Privacy Policy

Effective November 1, 2026

1. Who we are

LocatingLeads (the "Service") is operated by Ty Ciccarello, a sole proprietor based in Florida, United States ("we", "us"). Questions about this policy go to ciccarelloty@gmail.com.

This policy covers the website at locatingleads.com, the app at app.locatingleads.com, and the unsubscribe pages linked from emails sent through the Service.

2. What we collect

From you, as a customer

• Account details: your email address, a password (stored only as a one-way hash), your name, your business name, the physical mailing address you choose to show in your emails, and your timezone.
• Billing: your plan and subscription status. Payments are handled by Stripe. We never see or store your full card number.
• Usage: how many searches, drafts, audits and sends your account uses, so we can apply your plan's limits.
• Technical data: a session cookie that keeps you logged in, and standard server logs (IP address, browser, time of request) kept for security and troubleshooting.

From your Google account

• When you connect Gmail, we receive your Google account's email address and an access token with the gmail.send permission. That permission lets the Service send the emails you approve from your address. It does not let us read, search, change or delete anything in your mailbox.
• If you also choose to add a Gmail app password, the Service uses it to check your mailbox, over IMAP, for replies to and bounces of emails the Service sent for you. It looks only at those conversations, so it can stop follow-ups to people who replied and stop sending to addresses that bounced. It records that a reply or bounce happened.
• Tokens and app passwords are encrypted before they are stored. You can disconnect either one in Settings at any time, which deletes it from the Service. You can also remove the Service's access from your Google account at myaccount.google.com/permissions.

About the businesses you contact

The Service finds local businesses from public sources: Google Maps listings (through the Google Places API) and the businesses' own public websites, including contact email addresses they publish. It stores those details, the website and Maps audits it runs, the drafts you approve, and whether each email was sent, replied to, bounced or unsubscribed. For this information you, the customer, decide whom to contact and what to send; we process it on your behalf.

From people who receive emails sent through the Service

If you unsubscribe using a link in one of these emails, we keep your email address on a do-not-contact list for the sender who emailed you, so they cannot email you through the Service again. If an address bounces, we keep it on a shared list so no customer sends to it again.

From visitors to our website

If you join the waitlist, we receive the email address you enter, through our form provider Formspree.

3. How we use it

• To provide the Service: finding and auditing businesses, writing drafts for you to review, sending the emails you approve, and detecting replies, bounces and unsubscribes.
• To bill you and apply your plan's limits.
• To send you account emails, such as password resets, billing notices and notices that sending on your account was paused.
• To keep the Service secure and working: preventing abuse, enforcing our Acceptable Use Policy and fixing errors.
• To comply with the law.

We do not sell or rent personal information, do not share it for advertising, and do not use your data to train AI models.

4. Google user data

The Service's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. In particular:

• We use Google user data only to send the emails you approve and to show you their status.
• We do not transfer it to anyone except as needed to provide the Service, to comply with the law, or as part of a merger or sale with notice to you.
• We do not use it for advertising and do not sell it.
• No person reads it unless you ask us to for support, it is needed for security or legal reasons, or it has been made anonymous.
• We do not use Google user data to develop, improve or train AI models.

5. Who we share it with

We use these service providers to run the Service. Each receives only what it needs for its job:

• Render: hosting and the database.
• Vercel and Upstash: this website and the unsubscribe pages, and the list of unsubscribed addresses.
• Stripe: payments and subscriptions.
• Google: sending your email through Gmail, and the Google Places and PageSpeed APIs for business data and website audits.
• Anthropic: the AI model that writes drafts. It receives the business details and audit results needed to write each draft. Under Anthropic's commercial terms, this data is not used to train its models.
• Resend: sending account emails such as password resets.
• Sentry: error reports, which exclude request contents, cookies and headers.
• Formspree: the waitlist form.

We may also disclose information if required by law, or to protect the rights or safety of our users, the public or the Service.

6. How long we keep it

• Your account data is kept while your account is open.
• When you delete your account in Settings, its businesses, contacts, drafts, settings, usage records, Gmail connection and logins are deleted right away, and the Gmail connection is revoked at Google. Copies in database backups are overwritten within 30 days.
• Unsubscribe and bounce lists are kept indefinitely, because their purpose is to make sure those addresses are never emailed again.
• Billing records are kept as long as tax law requires.

7. Your choices and rights

• You can see and change most of your data in the app, and delete your account in Settings.
• You can ask us for a copy of your data, or to correct or delete it, by writing to ciccarelloty@gmail.com. We will answer within 30 days.
• If you received an email sent through the Service and want your address removed from the business data a customer holds, use the unsubscribe link in the email or write to us.
• Depending on where you live, you may have additional rights under local law. We will honor them where they apply.

8. Security

Connections use HTTPS. Passwords are hashed, and Gmail tokens and app passwords are encrypted. Each customer's data is kept separate from every other customer's. No system is perfectly secure, and we will notify you without undue delay if a breach affects your data.

9. Cookies

The app uses one cookie, which keeps you logged in. We use no advertising or tracking cookies.

10. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children.

11. Changes

If we change this policy, we will update the date at the top. If the change is significant, we will also email customers before it takes effect.

12. Contact

Ty Ciccarello, LocatingLeads, Florida, United States
ciccarelloty@gmail.com