Privacy Policy
Last updated: June 8, 2026
Note: Inertia Leads is currently operated as an independent product pending formal company registration. The operator of this Service is Aman Kumar, reachable at info@inertialeads.com. This policy will be updated with full legal entity details upon company registration.
Inertia Leads ("we," "our," or "us") operates the Inertia Leads platform (the "Service"), an AI-powered lead generation and email outreach tool. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service.
By using Inertia Leads, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
1. Information We Collect
Account Information
When you create an account, we collect your name, email address, and password. Your password is securely hashed using industry-standard hashing algorithms and is never stored in plaintext.
Profile Information
You may optionally provide a display name, bio, and profile photo. This information is entirely optional and can be updated or removed at any time.
Email Account Credentials
When you connect Gmail or SMTP accounts for sending emails, we store OAuth tokens (for Gmail) and SMTP credentials. All tokens and credentials are encrypted using AES-256-GCM encryption at rest. They are never stored in plaintext and can be revoked by you at any time.
Lead Data
When you use our lead finding feature, we collect publicly available business information including business names, email addresses, phone numbers, websites, addresses, and industry categories sourced from Google Maps and publicly accessible business websites. This is publicly listed information that businesses have made available for commercial contact.
Email Content
We store AI-generated email subjects, bodies, send status, and reply status associated with your campaigns. This data is stored solely to operate the Service and is never used for any purpose other than providing the Service to you.
Usage Data
We track your plan type, number of leads found, emails sent, and feature usage to enforce plan limits and improve our Service. This data is associated with your account and is never sold or shared with third parties.
Payment Information
Payment processing is handled entirely by Lemon Squeezy. We do not store your credit card number, CVV, or full payment details. We only receive a customer ID and subscription status from Lemon Squeezy to manage your plan.
2. How We Collect Information
- Directly from you: When you sign up, update your profile, upload CSV files, or configure email accounts.
- From third-party APIs: We use Serper.dev and Google Maps to find publicly listed business information based on your search queries. Only your search terms (niche and location) are shared — not your personal data.
- From public websites: We scrape publicly available contact information from business websites that are already indexed by search engines. We only collect information that businesses have made publicly available.
- From Google OAuth: When you connect Gmail, we request the minimum permissions necessary to send emails on your behalf. We do not read, scan, or store the content of your Gmail inbox.
3. How We Use Your Information
- To provide and operate the lead finding, enrichment, and email outreach service
- To authenticate your identity and manage your account
- To send emails on your behalf via your connected Gmail or SMTP accounts
- To generate AI-powered personalized email content using your lead and business data
- To track and enforce plan-based usage limits
- To improve, maintain, and develop new features for the Service
- To communicate with you about your account, updates, or the Service
- To comply with legal obligations
We do not use your data for advertising, profiling, or any purpose not listed above.
4. Lawful Basis for Processing (GDPR)
For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions with similar data protection laws, we process your personal data under the following lawful bases as defined under GDPR Article 6:
| Lawful Basis | When it applies |
|---|---|
| Contract (Art. 6(1)(b)) | Processing necessary to provide the Service you signed up for — account management, sending emails, finding leads, generating reports |
| Legitimate interests (Art. 6(1)(f)) | Usage analytics to improve the Service, fraud prevention, security monitoring. We have assessed that these interests do not override your rights. |
| Consent (Art. 6(1)(a)) | Where you have explicitly provided consent — such as connecting your Gmail account or uploading contact data |
| Legal obligation (Art. 6(1)(c)) | Where processing is required to comply with applicable law — such as responding to lawful requests from authorities |
5. How We Protect Your Information
- All data is stored in Supabase, hosted on AWS infrastructure with SOC2 compliance
- Gmail OAuth tokens and SMTP passwords are encrypted with AES-256-GCM before storage and are never stored in plaintext
- All data transmission uses HTTPS/TLS encryption in transit
- Row Level Security (RLS) is enforced on all database tables — users can only access their own data
- API access is protected with JWT authentication, rate limiting, and input validation on every endpoint
- OAuth state parameters are HMAC-signed to prevent cross-site request forgery (CSRF) attacks
- SSRF protection is implemented on our web scraping infrastructure to prevent internal network access
Data Breach Notification
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and applicable law. Notification will be sent to the email address associated with your account.
6. International Data Transfers
Inertia Leads operates globally and uses third-party service providers based in the United States and other countries. Your data may be processed in countries outside your home country, including the United States, where data protection laws may differ from those in your jurisdiction.
When transferring personal data from the EEA, UK, or Switzerland to countries not recognised as providing adequate protection, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission, or other legally recognised transfer mechanisms.
Our primary service providers and their data locations:
| Provider | Location | Transfer mechanism |
|---|---|---|
| Supabase (AWS) | United States | Standard Contractual Clauses |
| OpenAI | United States | Standard Contractual Clauses |
| Lemon Squeezy | United States | Standard Contractual Clauses |
| Serper.dev | United States | Standard Contractual Clauses |
| Google Gmail API | United States | Google's approved transfer mechanisms |
7. Third-Party Services
We use the following third-party services to operate Inertia Leads. Each provider has their own privacy policy and data handling practices:
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication, file storage | Account data, lead data, encrypted credentials |
| Google Gmail API | Sending emails on your behalf | Email content and recipient addresses you create |
| OpenAI | AI email and audit report generation | Business name, website summary, industry category only — no personal contact data of leads |
| Serper.dev | Lead finding via Google Maps | Search queries only — niche and location |
| Lemon Squeezy | Payment processing and subscription management | Billing name, email address, payment method |
| Railway | Backend hosting infrastructure | Application data processed in transit |
| Vercel | Frontend hosting | No personal data stored |
We do not sell, rent, share, or monetize your personal data or lead data with any third parties for marketing, advertising, or any commercial purpose.
