LeadScore LogoLeadScoreStart free trial

Privacy Policy

Last updated: September 10, 2026 (v2026-09-01)

1. Who We Are

LeadScore ("we", "us", "our") is an AI-powered lead scoring service for freelancers and agencies. We capture form submissions from your websites, score them using AI, and route notifications to you. This Privacy Policy explains what data we collect, how we use it, and your rights.

2. Data We Collect

Account data: Your name and email address from Google sign-in (we never see or store your Google password). We use this to create and manage your account.

Form submission data: When a visitor submits a form on a website with the LeadScore script installed, we receive the form field data (e.g., name, email, message, phone, budget). This data is stored, scored by AI, and displayed in your dashboard.

Technical data: IP addresses (for rate limiting and security), browser user-agent, and session cookies. We also use privacy-friendly product analytics (PostHog), consent-based in the EEA/UK/CH, on by default with opt-out elsewhere, see our cookie policy.

Billing data: Email address and subscription plan, processed through Dodo Payments. We do not store your credit card number, that is handled entirely by Dodo Payments.

3. How We Use Your Data

  • To score, summarize, and classify form submissions using AI
  • To send you notifications (email, Slack) when new leads arrive
  • To display submissions and analytics in your dashboard
  • To enforce rate limits, subscription limits, and prevent abuse
  • To send account-related emails (trial reminders)
  • To provide CSV export of your submissions

4. AI Processing

Form submission data is sent to our AI scoring providers (Groq and OpenRouter) for AI analysis (scoring, classification, summary, suggested reply). They process the data under their data processing terms. We send only the form field data, no LeadScore account credentials or internal data are shared with them.

5. Third-Party Services (subprocessors)

  • Groq. AI scoring of form submissions (form field data only; US processing under Groq's DPA)
  • OpenRouter. Fallback AI scoring of form submissions (form field data only; routes to model providers under OpenRouter's DPA)
  • Brevo. Transactional email delivery (recipient address + message content; EU infrastructure)
  • Dodo Payments. Subscription billing (email, name, plan; payments handled entirely by Dodo)
  • Cloudflare. Hosting, DNS, D1 database, Turnstile bot protection, and security logs
  • PostHog. Product analytics: opt-in via banner in the EEA/UK/CH, on by default with footer opt-out elsewhere (page views and feature usage only; no lead form contents; US hosting)
  • Google OAuth. Sign-in (name, email, profile photo)

Full list with purposes and locations: subprocessors. Our data processing addendum: DPA. We share only the minimum data necessary for each service to perform its function.

6. Data Retention

We retain your form submissions and account data for as long as your account is active. If you delete a site, all submissions for that site are deleted immediately. If you request account deletion, we delete all your data within 30 days, except a one-way SHA-256 hash of your email address, kept up to 24 months to prevent repeated free trials (our legitimate interest in fraud prevention, GDPR Art. 6(1)(f)). The hash cannot be reversed into your email; object anytime via the contact address below and we will remove it (removal restores trial eligibility). Rate limit logs and verification tokens are automatically purged after their expiry.

7. Cookies

Essential: one session cookie keeps you logged in (required for the service; not used for cross-site tracking). Analytics: in the EEA, UK, and Switzerland, PostHog cookies are set only after you click "Accept analytics" in the banner; everywhere else, pageview-only analytics run by default with a one-click opt-out via "Cookie settings" in the footer. Autocapture and session recording stay off everywhere, so lead form contents are never collected, only pageviews and explicit events. Details: cookie policy.

8. Data Security

We protect your data with: Google-managed sign-in (no passwords stored), API key hashing (SHA-256), webhook signature verification (HMAC-SHA256), rate limiting on all sensitive endpoints, and HTTPS for all connections. Database access is restricted to the application layer.

9. Your Rights

You have the right to:

  • Access your data, export all submissions via CSV from the dashboard, or file an access request in Settings → Privacy & data
  • Delete your data, delete individual sites and submissions, erase your whole account instantly in Settings → Privacy & data, or email us
  • Correct your data, update your name from the settings page
  • Object to processing, file an objection in Settings → Privacy & data, or cancel and delete at any time
  • Data portability, export your submissions in CSV format at any time

Self-serve first: Settings → Privacy & data. Or contact us at hello@leadscore.icu We respond within 30 days (GDPR Art. 12).

10. GDPR and CCPA

If you are located in the European Economic Area (EEA) or California, you have additional rights under GDPR or CCPA respectively. We act as a data processor for form submissions collected on your websites, and as a data controller for your account data. We do not sell personal data.

11. Children's Privacy

LeadScore is not intended for use by anyone under 18. We do not knowingly collect data from children. If you believe we have collected data from a minor, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Continued use after changes constitutes acceptance.

13. Contact

Questions about this Privacy Policy? Contact us at hello@leadscore.icu.