Openlead is run by Karmastudio LLC, a US limited liability company ("we", "us"). This policy explains what data we collect when you use openlead.ai, why we collect it, who helps us process it, and what rights you have. Questions go to hello@openlead.ai.
What Openlead does
Openlead finds companies that match the customer you describe, and the right people at each. You type a sentence or a website; we search the live web and keep what we find in a lead database. That shapes the two kinds of personal data we handle: data about you as a user, and data about business professionals in the lead database.
Data about you
When you create an account we collect your email address and, if you give it, your name. Sign-in works with a code or link we email you; there is no password. When you set up a workspace we store its name, its address and, if you give it, your company website and a short profile of who you sell to.
While you use Openlead we store what the product needs to work: your searches, the companies and people they found, your lists, your exports and your plan usage. If you email us, we keep the correspondence.
If you subscribe to a paid plan, our payment provider Stripe collects your card details. We never see your card number. We store what Stripe tells us about your subscription: the plan, the billing period and the invoice status.
The lead database
The companies and people Openlead finds are stored in our lead database. A person's record is business contact data: name, job title, company, and the address of a public professional profile. It comes from public web pages found through our search provider. It does not include private addresses, financial data or anything from non-public sources.
We process this data on the basis of legitimate interest: helping businesses find the companies and people most likely to buy from them, using information those people have published professionally. Records that no search has seen for 12 months are removed.
If you are in the lead database and want out, email hello@openlead.ai and we will delete your record. See "Your rights" below.
Guest preview
You can try Openlead at /try before creating an account. To keep that preview from being abused, the page uses Cloudflare Turnstile to check that you are human, and we apply daily limits per visitor. The identifiers behind those limits (your session and network address) are stored only as keyed hashes, not in the clear. A preview expires after 24 hours unless you verify your email to keep it; verifying stores that email as the start of your account.
Cookies and analytics
Openlead sets cookies that the product needs: a session cookie that keeps you signed in, and a signed cookie for the guest preview. These are essential and have no tracking purpose.
In production we load Google Tag Manager, which runs Google Analytics. It helps us understand how the site is used and may set its own cookies. We also use Vercel Analytics, which counts page views without cookies and without tracking you across sites.
Services we rely on
We share data with these processors, each for one job:
| Service | What it does | What it processes |
|---|---|---|
| Supabase | Database and sign-in | Your account, workspaces, lists and the lead database |
| Vercel | Hosting and analytics | Requests to openlead.ai, anonymous page views |
| Stripe | Billing | Your card and subscription details |
| Resend | Email delivery | The emails we send you, and delivery events |
| Exa | Lead search | The search text or website you submit, and what the web search returns |
| Tag Manager, Analytics, favicons | Usage data in production; the domains whose favicons the app shows | |
| Cloudflare | Turnstile on the guest preview | The signals Turnstile needs to tell humans from bots |
We do not share your data with anyone else, and we do not run third-party advertising.
AI processing
Searches are processed by AI systems: the search provider reads your description and public web pages to find companies that match, and to find people at them. No decision with legal effect about you is made automatically.
Emails
We send transactional emails that the product needs: sign-in codes and links. Marketing emails go only to people who agreed to get them, and every one carries an unsubscribe link that works without signing in. When open and click tracking is turned on for marketing emails, we record those events; when it is off, we do not.
Retention
We keep your account data while your account exists. If you delete your account, we delete it, except what we must keep for legal or accounting reasons. Guest previews expire after 24 hours unless claimed. Lead database records that no search has seen for 12 months are removed. Billing records are kept as long as tax law requires.
Your rights
You can ask us to show you the data we hold about you, correct it, delete it, hand it over in a portable format, or stop processing it. If you are in the European Economic Area or the UK, these are your GDPR rights, and you can also complain to your supervisory authority. If you are a California resident, you have similar rights under the CCPA, including the right to ask us to delete your record from the lead database and stop making it available to customers.
To use any of these rights, email hello@openlead.ai. We answer within 30 days.
International transfers
We are a US company and the services we rely on process data in the United States. Where data moves from the EEA or the UK to the US, we rely on the safeguards the law provides, such as standard contractual clauses with our processors.
Children
Openlead is a tool for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16.
Changes
When this policy changes, we update the date at the top. If a change matters, we tell account holders by email.
Contact
Karmastudio LLC, operator of openlead.ai. Email hello@openlead.ai.