Privacy Policy

The people whose details LeadProof extracts

This is the part of LeadProof that deserves the plainest language, so here it is. When you scan a company’s website, LeadProof extracts personal information about people who are not you and who never installed anything: their names, their job titles, the department their role falls under, and their business email addresses. It also records which pages of that website each of those things was found on.

Every one of those details is taken from what the website itself publishes. LeadProof does not buy data, does not query any third-party database, does not enrich records from another source, and does not infer a person’s details from anything other than the pages you asked it to read. If a name is not on the site, LeadProof does not have it — and it will not invent one: an address like john.smith@example.com produces no person rather than a guessed “John Smith”.

All of it is stored locally, in your browser, on your machine. None of it is transmitted to us or to anyone else, and none of it is sold, shared, pooled, aggregated or used to build any profile or dataset of any kind. We have no copy of it.

You are the data controller for that information. LeadProof is a tool that runs on your computer; what you collect with it, how long you keep it, and what you do with it afterwards are your decisions and your legal responsibility. If you are subject to the UK GDPR, the EU GDPR or a comparable law, the obligations that come with holding other people’s personal data — having a lawful basis, telling them, answering their requests, deleting on request — are yours. Please see Public is not permission to market.

What is stored, and for how long

LeadProof keeps everything in your browser’s own storage, on the extension’s own origin. Nothing here leaves your computer, and removing the extension removes all of it.

• Scans — the website scanned, when, and the counts the scan produced.
• Leads — names, job titles, departments, email addresses, address type and verification status, confidence and lead scores.
• Evidence — for each lead, the signals behind its score, the short quotations they were read from, and the source page URLs.
• Company profiles — what the site publishes about itself, such as its name and location.
• Usage counters — how many leads, addresses and scans you have used this month, so your plan’s allowance can be applied.
• Your settings — theme, whether to respect robots.txt, whether mail-server checks are on, and export preferences.
• Your licence record — Pro only, described below. Anyone who has not bought Pro has no such record.

Retention follows your plan, and it is enforced by deletion. On the free version, scans older than seven days are deleted — the scans and their leads, evidence and company profiles with them. That housekeeping runs when the extension is installed, when the browser starts, and twice a day. On Pro, scans are kept until you delete them. If a Pro licence lapses, the free retention applies again and older scans are removed, so export anything you want to keep.

A plan limit implemented as a filter over data still sitting on disk would be a product that retains everything and says otherwise. This one deletes.

You can erase everything immediately at any time: Settings → Delete all LeadProof data, which removes every scan, lead, evidence record, company profile and usage counter, behind a confirmation step.

Every network request it can make

There are exactly three, and two of them are switched off until you act. This is the complete list — there is no fourth.

• The website you asked it to scan. An ordinary page request, sent without cookies and without a referrer, to the site you named. LeadProof identifies itself honestly rather than impersonating a browser, and it honours robots.txt by default. Chrome asks your permission for that specific site at the moment you press Scan.
• api.freemius.com — only if you buy Pro, and only when you activate, re-check or remove a licence. Described in the next section.
• cloudflare-dns.com — only if you switch on mail-server verification, which is off by default and additionally requires Pro. The request carries the domain of an email address (example.com) and never the address itself, never the local part, and never a name. It asks one question: does this domain have mail servers? Results are cached for the duration of a scan, so one domain is one lookup however many addresses at it were found.

Three further addresses appear in the extension as links you can click — the Freemius checkout and account pages, and our own site, waafaa.com, linked from the popup. Opening one of those is an ordinary visit from your browser to that site. LeadProof does not fetch them, sends them nothing, and attaches no identifier to the visit.

Analytics are not shipped. The settings screen has an analytics toggle and it is off; in this version there is no code behind it that sends anything, anywhere. If that changes it will be described here first, and it will stay off unless you turn it on.

LeadProof Pro and the licence check

Buying Pro is optional. If you never buy it, LeadProof makes no request other than to the websites you scan, and most of this section does not apply to you.

Purchases are handled by Freemius, Inc., our reseller and Merchant of Record. The purchase happens on Freemius’s own checkout page in an ordinary browser tab. LeadProof never sees, handles or stores your card details, your billing address or the email address you buy with. Freemius’s own privacy policy governs that transaction; they are an independent controller of it.

