Privacy Policy

This Privacy Policy explains how GetLeadsFromAI ("GetLeadsFromAI," "we," "us," or "our") collects, uses, discloses and protects personal information when you visit getleadsfromai.com, request a free scan, create an account, use our application, or otherwise interact with us (the "Service"). It should be read together with our Terms of Service and Cookie Policy.

When we act as a business or controller. For information about our website visitors, free-scan requesters, account holders and prospective customers, GetLeadsFromAI decides how and why the information is used and is responsible for it under this policy.

When we act as a service provider or processor. When our customers install our attribution snippet on their websites, we process information about their website visitors on our customers' behalf and under their instructions, as described in our Data Processing Addendum. In that case the customer's own privacy policy governs, and visitors should direct privacy requests to the business whose website they visited. We will assist our customers in responding.

Information you provide

• Free scan details: business name, website, city, state, business category and your email address.
• Account information: name, email address, password (stored only as a salted hash), workspace name, team member invitations, and two-factor authentication settings.
• Business profile and configuration: business name, address, phone number, website, service areas, categories, competitors, prompts and preferences you enter.
• Billing information: plan, billing name and address, and transaction history. Payment card details are collected and stored directly by our payment processor (Stripe); we receive only limited details such as card brand, last four digits and expiration date.
• Communications: messages you send to support, feedback and survey responses.

Information collected automatically

• Device and log data: IP address, browser and device type, operating system, referring URL, pages viewed, timestamps and error diagnostics. For free scans we store a one-way hash of your IP address for abuse prevention rather than the raw address.
• Campaign data: UTM parameters and referrer information that indicate how you found us.
• Cookies and similar technologies: see section 7 and our Cookie Policy.
• Bot protection: our free-scan form uses Cloudflare Turnstile, which evaluates browser and device signals to distinguish people from automated traffic.

Information from third parties and public sources

• Public business information: details about your business and competitors from your website (for example page titles and structured data) and from business listing sources such as the Google Places API (category, rating, review count, address and hours).
• AI responses: answers generated by AI providers in response to our prompts, which may mention businesses and, occasionally, the names of individuals associated with them.
• Customer-provided data: if an agency adds your business as its client, we receive the information the agency provides.

Attribution snippet data (processed for our customers)

When a customer installs our snippet, we receive data about visits to that customer's website: whether the visit originated from an AI assistant, the landing page and referrer, UTM parameters, approximate country and device type, a pseudonymous visitor identifier stored in a first-party cookie or local storage, and lead events such as form submissions and clicks on phone or email links. By default, for form submissions we receive only field names and a one-way hash of an email address, not field contents. Customers may opt in to fuller capture and are responsible for providing notice and obtaining consent. We do not use fingerprinting or third-party cookies for attribution.

• to provide, operate and maintain the Service, including running scans and generating reports;
• to create and secure accounts, authenticate users and enable two-factor authentication;
• to process payments, manage subscriptions and send invoices and receipts;
• to send transactional messages, including scan results, security alerts, account and billing notices, and service updates;
• to send marketing emails about our products, including follow-ups to a free scan, which you can opt out of at any time;
• to provide customer support and respond to requests;
• to monitor, troubleshoot and improve performance, reliability and features;
• to create aggregated and de-identified statistics, benchmarks and research that do not identify you or any individual;
• to detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms of Service;
• to comply with legal obligations, enforce our agreements and protect rights and safety.

We do not use personal information to make decisions that produce legal or similarly significant effects about individuals based solely on automated processing.

Measuring AI visibility requires asking AI models questions about your market. To do this we send prompts, which typically include your business category, city and sometimes your business name or competitor names, to AI and search-data providers through their commercial APIs, including OpenAI, Perplexity, Google, Anthropic and DataForSEO (see our subprocessor list). We design prompts to contain business information, not personal information about individuals, and we ask that you not enter personal information into prompts.

Under these providers' current commercial API terms, data submitted through their APIs is not used to train their models by default. Providers may retain API data for limited periods for abuse monitoring under their own policies. We store the responses we receive to show you results and history.

We disclose personal information only as described below:

• Service providers and subprocessors that host our infrastructure, deliver email, process payments, protect against bots, store files and backups, track errors, and provide AI and business-data APIs, under contracts that limit their use of the information to providing services to us. See our Subprocessors page.
• Within your workspace: other members of your workspace and, for agency accounts, the agency and client viewers the account owner authorizes.
• Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or court order, or necessary to protect the rights, property or safety of GetLeadsFromAI, our users or the public, or to investigate fraud or security issues.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, subject to this policy's protections.
• With your direction or consent, for example when you connect an integration or ask us to send a report to someone.

We may disclose aggregated or de-identified information that cannot reasonably identify you.

GetLeadsFromAI does not sell personal information, does not "share" personal information for cross-context behavioral advertising, and does not process personal information for targeted advertising, as those terms are defined under U.S. state privacy laws. We have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would require offering a right to limit under California law.

On our own website and application we use only cookies and similar technologies that are necessary to provide the Service: keeping you signed in, protecting forms against bots, preventing fraud and remembering essential preferences. We do not use advertising cookies or third-party analytics trackers. Details are in our Cookie Policy. We honor Global Privacy Control (GPC) browser signals as a valid opt-out request where applicable law requires.

