Privacy Policy

1. Controller

The controller of your personal data is AUREOVOLUS - UNIPESSOAL LDA (NIPC 519414772), incorporated in Portugal, with its registered office at Av. Brasilia 21, 3 Dto, 2780-209 Oeiras, Portugal. Contact for all privacy matters: hello@leadprysm.com.

2. Data we collect about users

• Account data — name, email address, and a hashed password; if you sign in with Google, the name and email Google shares with us.
• Billing data — subscription status and invoices. Payments are processed by Stripe; we never see or store your full card details.
• Usage data — actions in the app (e.g. searches, exports) and technical logs (IP address, browser type) needed to operate and secure the Service. For each account we also keep a short activity log: the most recent sign-ins, startups and contacts opened, startups saved, email drafts written and calls made from a connected AI app, with a count of each. It holds no IP address or device information.
• Newsletter data — if you subscribe to our newsletter, your email address and the date you opted in. You can unsubscribe from any email or by emailing us.
• Outreach data — if you connect a mailbox to send email sequences: its address, the server settings and the app password (stored encrypted), your sender name, company, postal address and signature, the sequences you write, the people you add (including contacts you import from a CSV or from your own Apollo account, whose API key we store encrypted), and each email sent with its delivery result. Where your provider allows it, we read the new messages in that inbox to spot replies, bounces and unsubscribe requests to the emails sent through LeadPrysm; we keep only the resulting status, not the content of your other mail.

We use strictly necessary storage to run the Service (sign-in/session, security, and your saved preferences). We also use Google Analytics via Google Consent Mode — it sets no cookies and does no personal tracking until you accept analytics — and we load Google Sign-In only if you allow it. We run no advertising cookies. You can review and change your choices at any time via Cookie settings in the footer. See our Cookie Policy for the full list.

3. Purposes and legal bases

• Providing the Service (account, features, support, sending the emails you set up in Outreach) — performance of a contract (Art. 6(1)(b) GDPR).
• Billing and tax compliance — legal obligation (Art. 6(1)(c)).
• Security, abuse prevention, service improvement — legitimate interests (Art. 6(1)(f)).
• Product emails to account holders (e.g. weekly digest) — performance of a contract or legitimate interest; you can opt out at any time.
• Newsletter to public subscribers — your consent (Art. 6(1)(a)); withdraw anytime via the unsubscribe link.
• Analytics (Google Analytics) and the Google Sign-In script — your consent (Art. 6(1)(a)); withdraw anytime via Cookie settings.

4. Data about people listed in our database

LeadPrysm contains business information about startups that have recently raised funding, and about their founders and executives: name, role, company, business email address, a link to a public professional profile (such as LinkedIn), and the company's funding information. We hold no private or sensitive data about these people.

Sources.The company's public funding announcement and public filings (for example SEC Form D, which names a company's officers), the company's own website, public news coverage. Email addresses we work out from the person's name and the company's web domain, and confirm with an email verification service before we use them (the service checks that the mailbox exists; nothing is sent to it).

Purpose and legal basis. LeadPrysm lists recently funded startups so that businesses offering relevant services can contact them. Our subscribers can see the name, role and business contact details of people listed, and may email them about their services, including from their own mailbox through our sending tool. Every such email names its sender, says where the address came from and has an unsubscribe link; we never send it to anyone who unsubscribed from that sender or asked us to remove them, and we limit how many subscribers may email the same person each month. We process this data on the basis of our legitimate interest in providing business-to-business information (Art. 6(1)(f) GDPR), which we have assessed against the interests of the people listed.

How we tell you. If you work at a company based in the European Economic Area, the United Kingdom or Switzerland and we hold your business email address, we send you a one-time notice by email within one month of adding you (Art. 14 GDPR), explaining where your data came from and how to have it removed. We may send the same notice to people elsewhere when their address has been verified. The notice comes from a no-reply address; questions go to hello@leadprysm.com.

Removal and objection. You can access, correct or delete your data, and object to this processing, at any time: use the removal link in the notice, or write to hello@leadprysm.com. We remove your record without undue delay and at the latest within one month, including from saved lists in our subscribers' accounts. To make sure you are not added again from another source, we keep a one-way hash of your email address (not the address itself) on a do-not-add list.

