Privacy Policy

Purpose and Scope

This Privacy Policy explains how personal data is processed when you visit or use Leadverse, including its websites, applications, connected accounts and Model Context Protocol ("MCP") integration (collectively, the "Service"). It provides information required by Regulation (EU) 2016/679 ("GDPR") and other applicable data-protection law.

Controller and Contact Details

The controller is Jakub Mužík, self-employed (sole trader), CIN (IČ): 17825598, with registered office at Na Šmukýřce 932/35, 15000, Praha 5, Czech Republic.

• Delivery address: Na Šmukýřce 932/35, 15000, Praha 5, Czech Republic
• Email: support@leadverse.ai
• Phone: +420 732 710 244

The controller has not appointed a Data Protection Officer.

Personal Data We Process

Depending on how you use the Service, we may process:

• Account and contact data: name, email address, authentication identifiers, organization or team membership, account preferences and support communications.
• Subscription data: plan, trial and billing status, transaction identifiers, invoice details and limited payment-method information received from our payment processor. Leadverse does not store full payment-card details.
• Campaign and product data: product descriptions, targeting, keywords, competitors, blocklists, voice-training material, generated content, lead status and other settings or content you submit.
• Public platform data: public posts, comments, usernames, links, community information, engagement data and other publicly available discussion data relevant to the Service.
• Connected-account data: connected Reddit username, account identifiers and metadata, authorization credentials, connection status, messages sent through Leadverse, replies, conversation history and outreach configuration.
• MCP data: authorization requests and grants, MCP Client identifiers and redirect information, access and revocation records, tool requests, operational logs and the Leadverse data returned in response to your authorized MCP Client's requests.
• Technical and usage data: IP address, browser and device information, timestamps, feature interactions, diagnostic logs, security events, cookies and similar technologies.

Sources of Personal Data

We receive personal data directly from you, from members or administrators of your Leadverse team, from connected services you authorize, from payment and authentication providers, and from publicly accessible online sources. When you connect an external account or MCP Client, the relevant third party may also provide identifiers, authorization information and requested service data.

Purposes and Legal Bases

We process personal data for the following purposes and legal bases:

• Providing the Service and performing our contract: creating and authenticating accounts, managing subscriptions, operating campaigns, finding leads, generating content, sending configured outreach, synchronizing conversations, providing MCP access and responding to support requests (Article 6(1)(b) GDPR).
• Legal obligations: maintaining required accounting and tax records, responding to lawful requests and complying with applicable law (Article 6(1)(c) GDPR).
• Legitimate interests: securing and preventing abuse of the Service, diagnosing failures, improving features, measuring performance and communicating important product information, balanced against your rights and interests (Article 6(1)(f) GDPR).
• Consent: where required for non-essential cookies, optional marketing communications or another processing activity for which we specifically request consent (Article 6(1)(a) GDPR). You may withdraw consent at any time without affecting earlier lawful processing.

Leadverse uses automated systems to rank and categorize potential leads and generate recommendations. These activities do not make decisions that produce legal effects or similarly significant effects about you within the meaning of Article 22 GDPR.

Connected Reddit Accounts

When you connect a Reddit account, you instruct Leadverse to use the authorization provided by Reddit or the applicable connection provider to operate supported features. We may store and use authorization credentials and account metadata to send messages according to your settings, retrieve delivery information, synchronize replies and display conversation history.

You can disconnect the account in Leadverse settings. Disconnection prevents new access using that connection after it takes effect, but does not delete messages already sent or data that must be retained for security, legal or operational purposes. Reddit independently processes information under its own privacy policy.

MCP and User-Selected AI Assistants

If you approve an MCP connection, your selected MCP Client can request Leadverse data and perform supported actions using your Leadverse permissions. At your direction, we disclose the requested data to that MCP Client. Depending on the approved tools, this may include campaigns, leads, insights, conversations, generated content, account usage and outreach configuration.

The MCP Client is a separate third-party service with its own privacy practices. Its provider may process prompts, Leadverse responses and related metadata after receiving them. Review the provider's privacy policy before connecting it. You can revoke an MCP connection in Leadverse settings, which prevents new requests after revocation takes effect but does not control copies already received by the MCP Client.

Recipients and Service Providers

We disclose personal data only as necessary to operate the Service, carry out your instructions, comply with law, or protect the Service and its users. Recipients may include:

• Supabase Inc. for database, authentication and backend infrastructure.
• Stripe Payments Europe Ltd. and related Stripe entities for payment processing, billing and fraud prevention.
• OpenAI, L.L.C. for supported artificial-intelligence processing such as embeddings, classification and content generation.
• Resend and other communication providers for transactional email delivery.
• Cloudflare, OVHcloud and other hosting, networking, security, monitoring and infrastructure providers used to deliver the Service.
• Reddit and other connected platforms when necessary to perform actions you request.
• An MCP Client and its provider when you approve the connection and instruct it to access Leadverse.
• Professional advisers, competent authorities or other parties where disclosure is required by law or reasonably necessary to establish, exercise or defend legal claims.

We do not sell your personal data.

International Data Transfers

Some recipients may process data outside the European Economic Area. Where required, transfers are protected by an applicable adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. A user-selected MCP Client may process data in locations described in that provider's own privacy documentation.

Retention

We retain personal data only for as long as reasonably necessary for the purposes described above, including to provide the Service, maintain security, resolve disputes and comply with legal obligations. Retention depends on the category of data:

• Discovered lead records are generally retained for 60 days.
• Account and service data are generally retained while your account is active and may be retained for up to 3 years after account termination where necessary for legal claims, security and contractual records.
• Connected-account credentials are retained while needed to provide the connection and are deleted or rendered unusable after disconnection or account deletion, subject to limited backups, security records and legal obligations.
• Billing and transaction records may be retained for the period required by tax, accounting and other applicable law.
• Technical, security and MCP authorization logs are retained for a limited period appropriate to troubleshooting, auditing, fraud prevention and security.

Data may remain temporarily in restricted backups until those backups are overwritten in the ordinary course.

Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration and disclosure. No online service can guarantee absolute security. You are responsible for protecting your Leadverse credentials, connected accounts and access to any approved MCP Client.

Your Data-Protection Rights

Subject to applicable conditions and exceptions, you may have the right to:

• Access your personal data and receive information about its processing.
• Correct inaccurate or incomplete personal data.
• Request deletion of personal data.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests.
• Receive data you provided in a structured, commonly used and machine-readable format where data portability applies.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Czech Office for Personal Data Protection or another competent supervisory authority.

To exercise a right, contact support@leadverse.ai. We may need to verify your identity before completing the request.

Cookies and Similar Technologies

Leadverse uses cookies and similar technologies to maintain sessions, protect accounts, remember preferences and understand Service performance.

• Essential technologies: required for authentication, security and core Service functionality.
• Analytics technologies: used to understand use of the Service and improve performance, subject to consent where required.

You may control non-essential cookies through available consent controls or your browser settings. Disabling essential cookies may prevent parts of the Service from working.

Changes to This Policy

We may update this Privacy Policy to reflect changes to the Service, providers or applicable law. We will publish the updated version and revise the date above. We will provide additional notice where a change is material or required by law.