Back
Privacy Policy for LeadHunt AI
Elke Hwang (LeadHunt AI) Privacy Policy Version 2.0 · Last Updated: August 6, 2026 This Privacy Policy explains what data LeadHunt AI collects, why, who we share it with, how we protect it, and what rights you have. It applies to https://leadhuntai.com (the "Website") and the lead generation service provided there (the "Service"). The Service is operated by Elke Hwang, an individual sole trader based in the Hong Kong Special Administrative Region, who is the data controller for the purposes of this policy. Contact: support@leadhuntai.com. This policy forms part of, and should be read together with, our Terms of Service (https://leadhuntai.com/tos). THE SHORT VERSION - If you create an account we hold your email address and your subscription status — nothing more. - Your searches and their results are never stored on our servers. - We never receive or store your full card number. Payments are handled by Waffo Pancake (and, for legacy subscriptions, Paddle). - We use third parties for authentication, database, payments, email, hosting, and analytics — all named in Section 5 below. - We do not sell your personal data. - Our Service returns business contact details about other people. If you are one of those people and want your details removed, see Section 4. - You can access, correct, export, or delete your data at any time — see Section 8. 1. Data Controller - Operator: Elke Hwang, individual sole trader - Jurisdiction: Hong Kong Special Administrative Region - Privacy contact: support@leadhuntai.com - Data Protection Officer: not applicable (we do not meet the appointment threshold) 2. Personal Information We Collect 2.1 Account Data When you sign up we collect and store: - Your email address. - Your authentication provider and account identifier (for example, that you signed in with Google, or that you used an emailed sign-in link). - Your subscription or plan status, and whether you currently have paid access. We use this to create and secure your account, unlock paid features, and contact you about your account. 2.2 Search Queries and Results — Not Stored Your searches are run against third-party sources and the results are returned directly to your browser. We do not store your search queries, and we do not keep a copy of the contact records returned to you. Once you leave the page, that data exists only where you saved it yourself. As a consequence, we cannot re-send you a past result set, and we have no search history to disclose in response to a legal request, because none exists. 2.3 Billing Records When you subscribe we store a record of the transaction — plan purchased, amount, currency, date, subscription status, and a transaction or subscription reference — for accounting, refund handling, and dispute resolution. We never receive or store your full card number, expiry date, or security code. Card details are handled entirely by our payment processors (Section 5.2). 2.4 Communications Emails you send us, support requests, and feedback, together with our replies. 2.5 Technical and Analytics Data Our hosting provider and analytics tools automatically receive standard technical information when you visit: IP address, browser type and version, device type, operating system, referring page, time zone, and the pages you view. This is used for security, to keep the site running, and to understand aggregate traffic patterns. We do not collect precise location data, and we do not ask for it. 3. Why We Process Your Data, and On What Legal Basis Purpose — Legal basis: - Creating and running your account, delivering search results — Performance of a contract - Billing, subscription management, refunds, cancellations — Performance of a contract - Customer support — Performance of a contract / Legitimate interests - Service notices (billing, security, policy changes) — Legitimate interests - Security, fraud prevention, and abuse investigation — Legitimate interests - Aggregate analytics and product improvement — Legitimate interests - Retaining accounting and tax records; answering lawful requests — Legal obligation - Marketing email about features and offers — Your consent (Section 10) Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object at any time (Section 8). We may aggregate or anonymise data for statistical purposes. Such data cannot be linked back to any individual. 4. Business Contact Data Returned by the Service This section is about people who appear in our search results, rather than about our customers. The Service compiles business contact information — such as work email addresses, job titles, employers, and company details — from publicly accessible web sources and third-party data providers, and returns it to our customers for business-to-business outreach. We rely on legitimate interests as the lawful basis for this processing, limited to information about people in their professional capacity. We do not knowingly collect special-category data, and we do not target individuals in a private capacity. Once a customer receives a contact record, that customer acts as an independent data controller in respect of it and is responsible for their own lawful basis, notices, and opt-out handling. This is set out in Section 9.2 of our Terms of Service. If your business contact details appear in our results and you want them removed: Email support@leadhuntai.com with the email address or details