Privacy Policy

LeadRM.app (“LeadRM,” “we,” “us,” or “our”) is a trade name (DBA) of DTLA Professional Services, LLC, 770 S Grand Ave, Los Angeles, CA 90017, United States. The service is available at https://leadrm.app.

For account, billing, security, and usage information, DTLA Professional Services, LLC is the controller (and, where the California Consumer Privacy Act applies, the business). For lead and contact records that a customer uploads or asks the service to retrieve, the customer is the business that decides why those records are processed. We process those records on the customer’s instructions in order to provide the service.

This policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights available to you. It applies to leadrm.app, the LeadRM application, and related support communications. Our Terms of Service govern use of the product.

Account and authentication. When you create or use an account, we collect your email address and authentication data needed to sign you in. You may sign in with an email and password or with Google sign-in. If you use Google sign-in, Google provides us the identifiers and profile details required to authenticate you, such as your name and email address. We do not receive or store your Google password.

Workspace and team. If you use a workspace, we store the workspace identifier, tier, seat limits, member email addresses or user identifiers, roles, invitations, and the monthly credit pool associated with that workspace, so that access and shared storage can function.

Billing. Purchases and subscriptions are processed by Stripe through the checkout in the Service. In some cases we may instead bill you by a manual invoice, which may be payable through PayPal; in that case PayPal processes the invoice payment. We receive purchase status, the pack or plan purchased, the amount paid, a customer reference, and receipt information so we can grant credits and show billing history. We do not store full payment card numbers, card security codes, or PayPal credentials. Each payment processor handles payment data under its own privacy terms.

Marketplace and lifetime-deal partners. If you buy or redeem a license through a deal marketplace such as AppSumo or Dealify, we store the license key, the email address used to redeem it, the plan tier, and activation, refund, or void events that the partner sends us so we can provision, update, or revoke the plan. We share back only the license status needed to operate the deal.

Dataset marketplace. If you publish or purchase a lead dataset, we store the listing, its price, sale records, and the buyer and creator references needed to deliver the dataset and account for creator royalties.

Lead and CRM data. We store the business records you upload, import, or generate in the service. Those records may include business names, domains and websites, phone numbers, email addresses, categories, addresses, campaign tags, pipeline or lifecycle fields, notes, verification results, and other fields you map or enter. This information may relate to identifiable people at those businesses.

Usage and device data. We collect technical data needed to operate and protect the service, such as log records, IP address, browser and device type, approximate time of access, feature use, error reports, and security events.

Cookies and similar storage. We use cookies, local storage, and similar technologies for sign-in, preferences, and measurement, as described in the cookies section below. The site loads Google Tag Manager.

Support. If you contact us, we keep the message, your contact details, and the records needed to respond.

We use personal information to:

• provide, maintain, and secure the CRM and your account;
• run the directory searches and email verification you request, and store the results in your account;
• administer credits, purchases, receipts, and workspace entitlements;
• provision, verify, and manage marketplace and lifetime-deal licenses and prevent license abuse;
• operate the lead-dataset marketplace, including sales, delivery, and creator royalty accounting;
• send transactional messages such as receipts, team invitations, security notices, and service announcements you request;
• provide customer support and respond to inquiries;
• detect abuse, fraud, and security incidents;
• comply with law, enforce our terms, and protect our rights and the rights of others; and
• understand aggregate use of the site so we can keep it reliable.

Where a privacy law requires a legal basis, we rely on performance of a contract (providing the service you request), legitimate interests (securing the service, preventing abuse, and understanding product reliability, balanced against your rights), compliance with legal obligations, and consent where consent is required, including for non-essential cookies where applicable law requires it.

We do not use customer lead lists to market our own products to the people on those lists, and we do not sell customer lead lists.

When you request a search, the service queries public business directories you select. Examples of directories the product can query include Google Maps, Yelp, Trustpilot, Google Play, Product Hunt, and G2. A search may return business names, websites, phone numbers, categories, locations, and, where available, email addresses. Coverage differs by directory and by query. A result may be incomplete or empty.

When you request email verification, an email address from your account is submitted to an email-verification processor, which returns a result such as valid, invalid, catch-all, or unknown. We store that result with the lead. Verification is a data check. The service does not send email or text messages to those addresses.

