Privacy Policy

Information you provide

This can include your name, email address, login details, business settings, lead names and contact details, notes, prompts, generated drafts, suppression choices, and campaign settings.

If you connect a mailbox, RichLead may store messages and message details needed to show your inbox and link replies to leads. If you connect an AI provider or mailbox, RichLead stores the credentials or authorization tokens needed to use that connection.

How information is used

We use this information to operate your account, manage leads, create drafts when requested, send or sync email through the mailbox you connect, display dashboard activity, protect the service, and respond to support requests.

When you request AI generation, relevant lead details and your instructions are sent to the AI API provider configured for your workspace. Available integrations include OpenAI, Anthropic, Groq and DeepSeek. Sharing Gmail content has separate controls described below; connecting an AI key alone does not authorize this sharing.

A workspace can enable email-open tracking for a sending mailbox. Future emails from that mailbox include an image with a random identifier. RichLead records its first load to show an estimated open status. Tracking records do not include IP addresses, location or browser information. Image blocking, caching and privacy services can prevent or trigger loads, so this signal does not prove a person read an email.

RichLead also collects limited first-party usage analytics, including page paths, named landing-page link clicks, an anonymous session identifier, and event times. We use these events to understand traffic and improve the service. Analytics records do not include message contents, passwords, or IP addresses, and only RichLead administrators can view them.

Google and Gmail data

Connecting Google requests your email address, permission to send email, and permission to read email. Background synchronization inspects routing headers and retrieves message content for conversations matching your saved contacts, plus delivery reports. RichLead stores message subjects, addresses, bodies, timestamps, provider identifiers and conversation relationships to provide the inbox, reply notifications and campaign history. It does not request access to Drive, Contacts or Calendar.

AI sharing is off until the workspace owner chooses Agree and continue in the AI agreement, shown after sign-in or when AI or Autopilot is requested. Relevant lead and business details, message subjects, email and SMS bodies and conversation history, including Gmail content, are sent to the selected provider API for drafts, replies, summaries, intent classification and interest scoring. The agreement covers OpenAI, Anthropic, Groq and DeepSeek; each request uses only the selected provider. Background analysis and Autopilot can use these features without a separate click for each message. Material changes to the data use or supported provider list require a new agreement version.

Withdraw all AI processing in Account profile > AI permissions, or Gmail AI sharing separately in Gmail privacy & AI. Basic inbox reading and manual replies remain available. An already transmitted request cannot be recalled; RichLead discards its result if permission is withdrawn before it completes. Use provider API arrangements and account settings that exclude this content from general model training; the agreement does not override provider terms or Google restrictions. RichLead does not use Google data to train or improve general-purpose AI models, sell it, or use it for advertising or credit decisions.

RichLead's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Authorized customer teammates can access conversations according to workspace permissions. RichLead personnel do not read Google message content except with your documented permission for specific assistance, as necessary for security investigations, or where required by law. Aggregate operational reporting does not require reading your message content.

SMS communications

If you connect Twilio, RichLead uses your chosen Twilio account and number to send and receive SMS. Phone numbers and message content are transferred to Twilio and the relevant carriers. RichLead stores SMS conversations, delivery states, opt-in records and per-user read state. Authorized teammates can access this data according to their SMS permissions.

SMS permission is separate from email permission. You are responsible for recording the recipient's actual SMS opt-in and completing Twilio's applicable sender registration. STOP blocks further sending. An inbound inquiry allows a response but does not automatically authorize campaigns. When you separately agree to AI processing, relevant SMS text and conversation history may be sent to the AI provider selected for SMS or that campaign. Automatic replies require the sender's automatic-reply option and Autopilot to be enabled.

Storage, sharing, and security

Account data is used to provide RichLead to you. We do not sell your personal information. Information may be processed by hosting and service providers that help operate RichLead, or disclosed when required to protect users, the service, or comply with law.

Connected API credentials, mailbox passwords, and OAuth tokens are encrypted by the application before storage. We also use account authentication and access controls, but no online service can guarantee perfect security.

Retention and your choices

Account content is retained while needed for the workspace features you use. Removing a Google mailbox stops its use, revokes its authorization or queues a retry, and removes its locally synced messages and related analysis. Senders > Gmail privacy & AI > Remove Gmail data also removes disconnected Google copies and all Google mailbox connections in that workspace. It retains your lead records and messages held in Gmail. Revocation retries retain only an encrypted credential until Google confirms revocation.

New encrypted deployment backups expire after 30 days. Existing legacy backups and infrastructure encryption require operator review; we do not claim that a local data deletion instantly removes every backup copy. Backups are restricted to disaster recovery. A restoration must reapply recorded deletion requests before serving restored user data. Data already received by an external provider remains subject to that provider's applicable retention and deletion arrangements.

To request access, correction, or deletion of account data, email support@richlead.site from the email address associated with your account. Some copies may remain in protected backups until those backups expire, or be retained where the law requires it.

Updates and contact

We may update this policy when RichLead's features or data practices change. The current version will be available on this page.

For privacy questions or requests, email support@richlead.site.