After paying you receive a licence key by email and paste it into LeadProof’s settings. When you do — and only then — LeadProof sends one request to api.freemius.com containing exactly two things:

• the licence key you just entered, and
• a random install identifier, generated on your device with crypto.randomUUID() the first time you activate.

That identifier exists because a licence covers a set number of installations and Freemius has to tell one from another. It is not derived from anything about you or your machine — it is not a fingerprint, not a hardware id, and not a hash of your email. It identifies a copy of the extension and nothing else. Removing your licence discards it.

LeadProof re-checks the licence periodically to see whether it is still valid. Those checks carry the same two things and nothing more. No domain you have scanned, no lead, no address, no name, no count and no setting is ever part of any of these requests.

Removing your licence in Settings releases the installation seat first, then forgets the key and the identifier, and withdraws the extension’s permission to reach api.freemius.com at all.

Permissions, and why each exists

LeadProof asks for the fewest permissions that let it work, and it asks for the sensitive ones later rather than at install.

• storage and unlimitedStorage — to keep your settings, licence record and scan results on your machine. A single scan’s leads and evidence exceed the default 5 MB quota.
• activeTab — to read the address of the tab you currently have open, so the popup can offer that site as the one to scan. The broader tabs permission was deliberately not requested: it would expose every tab’s URL at all times, which this does not need.
• alarms — to keep the extension’s background worker alive for the length of a scan, and to run the retention deletion on a schedule.
• downloads — to save the CSV file when you ask for an export.
• Website access — requested one site at a time, when you press Scan. This is why adding LeadProof shows no “read and change all your data on all websites” warning: at install it holds none of it.
• api.freemius.com — requested when you submit a licence key. cloudflare-dns.com — requested when you switch on mail-server verification.

LeadProof executes no remotely-hosted code. Its content security policy restricts scripts to those shipped inside the package, so the browser will not run anything we did not publish for review.

Public is not permission to market

An email address published on a company’s own website is public information. That is not the same as consent to receive marketing.

Under the UK and EU GDPR, PECR, CAN-SPAM, CASL and their equivalents elsewhere, the obligations that attach to sending unsolicited commercial messages fall on the sender — not on the tool that found the address. Having a lawful basis, identifying yourself, honouring objections and opt-outs, and keeping suppression lists are all your responsibility.

LeadProof states this inside the product on first run as well as here. It does not send email, does not sequence outreach, and does not check addresses against any do-not-contact or suppression list — because it has no honest way to do so.

What LeadProof never does

• We do not sell your data, or anyone else’s.
• We do not transfer it to third parties for any purpose. The only third party involved at all is Freemius, and only for a licence key you chose to buy.
• We do not use it for anything unrelated to the extension’s single purpose, because we do not have it.
• We do not use it to determine creditworthiness or for lending purposes.
• We do not track you across sites, build advertising profiles, or include any advertising or analytics library.
• We do not probe mailboxes. Verification is domain-level only: no SMTP connection is ever opened and no individual mailbox is ever tested.

Your control over the data

Because everything is on your machine, you do not need to ask us for any of it — and we could not produce it if you did.

• See it — every scan and lead is in the extension’s own interface.
• Export it — CSV, saved wherever you choose.
• Delete some of it — delete an individual scan from the history list.
• Delete all of it — Settings → Delete all LeadProof data.
• Delete everything permanently — remove the extension from Chrome, which discards its storage.

If someone whose details you collected using LeadProof asks you to erase them, that request is one you can satisfy entirely yourself, from the history list or the delete-everything control. We hold no copy that would need deleting too.

For the licence record specifically, Freemius holds your purchase and licence information as part of the sale. Requests about that data can be made to them directly, or to us and we will pass them on.

Children

LeadProof is a business tool and is not directed at children. It does not knowingly collect information from anyone under 16, and it has no account system, no sign-up and no profile through which it could.

Changes to this policy

If what LeadProof does with information changes, this page changes with it, in the same release, and the date at the top changes too. A change that would newly send something from your machine will not be made quietly: it will be described here and it will be off until you switch it on.

Contact

LeadProof is made by WaaFaa. For any question about this policy, about what the extension does with information, or to make a data-protection request, write to waafaaofficial@gmail.com. It is read by a person.

Billing, invoices and refunds are handled by Freemius, Inc., our reseller and Merchant of Record, at users.freemius.com.