Skip to content
Lead Strategist
Menu

Privacy policy

Last updated

1. Introduction

Lead Strategist processes your personal data in accordance with the GDPR. This policy describes what data we collect, how we use it and what rights you have.

2. Data we collect

  • Name and email address when you create an account.
  • Your password, stored only as a secure hash.
  • Hashes of your API keys and OAuth tokens, and which AI clients you have connected.
  • Usage data for API, MCP and CLI calls (see section 5). We do not store your prompts or the results your AI shows you.
  • Website statistics without cookies (see section 4).
  • Payment details, once payments open, are handled by our payment provider. We never store card details.

3. Purpose

We use the data to deliver the service: your account, access to the MCP server, usage metering and, later, billing. We also use website statistics and API usage logs to improve the website and the service (sections 4 and 5). We do not store the lead lists your AI client shows you, and we do not use your data for marketing or sell it to third parties.

4. Website statistics without cookies

We keep simple visitor statistics to improve the website and the service. They use no cookies, nothing in your browser's local storage and no third-party scripts, and they run only on our own servers. We record which page was viewed and when, the site you came from (its domain only, not the full address), any campaign tags (utm) in the link, the device type (computer, mobile or tablet) and a few button clicks such as "Create account". Because the statistics are cookieless, there is no cookie banner (section 6).

To count unique visitors per day, we compute a code (a hash) from your IP address and your browser's User-Agent together with a secret value that changes every day and is then deleted. The statistics never store your IP address, the code cannot be used to find it, and you get a new code every day, so we cannot follow you from one day to the next.

If you create an account, we link that day's code to your account once, so we can see which pages lead to signups. If your browser sends Do Not Track or Global Privacy Control, we record nothing and make no such link. Known bots and our own automated tests are not counted.

The legal basis is our legitimate interest in improving the website and the service (GDPR Art. 6(1)(f)). Individual events are kept for 13 months; after that we keep only daily totals without codes.

Separately from the statistics, our web server keeps ordinary access logs with IP addresses for security and troubleshooting. They are deleted automatically after about 14 days.

5. Logging of API, MCP and CLI calls

When you use the API, the MCP server or the CLI with your account, we log for each call: the account, which API key was used (its ID, never the key itself), the channel (API, MCP or CLI), the tool or endpoint, which filters were used (for example industry code or a revenue limit), response time, number of rows, the status or error type, and the name and version of the client. We do not store the text you search for, only its length, and we do not store the CVR numbers you look up, your prompts or the results.

The purpose is to run and improve the service: find slow queries, decide which database indexes we need and catch errors. The legal basis is our legitimate interest in operating and improving the service (GDPR Art. 6(1)(f)). The log is kept for 13 months and then deleted.

To count credits and the trial, we also keep a metering record of each call: the account, the tool, whether the call succeeded, the credits it cost, the time and which API key or AI client made it. The legal basis is the performance of our agreement with you (GDPR Art. 6(1)(b)). Metering records are kept for 12 months and then deleted automatically.

6. Cookies and local storage

  • ls_session: signed session cookie that keeps you logged in. It is strictly necessary and is set only when you log in or create an account.

That is the only cookie. We use no statistics, marketing or third-party cookies and store nothing in your browser's local storage. That is why there is no cookie banner.

7. Data processors

  • Hosting provider: the servers that run the service, including the website statistics and the usage log.
  • Email provider: account confirmation, password reset and billing emails, and the mailbox for emails to support.
  • Payment provider: once payments open.

8. Company pages and removal requests

Our company pages show public information from the Danish CVR register (Danish Business Authority) and published annual reports, including the registered address. For sole proprietorships and other personally owned businesses we show only the postcode, town and municipality, never the street address, and these pages are not indexed by search engines.

If you use the form to request removal of a company page, we store the CVR number, your name, your email address and your reason. We use this data only to handle the request, and it is sent to kontakt@leadstrategist.dk. Your IP address is used only in the server's working memory to limit the number of requests. It is not saved with the request.

We delete the request, including the email about it, 12 months after it has been handled (approved or rejected). If the request is approved, we keep the CVR number on a list of hidden pages for as long as the page stays hidden. That list contains no information about you.

9. How long we keep data

  • Account data (name, email address, password hash): as long as you have an account. There is no delete button in the account: to delete it, email us from the address on the account (see the support page). We delete the account within one month, together with your API keys, connected AI clients, usage data and metering records, and confirm by email.
  • API keys and AI client connections: until you revoke them or delete your account. Access tokens are valid for 1 hour and refresh tokens for 30 days.
  • Website statistics: 13 months, then only daily totals (section 4). Web server access logs: about 14 days.
  • Logs of API, MCP and CLI calls: 13 months (section 5). Metering records used for credits and the trial: 12 months (section 5).
  • Emails to support: 24 months after the last message in the case, then deleted.
  • Removal requests for company pages: 12 months after they have been handled (section 8).
  • Payments and invoices, once payments open: the accounting records the Danish Bookkeeping Act requires, for 5 years.

10. Your rights

You have the right of access, rectification, erasure and data portability. You can also complain to the Danish Data Protection Agency (Datatilsynet). Contact us at kontakt@leadstrategist.dk.