Privacy Policy
Last updated: July 26, 2026
Who are we?
SprintLead, a sole proprietorship, operates the Site sprintlead.io. Data controller: GDPR contact form. Requests relating to data protection are processed via this form.
Data collected
Account data : email, first name, last name, password (bcrypt hashed, never in plain text)
Usage data : searches carried out, leads consulted, emails generated (to improve the service)
Payment data : processed by Stripe (we never store your credit card data)
Professional prospect data : identity or trading name, professional contact details, website, location, public signals, source, outreach history, objections and opt-outs
Support and chatbot : messages sent, voluntarily provided email address, feedback, and technical data needed to follow up the request
Navigation data : Google Tag Manager, Google Analytics and audience measurement only after your consent; minimized paths for internal measurement
Purposes of processing
| Purpose | Legal basis |
|---|---|
| Provision of service | Execution of the contract |
| Billing | Legal obligation |
| Product improvement | Legitimate interest |
| Marketing communications | Consent |
Data sharing
Your data is never sold. Subcontractors:
Use of Google Data / Use of Google User Data
SprintLead lets users connect their Gmail account to send personalized emails from the application. By default, we request the gmail.send, which allows emails to be sent on the user’s behalf from their own Gmail account. Synchronizing replies and delivery failures requires separate consent for the gmail.readonly. This restricted scope is not currently requested from public users: the feature remains unavailable until Google verification is confirmed.
Without that separate consent, SprintLead does not read the inbox. Whengmail.readonlyis enabled, targeted queries look for replies and bounce notices related to outreach messages; the metadata and content needed for the reply thread may then be stored in SprintLead. They are limited to threads initiated or explicitly tracked by SprintLead.
SprintLead's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the requirements of Limited Use.
Concretely:
Gmail data is never used for advertising
Gmail data is never sold
Gmail data is never used to train AI models
Gmail data is never transferred to third parties, except to provide and improve the service to the user, or when required by law
No human reads your Gmail data, unless you explicitly agree to it or require security
English
SprintLead's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We only request the gmail.send scope by default, used to send emails composed by the user from their own connected Gmail account. Reply and delivery-failure synchronization requires a separate grant of the gmail.readonly scope. This restricted scope is not currently requested from public users; the feature remains unavailable until Google verification is confirmed. Without that grant we do not read the inbox. When enabled, targeted queries find replies and bounce notices related to outreach messages, and the response thread data needed by the product may be stored only for threads initiated or explicitly tracked by SprintLead. Google user data is not used for advertising, sold, or used to train AI models.
Data Protection and Google User Data Security
We implement technical, organizational, and security measures designed to protect Google user data, including data processed through the Gmail API scopes gmail.send and, when separately authorized, gmail.readonly. Google user data is used only to provide user-facing email sending, reply synchronization and deliverability protection requested by the user. Public reply synchronization is currently disabled pending Google verification.
Encryption in Transit
All data transmitted between the user's browser, our application, our servers, and Google APIs is protected using secure communication protocols, including TLS/SSL. We require encrypted HTTPS connections for authentication, authorization, API requests, and any transfer of Google user data.
Encryption at Rest
OAuth access tokens, refresh tokens, authentication credentials, and other sensitive identifiers stored by our systems are encrypted at rest using AES-256 encryption or an equivalent industry-standard encryption mechanism. These credentials are stored only for the purpose of maintaining authorized access necessary to provide the service requested by the user.
Access Control and Human Review
Access to Google user data is strictly limited to automated processing required for operation of the service, specifically to send emails initiated or authorized by the user and, after separate authorization, synchronize related replies and delivery failures. SprintLead personnel do not access, read, review, or manually process Google user data, email content, recipients, or related message data, except when the user expressly requests technical support and such access is necessary to resolve the support request.
Data Retention and Deletion
Temporary data processed for email-sending operations is retained only for the period necessary to perform the requested service, maintain security, troubleshoot delivery issues, or comply with applicable legal obligations. Users may revoke the application's access to their Google Account at any time through their Google Account permissions page. Users may also request permanent deletion of their data at any time by contacting us through the contact details provided in this Privacy Policy.
Google API Services User Data Policy Compliance
SprintLead's use and transfer of information received from Google APIs strictly complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising purposes, do not sell Google user data, do not use Google user data to create or enhance user profiles for unrelated purposes, and do not transfer Google user data except as necessary to provide or improve the user-facing functionality of the application, comply with applicable law, or protect the security and integrity of the service.
Your rights (GDPR)
You have the rights of access, rectification, erasure, portability, opposition and limitation. To exercise them:
Contact: GDPR contact form · Response within 30 days.
Shelf life
Cookies
An anonymous audience measurement, with no cookie and no lasting identifier, counts the visits of every visitor; it is exempt from consent under CNIL rules and you can object to it on the Cookies page. Google Tag Manager, Google Analytics and our audience and journey measurement start only with your consent. Google Tag Manager never runs on pages whose address carries a token (password reset, e-mail verification, unsubscribe, invitations, shared audits). The internal analytics system minimizes page paths and excludes sensitive URL parameters, form contents and prospect identifiers. No Meta Pixel. Account events (sign-up, payment, cancellation) are recorded on our servers to measure our sales funnel, without reading anything on your device. The anonymous measurement also notes which links and buttons are used, repeated clicks, script errors, forms started or left (by field name, never what you type) and how fast pages load. The questions we sometimes ask (how you heard of us, what holds you back, why you cancel) are optional; free text is cleaned of e-mail addresses, phone numbers and links, and answers given without an account are kept three years. For accounts, we deduce the company from the domain of the e-mail address, using our own directory only; this is deleted with the account. When an account is deleted, its journey stays in our statistics under a random identifier that nothing links back to it.
International transfers
Supabase hosts the database in the European Union. Vercel, OpenAI, Google (including Google Analytics) and Sentry are providers established in the United States; when personal data is transferred to them, the transfers are governed by the EU–US Data Privacy Framework for providers certified under it, and otherwise by the standard contractual clauses, in accordance with Articles 45 and 46 GDPR.
Contact & complaint
For any questions relating to your personal data: GDPR contact form
You can also file a complaint with the CNIL: cnil.fr (online form available on their website).