Privacy Policy

Effective Date: October 23, 2026 • Last Updated: October 23, 2026

1. Introduction

Sales Lead Generator ("we", "us", or "our") is a B2B sales intelligence and pipeline CRM platform operated by Moldován Csaba Kft. This Privacy Policy details our practices regarding the collection, use, processing, and protection of your data when using our web application, APIs, and integrated mailbox services (the "Service").

2. Google API Services User Data Policy & Limited Use Disclosure

Sales Lead Generator integrates with Google APIs (including the Gmail API, Google Calendar API, and Google Contacts API) to empower commercial sales representatives to send outreach emails directly from their own mailbox, schedule meetings with automated Google Meet links, and synchronize prospect replies into the CRM timeline.

3. How to Connect Your Mailbox (Google / Gmail)

Sales representatives connect their individual Google Workspace or personal Gmail accounts directly to Sales Lead Generator using standard OAuth 2.0 with PKCE (Proof Key for Code Exchange):

1. Navigate to Email & Integrations in the app navigation menu (or click your profile avatar).
2. Under Personal Mailboxes (Google / Gmail), click Connect with Google.
3. You are redirected to Google's secure authorization page (accounts.google.com) to select your account and review permissions.
4. Upon clicking Allow, Google returns an authorization code that our server exchanges for encrypted OAuth tokens.
5. Your connected email address appears in your integration hub with instant Sync, Test, and Disconnect controls.

Exact Google Scopes Requested & Purpose:

4. How We Receive & Synchronize Emails

When synchronizing incoming emails, Sales Lead Generator uses a strict Data Minimization Filter:

• CRM Contact Filtering: The sync engine examines message participant headers. If an email thread does NOT involve a recognized lead or contact registered in your CRM workspace, the message is immediately skipped. Personal and non-CRM emails are never fetched, parsed, or stored.

• Internal Domain Shielding: Purely internal colleague correspondence (staff syncs, payroll filings, administrative notices) is automatically excluded from lead records.

• User Mailbox Isolation: Representatives only have access to their own connected mailboxes and assigned leads. If an authenticated session cannot be verified, the inbox fails closed with zero threads displayed.

5. How We Send Emails via Our Service

When an authorized sales representative sends an outreach email or schedules an automated cadence:

• Direct REST API Dispatch: Messages are sent directly through Google's official Gmail REST API using your authenticated credentials. Messages originate from your genuine corporate address with full SPF, DKIM, and DMARC alignment.

• Thread Continuity: Outbound follow-up messages automatically include standard RFC 2822 In-Reply-To and References headers to preserve conversation threads in recipient clients.

• Signature Synchronization: Primary Gmail SendAs signatures are synchronized and formatted with RFC 3676 delimiters.

• Automatic Stop on Reply: When a recipient responds, the active cadence sequence is immediately stopped to prevent redundant follow-ups.

6. Data Security & Token Encryption

We employ robust administrative, physical, and technical safeguards to protect your data:

• AES-256-GCM Encryption at Rest: All stored Google OAuth access tokens and refresh tokens are encrypted at rest using AES-256-GCM authenticated encryption with random nonces before persisting to the database.

• TLS 1.3 in Transit: All web traffic and API calls operate exclusively over encrypted HTTPS/TLS 1.3 connections.

• Multi-Tenant Isolation: Data is strictly partitioned by brand and tenant boundaries at the database and query layer.

7. Account Disconnection & Data Deletion

You maintain complete control over your connected accounts:

• 1-Click Disconnect: In the app, open Email & Integrations and click Disconnect next to any connected Google account. The server immediately revokes the OAuth token with Google and deletes all encrypted credentials from active storage.
• Revoke via Google: You can also revoke access anytime at myaccount.google.com/permissions.
• Data Erasure Requests: To request deletion of all associated personal and activity data, email moldovancsaba@gmail.com.

8. Your Rights & Contact Information

Under GDPR, CCPA/CPRA, and relevant privacy laws, you have the right to access, rectify, port, or request erasure of your personal information.