8. Google API Disclosure
Inertia Leads' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We only request the minimum scopes necessary:
gmail.send(to send emails you create) anduserinfo.email(to identify your Gmail address) - We do not read, scan, analyze, or store the content of your Gmail inbox at any time
- We do not use Gmail data for advertising, profiling, or any purpose other than sending emails you explicitly create and approve through our platform
- Gmail tokens are encrypted at rest using AES-256-GCM and can be revoked by you at any time by disconnecting your account in Settings
- We do not share Gmail data with any third parties except as necessary to operate the email sending feature
9. Data Retention
| Data type | Retention period |
|---|---|
| Account information | Retained until you delete your account |
| Lead data and campaigns | Retained until you delete them or delete your account |
| Gmail and SMTP credentials | Retained until you disconnect the email account. Upon disconnection, encrypted tokens are permanently and immediately deleted |
| AI-generated email content | Retained as part of your campaign history until you delete the campaign or your account |
| Payment records | Retained as required by financial and tax regulations — typically 7 years. Payment processing records are held by Lemon Squeezy |
| Usage and analytics data | Retained for 12 months then aggregated and anonymised |
| Account deletion | When you delete your account, all associated data including leads, campaigns, emails, connected accounts, and usage records is permanently deleted via cascade deletion within 30 days |
10. Your Rights
Depending on your location you have the following rights regarding your personal data. We will respond to all requests within 30 days of receipt.
| Right | What it means | How to exercise |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | Email info@inertialeads.com |
| Deletion | Delete your account and all associated data at any time | Settings → Delete account, or email us |
| Portability | Request an export of your lead and campaign data in CSV or JSON format | Email info@inertialeads.com |
| Correction | Update your profile information at any time | Settings page in your account |
| Disconnection | Remove connected Gmail or SMTP accounts at any time, permanently deleting stored credentials | Settings → Connected accounts |
| Objection | Object to processing of your data for legitimate interests purposes | Email info@inertialeads.com |
| Restriction | Request that we restrict processing of your data in certain circumstances | Email info@inertialeads.com |
| Complaint | Lodge a complaint with your local data protection authority | Contact your national DPA |
We will respond to all data rights requests within 30 days of receipt. For complex requests we may extend this by a further 30 days with notification. We will never charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.
11. Cold Email Compliance
Inertia Leads is a tool that enables users to send outreach emails to publicly listed businesses. Users are solely responsible for ensuring their use of the Service complies with all applicable laws and regulations in their jurisdiction, including but not limited to:
| Law | Jurisdiction | Key requirement |
|---|---|---|
| CAN-SPAM Act | United States | Clear identification, honest subject lines, opt-out mechanism, physical address |
| GDPR | European Union | Legitimate interests basis, clear identification, opt-out mechanism |
| CASL | Canada | Express or implied consent required, unsubscribe mechanism, sender identification |
| PECR | United Kingdom | Consent or legitimate interests, opt-out mechanism |
| Spam Act 2003 | Australia | Consent, clear identification, functional unsubscribe |
| UEM Act 2007 | New Zealand | Consent, sender identification, unsubscribe mechanism |
All outbound emails generated through our platform automatically include an unsubscribe option. We strongly encourage all users to respect opt-out requests immediately and maintain suppression lists. Inertia Leads reserves the right to suspend accounts that are reported for spam or that violate applicable email laws.
12. Cookies and Local Storage
Inertia Leads uses the following browser technologies:
| Technology | Purpose | Can be disabled? |
|---|---|---|
| Essential cookies | Authentication and session management via Supabase Auth. Required for the Service to function. | No — strictly necessary |
| localStorage | Maintaining your session state and user preferences within the application. Not used for tracking. | No — required for app function |
| sessionStorage | Temporary session data during your active session. Cleared when you close the browser. | No — required for app function |
We do not use third-party tracking cookies, advertising cookies, or analytics cookies. We do not use any cross-site tracking technology. Your browsing behaviour outside of Inertia Leads is never monitored or collected.
13. Children's Privacy
Inertia Leads is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal data, we will take immediate steps to delete that information from our systems. If you believe a child has provided us with personal data, please contact us at info@inertialeads.com.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make significant changes we will notify you via:
- Email to the address associated with your account at least 14 days before changes take effect
- An in-app notification when you next log in
- A notice on our website at inertialeads.com
Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you do not agree with the changes you may delete your account before the changes take effect.
The date at the top of this policy reflects when it was last updated. We recommend reviewing this policy periodically.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
| Contact method | Details |
|---|---|
| info@inertialeads.com | |
| Website | inertialeads.com |
| Response time | We aim to respond to all privacy enquiries within 5 business days |
| Data rights requests | We respond to all formal data rights requests within 30 days |
Company registration note: Inertia Leads is currently operated as an independent product pending formal company registration. Upon registration, this policy will be updated to include the full legal entity name, registration number, registered address, and appointed Data Protection Officer where required by law.
© 2026 Inertia Leads. All rights reserved.