Privacy Policy

1. Controller and contact

The controller of your data is VERTOM AI sp. z o.o., ul. Żurawia 45, 00-680 Warszawa, Poland, KRS 0001248500, NIP 7011319192. For anything concerning personal data, write to [email protected]. We have not appointed a data protection officer; this address is the point of contact for data protection matters.

2. What data we process and where it comes from

Account: e-mail address, name, password as an irreversible hash, chosen language, date the e-mail address was confirmed, date and version of the accepted terms and of consents given, and the two-factor authentication secret (encrypted) if you enable it. You provide these yourself at registration and in settings.

Organisation: company name, time zone, description of the offer, exclusions and service area, the list of scanned sources and keywords, the scan schedule, notification channels (the e-mail addresses, phone numbers, webhook URLs and Slack channels you set; integration secrets are encrypted). Provided by the owner or a team member.

Billing: company name, tax ID, address, invoice e-mail address, customer and subscription identifiers in Stripe, payment history and invoices. We neither see nor store card details — they go to Stripe only.

Team: the invited person's e-mail address, role, and who invited them. Provided by the person inviting.

Security log: who did what and when in an organisation (for example a settings change, an invitation, a data export), and — on the operator side — every reading of personal data outside the ordinary operation of the service.

Technical data: IP address and browser identifier at login, registration and acceptance of the terms; IP address on failed login attempts; application error events with personal data stripped; product events (such as “wizard completed”, “trial started”) attributed to an organisation identifier, not to a person.

Acquisition source: the campaign parameters in the address you opened our website under (utm), the address of the site that referred you, the first page you visited and the time of that visit, and — if you answer it — your answer to the “how did you hear about us” question in the setup wizard. We store them at registration, against the organisation's account.

Correspondence: the content of messages you send us and your e-mail address.

We do not process special categories of your data and do not ask for them.

3. Why, and on what legal basis

Providing the service — creating and running the account, scanning, notifications, billing, team management, answering your requests: art. 6(1)(b) GDPR (a contract you are a party to or act on behalf of).

Issuing and keeping invoices, tax settlements, answering requests from individuals and authorities: art. 6(1)(c) GDPR (legal obligation).

Security — blocking intrusion attempts, detecting abuse, the security log, error monitoring, backups: art. 6(1)(f) GDPR (our legitimate interest in protecting the service and its users).

Understanding how the product is used — counting product events at organisation level, without cookies and without identifying a person: art. 6(1)(f) GDPR (legitimate interest in developing the product). You may object (section 8).

Establishing how a customer found us — campaign parameters, the referring site and the answer to “how did you hear about us”: art. 6(1)(f) GDPR (legitimate interest in assessing how effective the channels we reach customers through are). You may object (section 8).

Documenting acceptance of the terms and consents: art. 6(1)(c) and (f) GDPR (the accountability obligation of art. 7(1) GDPR and our interest in proving the content of the contract).

Telling you about product news by e-mail: only with your consent (art. 6(1)(a) GDPR and art. 398 of the Polish Electronic Communications Law). You may withdraw consent at any time in account settings; withdrawal does not affect the lawfulness of earlier messages. Messages necessary to provide the service — about leads, payments, account security, changes to the terms — are not commercial communications and need no consent.

Providing data is voluntary, but without an e-mail address, a password and acceptance of the terms an account cannot be created, and without invoice details a plan cannot be bought.

4. How long we keep data

Account and organisation data: for the duration of the contract and, after a deletion request, a 30-day grace period during which the decision can be reversed; then we delete it irreversibly.

Invoices and the data needed to issue them: 5 years from the end of the tax year in which the tax obligation arose.

The organisation's security log: until the organisation is deleted; entries concerning the exercise of individuals' rights are kept in anonymised form (without who acted) to show that the request was carried out.

Records of acceptance of the terms and consents: for the duration of the contract and 3 years after it ends (the limitation period for claims).

Lockout after failed logins: 1 hour. Session: access token 15 minutes, refresh up to 14 days, the whole session no longer than 30 days.

The account data export package: 24 hours from generation. Error events in the monitoring system: 90 days. Server backups: according to the hosting provider's schedule; data deleted from the database disappears from backups as they rotate.

