Security & privacy
Your contacts and conversations stay yours
Cold Leads holds your client list and your e-mail conversations. Here is exactly how we protect them, and what we promise about who can see them. The same promises are written into our Terms and Privacy Policy.
Only your team sees your workspaceContacts, chats, templates and campaigns belong to one account. Every request is checked against that account, and only you and the teammates you invite can open it.
We don't look at your dataCold Leads staff do not open your contacts, messages or campaigns. The only exceptions: you ask us for help and allow it, we investigate abuse flagged by the automated check or a report, or the law requires it.
Never sold, never used for ads or AI trainingWe don't sell personal data, don't share it for advertising and don't use it to train AI models.
Encrypted on the wayEvery page and API call goes over HTTPS with HSTS, and the connection between our servers and the database is encrypted too.
Passwords we can't readYour login password never reaches our database: Firebase Authentication keeps only a salted scrypt hash. Sign in with Google and there is no password with us at all.
Mailbox access encryptedSMTP passwords and Gmail / Microsoft 365 access tokens are encrypted with AES-256-GCM before they are stored, with the key kept outside the database.
Keys stored only as hashesSecret API keys and the tokens of connected AI apps (ChatGPT, Claude) are stored only as hashes. We show a key once and can't show it again.
Cards never touch our serversPayments run on Stripe (PCI DSS Level 1). We keep only payment identifiers, never card numbers.
Your CRM is never recordedAnonymised session replays help us improve the website. Inside the app all on-screen content is masked, so your contacts and messages never appear in them. Analytics cookies load only after you agree.
Export or delete any timeIn Settings → Your data, download your contacts as CSV or all your data as a file, or delete the account: contacts, messages, campaigns and templates are erased.
Automated checks and AI, in plain words
- E-mails, chat replies and AI drafts pass an automated abuse check (OpenAI Moderation) before they are sent. If a text is flagged, a short excerpt is kept so a person can review the case.
- AI drafts and the Frosty assistant send only the text they need to OpenAI; under OpenAI's API terms it is not used to train models. Frosty never sees your contacts' data.
- We run on Vercel (hosting, in Paris), Supabase (the database, stored in the EU — Paris), Firebase (sign-in), Stripe (payments) and Resend (e-mail delivery). The full list of subprocessors is in the Privacy Policy.
For businesses
- For your contacts' data you are the controller and we are your processor. Our Data Processing Agreement (GDPR Art. 28) is part of the Terms and applies automatically — nothing to sign.
- Operator: Anton Tkachenko, Czech Republic (EU). The GDPR applies to all data in Cold Leads.
- If we ever learn of a breach affecting your data, we tell you without undue delay. Found a security issue? Write to support@coldleads.app.
What we can and can't promise
No online service can honestly promise it will never be attacked. What we can promise — and put in writing — is how your data is protected, who may see it and that it is never sold or used for anything but your work in Cold Leads.
Binding versions:Terms of Service·Privacy Policy·Data Processing Agreement·Remove my e-mail