When you request enrichment or an AI email lookup, fields from the affected lead — such as company name, website address, website page text, and location — are sent to an AI model-routing provider (OpenRouter). A request may be fulfilled by an OpenAI, DeepSeek, or Google model depending on availability. We use AI output only to answer your lookup; we do not use your lead lists to train models.

The service providers we rely on include:

• Google Firebase, Google Authentication, and Google Cloud (including a Cloud Run worker) for hosting, database, sign-in, and directory retrieval;
• Stripe, for checkout payments, and PayPal, where we bill you by a manual invoice payable through it;
• AppSumo and Dealify, for lifetime-deal license delivery and status updates;
• Serper, for the Google search queries used in website-domain discovery;
• Apify, for the decision-maker and contact enrichment steps;
• MillionVerifier, for email verification results;
• OpenRouter, for AI model routing described above;
• logo.dev, for company logos requested by domain or business name;
• Google Tag Manager and Google Analytics, for site measurement — see the cookies section; and
• optional customer-supplied API keys on Tier 3, which cause the corresponding step to run on the customer’s own vendor account.

Processors may handle personal information only to perform the service we engage them for, under contractual restrictions. Each third party above processes data under its own privacy policy.

You, the customer, decide the purposes for which you collect and use lead contacts, including any later outreach you conduct outside LeadRM. We process those contacts on your instructions to host them, search for them, verify them, and let you export or delete them. You are responsible for having a lawful basis to process those contacts and for honoring the rights of the people they identify.

We do not sell customer lead lists. We do not rent them, and we do not use them as a data product for other customers. Other customers cannot see your leads.

Shared caches. To make repeat searches faster and cheaper, results retrieved from public directories and from enrichment lookups may be kept in shared caches for up to 180 days — one for directory search results and one keyed by business name and location for enrichment output. Those caches hold business and contact fields returned for a business (such as its website or a published contact), not your account data, campaign tags, notes, or pipeline fields. Another customer who looks up the same business inside the window may receive the same cached business fields. Your lead list itself stays private to the workspace.

Dataset marketplace. A workspace may choose to offer business lead records for sale to other users through the dataset marketplace. That sale is the workspace’s own decision about its collected data; buyers receive the listed records. We operate the marketplace and account for the transaction and creator royalties, but we do not decide to sell any workspace’s data ourselves.

A Tier 3 workspace owner may store API keys so that directory retrieval, enrichment, or email verification runs on that customer’s own vendor accounts. Those keys are stored for the workspace owner. Access is limited to the owner. They are not shown to other workspace members.

We use a stored key only to perform the step the owner has configured for that workspace. We do not use customer API keys to market to the customer or to the people on the customer’s lead lists. The owner may replace or remove keys. Deleting the owner account removes cloud copies of keys stored for that account. The owner is responsible for the security of vendor accounts and for any charges those vendors bill.

We share personal information only in these circumstances:

• Processors. With vendors that host the service, authenticate users, process payments, retrieve directory data, run AI lookups, verify email addresses, display logos, or measure site use, and only as needed for those tasks. The main providers are listed in the processors section above.
• Marketplace buyers. With purchasers of a dataset a workspace has chosen to sell, to the extent the listed records are delivered.
• Deal partners. With the marketplace that issued a lifetime-deal license, limited to the license status needed to honor the deal.
• Workspace members. With people the workspace owner invites, to the extent the product shares that workspace’s leads, credits, and settings with them. API keys are not shared with members.
• Legal requests. If we believe disclosure is required by law, regulation, legal process, or a governmental request, or is necessary to protect the rights, safety, and security of LeadRM, our users, or others.
• Business transfer. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy or a successor policy that provides comparable protection.

We do not sell personal information.

We do not sell personal information for money or other valuable consideration. We do not share personal information for cross-context behavioral advertising. We do not sell customer lead lists. Analytics measurement through Google Tag Manager is described in the cookies section and is not a sale of your lead records. A workspace’s own decision to sell a lead dataset through the marketplace is that workspace’s transaction in its collected data, not a sale of personal information by us.