5. Who receives data

We use providers that process data on our behalf under data processing agreements: hosting and backups, payment processing, e-mail and SMS delivery, error monitoring, product analytics, invoicing. The full, current list with each provider's country and role is at useleadscanner.com/en/legal/subprocessors.

For fraud prevention and regulatory purposes, Stripe Payments Europe Ltd. is an independent controller of payment data; its privacy policy is at stripe.com/privacy.

We may disclose data to public authorities where the law requires it, and to legal and accounting advisers bound by professional secrecy, to the extent necessary for their work.

We do not sell data and do not share it for third parties' marketing.

6. Transfers outside the European Economic Area

We store data on servers in the EEA. Some providers (payment processing, e-mail delivery, error monitoring) are based in the United States. We transfer data to them under the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and, should it be invalidated, under the Commission's standard contractual clauses, which we have in place with each of them. The provider of the language model used in AI mode (OpenAI) processes post content on servers in the United States solely under the standard contractual clauses incorporated into its data processing agreement. A copy of the clauses is available on request.

7. Cookies and browser storage

The useleadscanner.com website does not set its own cookies. Visit analytics works without them: the visit identifier is not linked to a person and does not survive the closing of a tab, and the IP address is discarded on the provider’s side. We do not use advertising tools. We serve fonts from our own server, without connections to third parties.

On your first visit, we ask about one thing: whether we may load the Calendly calendar on the implementation page. Until you consent, the calendar does not load and no Calendly cookie is created—instead, you see a link that opens Calendly in a new tab, subject to their terms. We remember only your response (the leadscanner.consent key in local storage), because otherwise we would ask every time you visit; you can withdraw your consent below the calendar. This record itself is also the storage of information on your device within the meaning of Article 399(1) of the ustawa Prawo komunikacji elektronicznej (Electronic Communications Law); it is necessary to provide the service you request—remembering your choice—so it does not require consent (Article 399(3)(2)). Refusal does not block anything other than the calendar embedded on the website.

The app.useleadscanner.com panel sets one cookie: ls_refresh, which keeps your session active after you log in. It is necessary to provide the service you requested, is available exclusively to the server (HttpOnly), and is transmitted only over an encrypted connection. It expires after 14 days or when you log out. Under Article 399(3) of the ustawa Prawo komunikacji elektronicznej, it does not require consent and is not covered by the banner.

The panel uses the browser’s local storage (localStorage) to remember an unfinished configuration wizard and your interface preferences. This data does not leave your browser, is necessary for the operation of the functions you use (Article 399(3)(2)), and disappears when you log out or clear the website data.

Product analytics in the panel works without cookies and without persistent storage: the identifier is the organisation, not a person, and the IP address is discarded on the provider’s side.

8. Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest — including product analytics. You may withdraw marketing consent at any time.

Most of this you can do yourself in the panel: edit account and organisation data in settings, download a copy of all your data with one click (“Download data”), and delete the account and the organisation in the same place. Send other requests to [email protected]; we reply within a month and, in complex cases, tell you if we need longer.

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in the country of your habitual residence.

9. Automated decisions

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. The automatic lockout after five failed logins lasts one hour and protects your account.

10. Security

Passwords are stored only as Argon2 hashes. Connections are encrypted. Integration secrets are encrypted at rest. Each organisation's data is isolated and identified by random identifiers. Operator accounts require two-factor authentication, and every reading of personal data by an operator is logged. We recommend enabling two-factor authentication on your account too.

11. Authors of Entries and changes to the policy

We process the data of authors of public Entries read by the system as a joint controller together with the client that indicated the Source, under the terms of the joint controllers’ arrangement (useleadscanner.com/legal/joint-controller-arrangement). Until 6 September 2026, the policy stated that we processed them on behalf of the client as a processor; this did not reflect how the service operates. What happens to such an Entry and how to object to it is described in the Notice for Authors of Entries: useleadscanner.com/legal/notice-for-authors.

We change the policy when the product, providers or the law changes. We inform you of changes material to you by email or in the panel. Effective date of the current version: 7 September 2026.