Emails sent by our subscribers. When a subscriber emails you through our sending tool, that subscriber is the controller of the email and decides what it says; we send it on their behalf as their processor and keep a record of it. To stop one sender, use the unsubscribe link in their email. To stop all of them, ask us to remove your details.

5. Recipients and processors

We share data only with service providers that help us run the Service:

• Stripe — payment processing;
• Google — sign-in (Google Identity Services) and Google Analytics, each loaded only with your consent;
• Microsoft Azure — hosting, in the West Europe region (Netherlands);
• Ahrefs — cookieless web analytics (legitimate interest, no personal identifiers);
• Resend — delivery of account, product, and newsletter emails, and of privacy notices;
• OpenAI and Google (Gemini API) — AI processing of company information: summarising funding announcements and websites, classifying companies, and drafting suggested emails for subscribers. Data sent to these services is not used to train their models;
• Apollo.io — business contact data provider. Until October 2026 it supplied founder and executive contact details for the database; records collected then remain. Today we use it only to find business contacts for LeadPrysm's own marketing emails to agencies and service providers;
• Bouncer (EU; or MillionVerifier) — email verification: checks that a business email address exists before we use it;
• Cloudflare — DNS lookups of a sender's domain (no personal data) when you connect a mailbox;
• Your own email provider — if you use Outreach, your emails are sent through, and replies read from, the mailbox you connect (for example Google or Microsoft), under your agreement with that provider.

Company logos shown in the Service are fetched by our servers and served from our own domain, so your browser does not call third-party logo hosts.

Where a provider processes data outside the EEA (e.g. Stripe, OpenAI or Apollo.io in the United States), transfers are protected by an adequacy decision (EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

AI apps you connect. If you connect LeadPrysm to an AI app such as Claude or ChatGPT, that app receives the data you ask it for, including business contact details within your plan, and handles it under its own terms as a separate controller chosen by you. The connection is read-only, we log how often it is used (for plan limits), and you can disconnect it at any time in Settings.

6. Retention

• Account data — for the life of the account and up to 30 days after deletion;
• Billing records — 10 years, as required by Portuguese tax law;
• Technical logs — up to 12 months;
• The account activity log — the last 20 entries of each kind and their counts, for the life of the account;
• Agency listings — while listed, and removed with the account; requests sent to an agency through its page (your name, email, company, budget and message) are forwarded to that agency and kept for up to 24 months;
• Projects posted on the project board — the project, your name and email (never shown publicly) and the proposals agencies send, for as long as the project is open and up to 24 months after it closes; your email goes to the three agencies we match only if you allow them to write to you directly, and to an agency you reply to;
• Contact details of people listed in our database — while current, and no longer than 24 months without being confirmed again, or until a valid objection or erasure request;
• Company records (funding information) — while the information remains current and relevant;
• Messages sent through the message button on our site — your email address and message, kept to answer you and for up to 24 months after;
• Outreach — the mailbox password until you remove the mailbox; emails sent through Outreach and their status for up to 24 months, to answer complaints and keep unsubscribes working; the list of people who unsubscribed from a sender or whose address bounced, for as long as needed to honour it;
• Privacy notice records — the date we notified you, the wording used and the delivery result, kept as evidence of compliance; after a removal only a masked form of the address is kept;
• The do-not-add list — a one-way hash of the email address, kept for as long as needed to honour your objection.

7. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Write to hello@leadprysm.com. You also have the right to lodge a complaint with the Portuguese supervisory authority, CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt), or the authority of your country of residence.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit (HTTPS), hashed passwords, encryption of connected mailbox passwords (AES-256), and access controls. No system is perfectly secure; we will notify you and the CNPD of any breach where legally required.

9. Automated decision-making

We use AI to enrich company records, draft suggested emails and write the opening line of an outreach email from the facts we hold about a company. We do not make automated decisions about you that produce legal or similarly significant effects.

10. Changes

We may update this policy as the Service evolves; material changes will be announced by email or in-app. The date above always reflects the latest version.