This policy explains what information HeyLeads (the website at heyleads.so and the app at app.heyleads.so) collects, why we collect it, who we share it with, and the choices you have. It sits alongside our Terms and Conditions.
1. What we collect
Account information. Your name, work email and a password (stored only as a one-way hash by our sign-in provider). If you sign in with Google, we receive your name, email address and profile picture from Google, and nothing else.
Workspace information. The things you put into HeyLeads to do your job: the LinkedIn accounts you connect (including the session details needed to act on them, which are stored encrypted), the leads you import or find (such as name, job title, company, location, LinkedIn profile link, email and photo), your campaigns, the messages you send and the replies you receive, templates, notes and voice or file attachments.
Usage and technical information. Basic logs such as your IP address, browser and device type, pages and actions used, and error reports, so we can run, secure and fix the service.
Payment information. If you buy a plan, card details are handled by our payment provider. We don't store card numbers.
2. How we use it
- to provide HeyLeads: sign you in, run your campaigns, show your inbox and results;
- to keep the service secure, prevent abuse and fix problems;
- to send you the emails the service needs, such as sign-in codes, password resets, invitations and billing notices;
- to improve the product and to give support when you ask for it;
- to meet legal obligations.
We don't sell your data, and we don't use it to show advertising.
3. Google sign-in and Google user data
If you choose Continue with Google, HeyLeads asks Google only for your basic profile: your name, email address and profile picture. We use them to create and recognise your account and to show your name and photo in the app. We don't request access to your Gmail, Drive, Calendar, contacts or any other Google data.
HeyLeads' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, and we don't let people read it except where needed to give you support, keep the service secure or comply with the law.
You can remove HeyLeads' access at any time from your Google Account permissions page.
4. Who we share it with
We use trusted service providers who process data for us and only on our instructions:
- Hosting and database: Railway runs our servers, and Supabase provides our database, sign-in and file storage.
- Email delivery: Resend delivers the emails we send you.
- AI: the text involved in an AI feature (for example a lead's name and headline, or a message) is processed by AI model providers to draft and sort messages.
- Network providers: to keep each connected LinkedIn account on a stable address, its traffic can pass through proxy providers.
- Payments: our payment provider, if you buy a plan.
We may also disclose information if the law requires it, or to protect the rights, safety and security of our users and the service. If HeyLeads is ever part of a merger or sale, we'll tell you before your data is handed over or becomes subject to a different policy.
5. Your leads' information
The people in your lists are your contacts. For their information, you decide why and how it is used, and we process it on your behalf to run your outreach. You are responsible for having a lawful basis to contact them and for honouring their opt-outs (see section 5 of the Terms). We don't use your leads for our own marketing and we don't combine them with other customers' data.
6. The HeyLeads Chrome extension
The HeyLeads Chrome extension adds a button to LinkedIn posts and lets you connect a LinkedIn account to HeyLeads. This section explains what it does with data. It works only on linkedin.com and app.heyleads.so, and it does not read any other website.
What it reads on LinkedIn. When you open the panel on a post, it reads the people who reacted to or commented on that post, as shown in your own signed-in LinkedIn session: their name, headline (usually their job title), current company, profile link and photo, the type of reaction, and the text of their comment. It reads only, and it never likes, comments, messages, connects or posts for you. The people shown stay in your browser until you choose to add them.
What it sends to HeyLeads. When you add people to a list, the extension sends the people you chose (the details above and the post they came from) to your HeyLeads workspace, over an encrypted connection. Nothing is sent to HeyLeads about people you don't add. It also contacts HeyLeads to check that your connection is still valid and to see which of the people shown are already in your workspace.
The LinkedIn session when you press Connect. Only when you choose to connect a LinkedIn account, the extension reads three of your LinkedIn cookies (li_at, JSESSIONID and, if present, bcookie) and sends them to HeyLeads so that account can be connected to your workspace. It does not keep them: they are not saved by the extension after they are sent. On our side they are stored encrypted, as described in section 7.
What is stored on your device. The extension keeps in your browser: a HeyLeads access token that you can revoke at any time (from the extension or in your HeyLeads settings), the name of your workspace, a small count of how many posts it has read today, and your panel choices, such as which lists or companies you chose to skip. It does not store the LinkedIn cookies or your LinkedIn password.
What we do not do. We don't sell this data, we don't use it for advertising or credit decisions, and we use it only to provide the extension's single purpose: showing who engaged with a LinkedIn post and adding the people you choose to your HeyLeads lists. Once people are in your lists they are covered by section 5. You can remove the extension at any time, and you can delete your workspace's data as described in section 8. HeyLeads is not affiliated with or endorsed by LinkedIn.
7. Security
Each workspace's data is kept separate from every other customer's by database access rules. Connections are encrypted in transit, and sensitive details such as a LinkedIn session are encrypted at rest. Access to production systems is limited to the people who need it. No system is perfectly secure, so please use a strong, unique password and tell us at once if you suspect a problem.
8. How long we keep it, and deleting it
We keep your information while your account is active. You can delete a workspace yourself in Settings: that removes its campaigns, leads, inbox, connected accounts and stored files. You can ask us to delete your account entirely, or to export your data, by emailing sales@heyleads.so. Copies in backups are removed as the backups expire, and we keep what the law requires us to keep (for example billing records).
9. Where your data is stored
Our database is in Singapore, and our servers run in Singapore and the United States. Our providers may process data in other countries too. Where the law requires it, we rely on appropriate safeguards for those transfers.
10. Your choices and rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to complain to your local data-protection authority. To use any of them, email sales@heyleads.so. We'll reply within a reasonable time, usually within 30 days.
11. Cookies
We use only the cookies the service needs to work: one to keep you signed in, one to remember which workspace you have open, and a few to remember small preferences. We don't use advertising or cross-site tracking cookies.
12. Children
HeyLeads is a business tool and isn't meant for anyone under 18. We don't knowingly collect information from children.
13. Changes to this policy
We may update this policy. When we make a change that matters, we'll tell you in the app or by email, and we'll change the date at the top of this page.
14. Contact
Questions about privacy or your data: sales@heyleads.so. For help using the product, see the Help page.