concerned. Because we do not store search results (Section 2.2), there is no stored copy of your record for us to delete. What we do instead is add the address to a suppression list, so that it is filtered out of any future results the Service returns. We will act within thirty (30) days and confirm when it is done. We cannot recall records that a customer has already received, and we cannot remove your details from the public web pages or third-party providers they were compiled from — for that you will need to contact those sources directly, and we will tell you which ones we queried if you ask. 5. Who We Share Data With We do not sell your personal data, including as that term is defined under the CCPA/CPRA, and we do not share it for anyone else's independent marketing. We do rely on the following service providers, each of which processes data on our behalf or as an independent controller for their own service: 5.1 Authentication and Database - Supabase — stores your account record, email address, and subscription status, and handles sign-in sessions. - Google — if you choose "Continue with Google", Google authenticates you and provides us with your email address and basic profile identifier. Your use of Google sign-in is also governed by Google's privacy policy. 5.2 Payments - Waffo Pancake — our current payment processor and merchant of record. - Paddle — retained for subscriptions created before our migration to Waffo Pancake. These processors handle checkout, card data, subscription billing, and refunds. They receive your email address and payment details directly from you; we receive back only the transaction record described in Section 2.3. Each operates under its own privacy policy and is PCI-DSS compliant. 5.3 Email - Mailgun — used to deliver transactional email such as sign-in links, receipts, renewal notices, and account notices. 5.4 Hosting and Delivery - Cloudflare — hosts and serves the Website, and provides security and DDoS protection. Cloudflare processes connection data including your IP address. 5.5 Search and Data Providers Third-party search and business-data APIs that we query to compile results. These providers receive the search parameters needed to run a query; they do not receive your account identity. 5.6 Analytics - pageview.app — privacy-oriented, aggregate website analytics. - Google Ads (tag ID AW-17460992689) — measures conversions from our advertising, such as which visits led to a sign-up or purchase. You can opt out of personalised Google advertising at https://adssettings.google.com. 5.7 Legal Disclosure We may disclose data where required by law, court order, or a binding request from a competent authority, or where necessary to establish, exercise, or defend legal claims — including in response to a payment dispute or chargeback. 5.8 Business Transfer If the Service is sold or transferred, account data may transfer with it, subject to continued protection under this policy. We will notify registered users by email before that happens. 6. Cookies and Tracking Category — Purpose — Can you disable it? - Strictly necessary — sign-in session cookies set by Supabase, and cookies required for core functionality — No; the Service cannot function without these - Analytics — pageview.app and Google Ads conversion measurement — Yes - Advertising — Google Ads conversion tags used to measure our own campaigns — Yes We do not display third-party advertising on the Website, and we do not use advertising cookies to profile you for other advertisers. You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent sign-in from working. 7. How Long We Keep Data - Account data — kept while your account is open. Following cancellation or a deletion request, retained for ninety (90) days and then deleted. The 90-day window exists so that you can recover an account deleted by mistake, and so that we can resolve any billing dispute raised shortly after departure. - Search queries and results — not retained at all, because they are never stored (Section 2.2). - Billing records — retained for as long as required by applicable tax and accounting law, and to defend payment disputes, even after your account is deleted. These records are minimised to the transaction detail in Section 2.3. - Support correspondence — retained for two (2) years, then securely deleted. - Security and access logs — retained for twelve (12) months, then securely deleted. - Suppression list entries (Section 4) — retained indefinitely, because deleting them would cause the removed record to reappear in future results. Suppression entries hold only the minimum needed to block the record (a hashed address). 