We keep personal information only as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law. Typical periods:

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS), salted password hashing, mandatory two-factor authentication and IP restrictions for administrative access, role-based access controls, tenant isolation, audit logging of administrative actions, and encrypted off-site backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we discover a breach of security affecting your personal information, we will notify affected individuals, customers and regulators as required by law, including within the timeframes required by the Florida Information Protection Act of 2014 (Section 501.171, Florida Statutes), which generally requires notice no later than 30 days after a breach is determined. To report a security vulnerability, contact security@getleadsfromai.com.

Depending on where you live, and subject to legal exceptions, you may have the right to:

• Know and access the personal information we hold about you and how we use it;
• Correct inaccurate personal information;
• Delete personal information we collected from or about you;
• Portability: receive a copy of your information in a portable format;
• Opt out of sale, sharing for targeted advertising and certain profiling (we do not engage in these activities);
• Appeal our decision on your request; and
• Non-discrimination: not be treated differently for exercising your rights.

If you have an account, you can download your data, correct your details, change your email preferences and delete your account yourself in Settings → Account and Settings → Privacy & data. For anything else, or if you don't have an account, use our privacy request form or email privacy@getleadsfromai.com with the subject "Privacy Request." We verify your identity by confirming control of the email address associated with your information and may ask for more information if needed. You may use an authorized agent, who must provide written permission signed by you; we may still ask you to verify your identity directly. We respond within 45 days under U.S. state laws (extendable by 45 days where permitted, with notice) and within one month under the GDPR (see section 12).

Appeals. If we decline your request, you may appeal by replying to our decision with the subject "Privacy Appeal." We will respond within the period required by your state's law. If you are not satisfied, you may contact your state attorney general.

If your information was collected by one of our customers through our snippet, please contact that business directly. If you contact us, we will forward your request to the customer where we can identify it.

Florida. We respect the rights described in Florida's privacy and data security laws. The Florida Digital Bill of Rights (Sections 501.701 to 501.722, Florida Statutes) applies to controllers that meet specific revenue and activity thresholds. Regardless of whether it applies to us, we do not sell personal information, do not sell sensitive or biometric data, and offer the access, correction, deletion and portability choices described above to all U.S. users.

California notice at collection. In the past 12 months we collected these categories of personal information under the California Consumer Privacy Act, as amended: identifiers (such as name, email, IP address and account ID); customer records (such as billing name and address); commercial information (such as plan and purchase history); internet or electronic network activity (such as pages viewed and interactions); approximate geolocation derived from IP address; professional information (such as your business and role); and inferences limited to our scoring of business visibility. We collect these from you, your devices, our customers and public sources, for the business purposes in section 3, and disclose them to the categories of recipients in section 5. Retention periods are in section 8. We do not sell or share personal information or use sensitive personal information to infer characteristics.

Other states. Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, may exercise the rights in section 10 to the extent those laws apply.

Nevada. We do not sell covered information as defined in Nevada law.

If you are in the European Economic Area, the United Kingdom or Switzerland, the EU General Data Protection Regulation, the UK GDPR or the Swiss Federal Act on Data Protection apply to our handling of your personal data. For our own purposes, GetLeadsFromAI is the controller. For data our customers collect on their websites with our snippet, the customer is the controller and we are their processor under our Data Processing Addendum.

Legal bases. We process personal data only where the law allows it:

Your rights. You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including, at any time, to processing based on our legitimate interests and to direct marketing), to data portability, and to withdraw consent at any time where we rely on consent, without affecting processing before you withdrew it. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

How to exercise them. Use the self-service tools in your account settings, our privacy request form, or email privacy@getleadsfromai.com. We respond within one month of verifying your request; for complex or numerous requests we may extend this by up to two further months, and we will tell you why within the first month. Requests are free unless they are manifestly unfounded or excessive.

Complaints. You can lodge a complaint with the data protection authority where you live or work, or where you believe an infringement took place. In the UK this is the Information Commissioner's Office (ico.org.uk); in Switzerland, the FDPIC. We would appreciate the chance to address your concern first.

Representatives. For any GDPR matter, contact us at privacy@getleadsfromai.com.

We may send you emails about our products, including a follow-up sequence after a free scan. Every marketing email includes an unsubscribe link, and we honor opt-outs promptly, consistent with the CAN-SPAM Act. Unsubscribing does not stop transactional messages about your account, security, billing or scans you requested. We do not send marketing text messages or make telemarketing calls.

The Service is intended for business use by adults. We do not knowingly collect personal information from children under 13 (or under 18 where required by law). If you believe a child has provided us personal information, contact privacy@getleadsfromai.com and we will delete it.

GetLeadsFromAI is based in the United States, and the Service is intended for U.S. businesses. Information we collect is stored and processed in the United States and in other countries where our service providers operate, which may have data protection laws different from those of your country. When we transfer personal data from the EEA, the UK or Switzerland, we rely on the European Commission's standard contractual clauses (with the UK Addendum and Swiss amendments where they apply) or, for providers certified under it, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, together with the safeguards described in our Data Processing Addendum. You can ask us for a copy of the relevant safeguards.

We may update this policy from time to time. If we make material changes, we will notify you by email or in-app notice at least 30 days before they take effect, and we will obtain consent where required by law. The "last updated" date shows the latest revision.

For privacy questions or requests, contact GetLeadsFromAI at privacy@getleadsfromai.com. Formal notices may be sent by email to legal@getleadsfromai.com.