operate the Service

Note: we do store a short snippet of replies from contacts you have emailed (see "Email send logs & reply snippets" above), and that snippet is sent to our AI provider to draft a suggested reply that you review before sending. AI never sends email automatically.

Each email sent through LeadWithEmail contains a small image — either your uploaded brand logo or a 1×1 transparent pixel — hosted at leadwithemail.com/track/[token]. When a recipient's email client loads this image, we record that the email was opened.

This is standard email tracking practice. The pixel is embedded in the HTML version of the email. Recipients using plain-text email clients will not trigger tracking.

The tracking token links to the specific email sent. No personal data about the recipient's device, IP address, or location is collected beyond the open event timestamp.

Apple Mail Privacy Protection (MPP), introduced in iOS 15 and macOS Monterey, causes Apple's mail servers to pre-fetch tracking pixels automatically — even if the recipient never actually opens the email. As of 2025, Apple Mail accounts for approximately 58% of all email client market share.

To reduce false positives, we apply the following filters:

• Opens recorded within 45 seconds of send are flagged as likely automated (bot or MPP scan) and excluded from open rate calculations
• Domains icloud.com, me.com, and mac.com receive automatic Apple MPP consideration

For this reason, all open data in LeadWithEmail is labeled "Estimated Opens" throughout the platform. Reply rate — not open rate — is the primary and most reliable success metric we emphasize.

We retain your data for as long as your account is active.

Delete it yourself: while signed in, go to Settings → Account → Delete account to permanently remove your account and tenant data (contacts, campaigns, sent-email and reply records, hot leads, tracking events, and stored Gmail tokens). You can also Disconnect Gmail from the same screen without deleting your account.

Or request deletion: email [email protected] with the subject "Data Deletion Request" and we will delete your account and associated data within 30 days. Some records may be retained for legal, billing, or security reasons — see our Data Deletion page.

You can also revoke Gmail access at any time from your Google account at myaccount.google.com/permissions. Revoking access does not delete your LeadWithEmail account, but it will stop email sends until you reconnect.

Gmail OAuth tokens are encrypted at rest using Fernet symmetric encryption (AES-128-CBC). The encryption key is stored separately from the database.

All data is transmitted over HTTPS. Database access is restricted by network rules and authenticated credentials.

If you believe you have discovered a security vulnerability, please email [email protected] immediately.