Notice for authors of public posts

1. What LeadScanner is and who is behind it

LeadScanner is a tool of VERTOM AI sp. z o.o. (ul. Żurawia 45, 00-680 Warszawa, KRS 0001248500) that enables small businesses to find people publicly asking for their service — for example, someone writing in a neighbourhood group that they are looking for a plumber. Our clients identify public groups, pages, subreddits and searches, and the system reads the latest Entries in them and checks whether they match the description of what the client offers.

We read three services: Facebook, Reddit and X (formerly Twitter). Contact for all matters described here: [email protected].

2. Where we obtain your data

Exclusively from content that you have published publicly and that anyone on the internet can see without logging in. We do not log into any account on any of these services, we have no access to your profile beyond what is public, we do not read private groups or personal profiles, and we do not see who reacted to an Entry.

We read Facebook ourselves, as it is seen by a person who is not logged in. We receive content from Reddit and X from an external provider of access to the public resources of those services, established outside the European Economic Area; we send it the name of a subreddit or a search phrase, and receive public Entries together with the names of their Authors. The provider itself decides how it collects that content and acts in relation to your data in its own capacity, not on our instructions. We identify it at useleadscanner.com/legal/subprocessors.

3. What data we collect, why and for how long

We store: the content of your Entry or comment, the first and last name or profile name under which you published it, a link to the Entry and — if it is public — to the profile, the publication date, the address of the Source in which the Entry appeared, and public reaction and comment counters. The system assesses whether the Entry expresses a need for the client's service; the assessment is automated (keywords or a language model) and is never a decision concerning you — the only possible consequence is that the client reads your Entry and decides whether to contact you. For an Entry that the client sees, the system may prepare a reply draft for the client; we never publish or send it.

We collect only Entries from the last seven days and only from those Sources that the client identified by name. A Scan of one Source is a one-time reading of several of the latest Entries, repeated according to the client's schedule; we do not browse the entire service, do not build a profile of any person and do not link your Entries from different Sources.

There is one purpose: to enable the client to contact you regarding what you publicly asked about. The client may not use this data for anything else — in particular, to build databases about people, assess creditworthiness or send you advertising without the consent required by law. We prohibit clients from identifying Sources whose subject matter reveals health, sexual orientation, religion, political views or origin; we determine this prohibition and the client cannot waive it.

4. Who the controller is and on what basis

Two decisions and two entities concern your data. We decide how Entries are read, which fields we store, how long we retain them, which model we use for assessment and which Sources may not be scanned. The client decides which Sources to scan, according to which criteria, and for what purpose it uses the result. Therefore, in relation to your data, we are joint controllers within the meaning of Article 26 GDPR: VERTOM AI sp. z o.o. and the client that identified the Source.

Until 6 September 2026, this page stated that the client alone was the controller and that we processed data on its behalf. This did not reflect how the service actually operates, and we are therefore correcting it.

The basis for processing is legitimate interest (Article 6(1)(f) GDPR): reaching a person who has themselves, publicly, asked for a service provided by the client. The assessment of whether this interest is not overridden by your rights belongs to both joint controllers; the fact that the Entry was public and was itself a question about a service is material to it, but not decisive.

We are the contact point — [email protected] — and it is simplest to contact us. However, you may exercise your rights in relation to each of the joint controllers, regardless of how we have divided tasks between ourselves (Article 26(3) GDPR). At your request, we will identify which client processed your data, insofar as we are able to determine this (section 8).

5. How we inform you and what is missing here

We have no channel of contact with you other than the service in which you published the Entry, and writing to you there would require logging into an account — which we deliberately do not do, because it would give us access to far more than your public Entry. We therefore publish the information here, in every language in which our service operates, and answer every question sent to [email protected].

We say this directly: a public page does not replace information provided to you personally. Until 6 September 2026, we relied here on the exception under Article 14(5)(b) GDPR — that informing you would involve a disproportionate effort. We withdraw that reliance because administrative courts refuse to apply that exception to activity carried out for profit.

We are working to ensure that a statement of how we know about your Entry, and the address of this page, reach you upon the first contact from the client. Until that change is introduced: if a client contacts you in connection with your public Entry, you have the right to ask where it obtained your data, and it is obliged to identify this page to you. You may also at any time request the deletion of data and object to their further collection (section 8) — we honour an objection without asking for a reason.

6. Who sees your data and for how long

Your Entry is seen by the client whose criteria it met, and members of its team. The client may receive a notification about the Entry at its email address, telephone number, Slack channel or in its own system — the notification contains your first and last name, an excerpt of the Entry, a link to the Entry and to your profile, the match score together with a short justification for it and, if the client uses that feature, a draft reply to you prepared by the model. In language-model assessment mode, the content of the Entry, with first and last names, addresses and telephone numbers removed beforehand, is transferred to the model provider — OpenAI Ireland Ltd — under a data processing agreement and processed on OpenAI servers in the United States under standard contractual clauses; it is not used to train models. If your Entry comes from Reddit or X, it previously passed through the provider described in section 2. The full list of companies that help us provide the service, and of the Sources from which Entries come, is available at useleadscanner.com/legal/subprocessors.

We retain data for as long as the client's Plan provides: 30, 365 or 730 days from the date of the Entry. After that time, the content of the Entry and your data are deleted automatically. Entries that were not assessed as matching are deleted at the same time or earlier. When the client terminates its contract with us, its data — including yours — are deleted after 30 days.

7. What we do in our own name

One thing: when you object, we record an irreversible hash of your profile identifier on a suppression list, so that subsequent scans — for every customer — skip your posts. Neither your name nor your profile address can be reconstructed from that hash. We keep this list as a controller, under art. 6(1)(c) and (f) GDPR, indefinitely — because deleting it would mean the system starts recording again the posts of a person who asked us not to.

We do not use your posts to train models, for analyses of our own, or for any other purpose.

8. Your rights and how to use them

You have the right to: object to processing (art. 21 GDPR) — we then stop, without asking why, because an interest in winning a customer does not outweigh your wishes; request erasure (art. 17); request access to your data (art. 15) and information about which customer processed it; request rectification and restriction of processing.

One e-mail to [email protected] with a link to your public Facebook profile or to the post concerned is enough. We need the link to find the right data and to make sure we delete the data of the person who is asking; we do not ask for a scan of any document or for any other data. We carry out objections and erasure requests within 7 days — deleting the data for every customer and adding the hash to the suppression list. We answer other requests within a month.

You may also contact the customer directly if you know who it is; the customer is obliged to forward your request to us.

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in your country.

9. Changes to this notice

We update it when the way the system works, the list of companies we use, or the law changes. This version applies from 2 September 2026. The Polish version is binding; the English one is a translation.