Account information. When you sign in with Google, we receive your name and email address from your Google account. We do not receive your Google password and we request no other Google data. When you sign in with an emailed link instead, we collect the email address you give us to send and verify that link.

Your company profile. The company website URL you give us, the results of scanning that public website, and the service selections you confirm or correct during onboarding (what your company does and doesn’t do).

Your work in the product. Annotations and labels on prospects, notes, and pipeline stages and outcomes.

Usage data. Standard operational logs (pages requested, errors, timestamps) needed to run and debug the service.

Analytics. One optional shared analytics preference covers both vendors. Analytics is enabled by default, and you can turn it off at any time. Google Analytics is used for public-site acquisition, sign-in, signup, and onboarding activity; it never runs in your signed-in workspace. It may receive an analytics preference cookie, browser and device information, a general location derived by Google, the public page path, the referring site’s domain, but not its page path or query string, and limited events such as starting a trial, requesting a demo, signing up, or completing an onboarding step.

We do not send Google Analytics form contents, your company website URL, notes, customer records, or prospect records.

You can change the shared preference at any time through Analytics preferences in the public footer or signed-in Settings. Withdrawal stops future optional collection on both the public and signed-in surfaces, for both vendors.

The opportunities in your feed are derived from public government records (procurement databases, budget documents, permits, and similar public filings) — not from data about you.

We use your data for one purpose: making the product work for you — building and personalizing your feed, applying your corrections, preparing the evidence-backed qualification view for each opportunity, and sending you the product emails you expect (such as your daily digest).

Your workspace is isolated. Your labels, annotations, win history, routing decisions, and pipeline are scoped to your workspace at the database level. They are never shown to or shared with another customer.

Tenant-specific data is never used to fine-tune a shared model. Your specific deals, relationships, and margins are never shown to another customer. Identity-stripped general industry knowledge may transfer as inspectable baseline rules and examples. That transfer is explicit and auditable; it is not autonomous model training.

We do not sell your data. Not to advertisers, not to data brokers, not to anyone.

Longlead AI never contacts your prospects on your behalf. It prepares a cited opportunity-qualification view you use to decide and reach out yourself, from your own channels — no outreach leaves the system. If you choose to, you may track a qualified opportunity in Longlead Pipeline and/or send it as a one-way snapshot to your own connected CRM; neither is required. Emails we send you about your own account and feed are product emails; where marketing email applies, it complies with CAN-SPAM, including a working unsubscribe.

Before 2026-07-16, the product generated shareable, tokenized dossier links (/dossier/<token>). That feature is retired and creates no new links. Any dossier link created before then may remain accessible at its original URL until its already-stored 30-day expiry, and the associated open-tracking rows are retained under this policy until then — we do not claim those legacy rows are already deleted.

We run on a small set of infrastructure providers (subprocessors):

• Vercel — application hosting
• Supabase — database and authentication
• Anthropic — AI inference (under terms that do not permit training on the data)
• Resend — transactional email delivery
• Google — OAuth sign-in and public website analytics (which you can turn off through Analytics preferences)
• PostHog — signed-in product analytics (US Cloud), which you can turn off through Analytics preferences

Google sign-in, Google Analytics, and PostHog are separate services. Google sign-in does not give Longlead AI access to your Google Analytics or Search Console accounts. Those services are administered separately from your product account.

Each receives only what it needs to perform its function. We will update this list if it changes.

We keep your data while your account is active. To have your account and its data deleted, email support@longlead.ai from your account address and we will delete it within 30 days, except where we are legally required to retain records (such as billing).

If this policy changes materially, we will update the date above and notify active customers by email. Questions, requests, or complaints: support@longlead.ai.