We keep account information and lead records for as long as the account is open and the records remain in the service, unless a shorter period is required. You may delete individual leads or sets of leads in the application. You may delete the account, and the lead data stored with it, by following the steps on the Delete Account page.

We may retain purchase records, invoices, and limited security logs for as long as needed for receipts, tax, accounting, fraud prevention, and legal claims. API keys stored for a Tier 3 owner are removed when the owner deletes them or deletes the account. Residual copies may remain in encrypted backups until those backups expire in the ordinary course.

Shared caches that speed up directory search and enrichment keep business-contact fields for up to 180 days, after which the entries are treated as stale. Public marketplace dataset listings stay visible for up to 180 days after extraction or the last sale, then drop out of marketplace results — delisting never deletes the listing owner's workspace leads. Workspace usage-ledger entries — records of credits spent and which feature used them — are retained for billing history while the workspace exists. Lifetime-deal license records are kept for as long as the license remains active, plus the period needed for accounting and fraud prevention.

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, and alteration. Those measures include access controls on production systems, authenticated access to customer data, and use of established infrastructure providers.

No method of transmission or storage is completely secure. We do not promise absolute security, and we do not guarantee that the service will be free of unauthorized access, interruptions, or errors.

If we confirm a security incident that results in unauthorized access to personal information, we will notify affected users and any regulator where applicable law requires it.

We operate from the United States and use cloud providers located in the United States, including Google and Firebase. If you access the service from outside the United States, your information will be processed in the United States, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards for those transfers, such as contractual clauses with our processors.

The service is a business tool. It is not directed to children under 13, and it is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us and we will delete it.

Depending on where you live, you may have the right to access personal information we hold about you, to correct it, to delete it, to receive a copy, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You may also lodge a complaint with a supervisory authority. You can exercise access, correction, and deletion for account and lead data in the product, including through the Delete Account page, or by contacting us at the address below.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know the categories and specific pieces of personal information we collect, the right to delete personal information, and the right to correct inaccurate personal information. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that would give you a right to limit that use under those laws. We will not discriminate against you for exercising these rights.

To make a request, email info@dtlaprofessionalservices.com or write to the postal address in the contact section. We will verify the request using information associated with the account. You may use an authorized agent where the law allows it; we may require proof of authorization. If we deny a request, you may appeal by replying to that denial.

If you are a person whose contact details appear in a customer’s lead list, we process that information for the customer. Please direct access, correction, and deletion requests about those records to the business that collected or uploaded them. If you contact us, we will forward the request to that customer or ask you to do so, except where we are required to respond ourselves.

Strictly necessary storage. Essential cookies and similar storage keep you signed in and remember security and interface state. The authentication provider and your browser maintain the session. Local storage and session storage may hold interface preferences and in-progress search state on your device. These are required for the service to work.

Analytics and marketing tags. The site loads Google Tag Manager. That container can set analytics cookies and similar identifiers — for example through Google Analytics — that record pages viewed, referring pages, approximate location derived from your IP address, and general device information so we can measure traffic and reliability. Google processes that data under its own privacy policy and may use it as described in Google’s partner-site disclosures. Those cookies are not used to sell your lead lists.

Your controls. You can block or delete cookies in your browser; if you block essential cookies, sign-in may not work. You can opt out of Google Analytics measurement with Google’s browser add-on or adjust Google’s ad personalization settings in your Google account. We honor Global Privacy Control and similar opt-out signals where the law requires us to treat them as a request not to sell or share personal information; because we do not sell or share personal information for cross-context behavioral advertising, those signals do not change the lead data stored in your account. The service does not otherwise respond to “Do Not Track” signals.

We may update this policy as the service or the law changes. The effective date and the last-updated date at the top of this page will change when we do. The current version is effective October 13, 2026. If a change materially reduces your rights, we will provide additional notice as required by law. Continued use of the service after the updated policy takes effect means the updated policy applies to information collected from that date forward.

Privacy requests and questions about this policy may be sent to:

LeadRM.app, a DBA of DTLA Professional Services, LLC
770 S Grand Ave
Los Angeles, CA 90017
United States

Phone: +1 213-444-2224
Email: info@dtlaprofessionalservices.com
Website: https://leadrm.app