Privacy Policy

LeadBoffin is operated by Sako Dev. For data you give us about yourself (your account), we are the data controller. For personal data in the business leads you collect — and in the contact lists you upload, where the optional outreach features are enabled — you are the controller and we process it on your behalf. Contact: support@sakodev.com.

• Account data — your name, email address, and a salted hash of your password (we can never read the password itself).
• Workspace data — the leads and contacts you discover or save, the searches you run, and any messages you generate (or, where outreach is enabled on your deployment, send) and their replies and statistics.
• Connection credentials — API keys you choose to store, and SMTP/IMAP passwords if outreach is enabled. These are encrypted at rest (AES-256-GCM) and never returned to the browser once saved.
• Engagement signals — where outreach is enabled, opens, link clicks, replies, bounces and unsubscribes for emails you send, so you can see results. This deployment sends no email, so it records none of this.
• Technical basics — IP addresses in server logs and rate-limit records, kept briefly for security.

We do not sell data or run third-party advertising or analytics trackers.

• to operate the product: run your searches, fetch each business's public details, audit its website, and — where outreach is enabled — send your campaigns, poll your inbox for replies and show statistics;
• to generate message drafts via the AI provider configured for your account;
• to send transactional email (welcome, email verification, password reset);
• to protect the Service: rate limiting, abuse prevention, enforcing usage limits;
• to respond when you contact support.

• Public data sources — the businesses returned by a search come from open map data (OpenStreetMap), the official UK company register, and a web-search provider that reads publicly published business pages. Nothing about you is sent to them beyond the niche and location you typed.
• AI providers (Anthropic, Groq) — receive the briefs and business details needed to draft a message. With your own API key, your provider relationship applies; with the included AI, requests go through our key.
• Your email provider — where outreach is enabled, messages are sent through the SMTP server you connect and replies are read from the IMAP inbox you connect. This deployment does not connect to a mailbox.
• Payment providers — if you purchase a paid plan, the provider and its privacy terms are disclosed before payment. Card or bank details are processed by that provider; we do not store full card numbers.
• Hosting — the application and database run on servers we rent in the EU.

The leads this Service returns are businesses, and the contact details on them are the ones those businesses publish publicly. We do not sell personal data and we do not compile consumer lists. Where outreach is enabled and you send to those contacts, you are the sender: every message carries a one-click unsubscribe link, opting out is enforced permanently and automatically, and you may not remove or work around it. If you received unwanted contact that references LeadBoffin, contact us at support@sakodev.com and we will investigate.

Account and separate administrator sessions use necessary cookies. A preference cookie remembers your analytics choice for 90 days. Only after you allow pilot analytics, a first-party journey cookie lasts up to 30 days. It connects preview/page views to signup, searches, result actions and upgrade-link interest; after signup it links to your account. No advertising or cross-site analytics cookies.

Optional pilot journey records contain event types, times, audience and owned search references, not passwords, contact payloads, full URLs or referrers. They are removed after 90 days from journey creation. Withdraw using Analytics preferences at the bottom of the page to delete that browser journey from the live database immediately. Existing operational search/account records are separate. Your account data is kept while your account is active. Deleting your account removes your contacts, campaigns, messages, settings, and credentials from the live database. Server backups age out on a rolling schedule. To request deletion or a copy of your data, email support@sakodev.com.

Passwords are hashed with scrypt; stored credentials are encrypted with AES-256-GCM; the Service runs over HTTPS; access to production systems is limited to the operator. No internet service can promise perfect security, but security decisions in LeadBoffin err on the conservative side.

Depending on where you live (e.g. GDPR, UK GDPR, CCPA), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict processing. Email us and we will honor these requests for the data we control. For contact data uploaded by one of our users, we will refer the request to that user, as they are the controller.

We will post updates here and, for material changes, notify you by email or in-app. See also our Terms of Service.