8. Your Data Rights Depending on where you live, you have the right to: - Be informed — know what data we hold and how we use it, which is what this policy is for. - Access — obtain a copy of the personal data we hold about you. - Rectification — correct data that is inaccurate or incomplete. - Erasure — delete your account and associated data, subject to the billing-record exception in Section 7. - Restriction — ask us to pause processing while a dispute is resolved. - Portability — receive your data in a structured, machine-readable format. - Object — object to processing based on legitimate interests, including profiling, and to direct marketing at any time. - Withdraw consent — for marketing email or non-essential analytics, at any time, without affecting processing already carried out. How to exercise them: - Self-service: sign in and open your Account menu. "Download my data" gives you a JSON copy of everything we hold about you. "Delete account" cancels any active subscription and permanently erases your account. "Cancel subscription" ends billing without deleting the account. - By email: write to support@leadhuntai.com from your registered address, stating which right you wish to exercise. We will respond within thirty (30) days. We may need to verify your identity before acting on a request, and we will tell you if we need more time or if an exception applies. Exercising these rights is free, and we will not discriminate against you for doing so. If you are a California resident, you additionally have the right to know what personal information is collected and disclosed, the right to deletion and correction, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. You may also lodge a complaint with your data protection authority. In Hong Kong this is the Office of the Privacy Commissioner for Personal Data (PCPD); in the EEA or UK it is your national supervisory authority. 9. How We Store and Protect Your Data Where your data is stored: account, search, and result data is held in our Supabase database, hosted on managed cloud infrastructure with encrypted storage at rest. The Website itself is served through Cloudflare. Technical measures: - Encryption in transit — HTTPS/TLS is enforced across the entire Website and all API traffic. - Encryption at rest — database storage and backups are encrypted by our infrastructure provider. - No credentials in our hands — passwords are not stored by us; authentication is handled by Supabase using Google OAuth or single-use emailed sign-in links, so there is no reusable password for an attacker to steal. - No card data in our hands — full card numbers never reach our servers (Section 5.2). - Row-level access control — database rules restrict each account to its own records. - Least-privilege administrative access — administrative access is limited to the operator, protected by multi-factor authentication, and secrets are stored in a managed environment rather than in source code. - Network protection — Cloudflare provides DDoS mitigation, bot filtering, and a web application firewall in front of the Service. - Backups — taken regularly and encrypted, so that data can be restored after an incident. - Review — dependencies are kept patched and access is reviewed periodically. Organisational measures: data is accessed only where necessary to operate the Service, provide support, or comply with law. Any contractor with access is bound by confidentiality obligations. Breach notification: no system is completely secure. If a breach affecting your personal data occurs, we will notify the relevant supervisory authority within seventy-two (72) hours of becoming aware of it where the law requires, and we will notify affected users without undue delay, describing what happened, what data was involved, and what you should do. Your part: keep your email account secure, since sign-in links are delivered there, and do not share access to your account. Tell us immediately at support@leadhuntai.com if you suspect unauthorised access. 10. Marketing and Opt-Out With your consent, we may send you email about new features, tips, and offers. You can opt out at any time by clicking "Unsubscribe" in any marketing email, changing the setting in your account, or emailing support@leadhuntai.com. Opting out of marketing does not stop essential service messages — sign-in links, receipts, renewal and price-change notices, security alerts, and changes to these policies — because we need to send those to run your account. 11. Where Your Data Is Processed We operate from Hong Kong SAR. The service providers listed in Section 5 process data in various countries, including the United States and the European Union. Where data originating in the EEA or UK is transferred outside those regions, our providers rely on Standard Contractual Clauses, an adequacy decision, or an equivalent recognised transfer mechanism, supported by data processing agreements. 12. Children The Service is intended for business users aged 18 and over, as set out in Section 1 of our Terms of Service. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@leadhuntai.com and we will delete it promptly. 13. Third-Party Links and Services The Website may link to, or integrate with, third-party services. This policy covers only data we collect directly. We are not responsible for third-party privacy practices and encourage you to review their policies before use. 14. Changes to This Policy We may update this policy to reflect changes in our practices, our providers, or the law. Material changes will be notified to registered users by email and by notice on the Website at least fourteen (14) days before taking effect. The "Last Updated" date at the top of this page always reflects the current version. 15. Contact For any privacy question, data request, removal request, or complaint: support@leadhuntai.com — we reply within two (2) business days and complete rights requests within thirty (30) days. Operator: Elke Hwang (sole trader), Hong Kong SAR Related documents: Terms of Service (https://leadhuntai.com/tos) · Refund Policy (https://leadhuntai.com/refund-policy) Last Updated: August 6, 2026 · LeadHunt AI · https://leadhuntai.com