Privacy Policy

1. Who we are

Warmleadz is the controller of the personal data we collect about our customers and website visitors - for example, your account, billing and usage information.

For the prospect data the Agent and Extract process on a customer’s behalf (see section 3), Warmleadz acts as a processor (or “service provider”) and processes that data on the customer’s instructions. The customer is the controller of that data.

2. Information we collect about you

Account information

Your name, email address, password (stored only as a secure hash by our authentication provider), company name and website, your ideal customer profile, and your settings. If you sign in with Google, we receive your name, email address and profile picture from Google. If you invite teammates, we collect their email addresses to send the invitation.

Billing information

Payments are processed by Dodo Payments. We receive your billing name, email, country, the products you bought, and payment status. We do not receive or store your full card number or security code. Dodo Payments handles payment data under its own privacy policy.

Connected accounts

To run outreach, the Agent works through the LinkedIn account you connect. Account connection and message delivery are handled through a third-party LinkedIn outreach and data-enrichment provider (see section 6). We store the resulting campaign data - the prospects contacted, the messages sent, and the replies received - so you can see and manage them in GTM Plays. If you connect integrations (such as a webhook, Slack, Clay or Zapier) we store the URLs and settings you provide.

Usage and device information

How you use the Service (pages viewed, features used, orders and agents created), and technical data such as IP address, browser and device type, and error reports. We use it to run, secure and improve the Service.

Communications

Messages you send us by email or through the in-app support chat, and our replies.

3. Prospect data we process for customers

The Agent and Extract process information about third parties - the prospects our customers want to reach. This is public professional profile data: name, job title, company, headline, location, LinkedIn profile URL, and information about the prospect’s company. Where a customer asks for enrichment, it can also include a work email address or phone number. For the Agent it also includes the signals that surfaced the prospect (for example, engagement with a public post), and the messages exchanged with them.

• We process prospect data only to provide the Service to the customer who requested it, on that customer’s instructions. We do not sell it, and we do not share one customer’s lists with another customer.
• We do not access private LinkedIn data, such as private messages of people who are not using GTM Plays, or content that requires a connection to view.
• Customers are responsible for having a lawful basis to process prospect data, for giving any required notices, for honoring opt-outs, and for making sure their outreach complies with applicable laws (such as the GDPR, the CAN-SPAM Act and India’s Digital Personal Data Protection Act, 2023) and with LinkedIn’s terms.

If you are a prospect and want to know what we hold about you, or want it deleted, email support@gtmplays.io. We will delete the data we hold about you on our systems where we are able to, and where the data belongs to a specific customer we will pass your request on so they can act on it too.

4. How we use information

• Provide, operate and maintain the Service, including running your agents and orders.
• Process payments, manage subscriptions, credits and lifetime deals.
• Send service emails, such as order-ready notices, billing receipts, security alerts and low-credit warnings.
• Respond to support requests.
• Detect, prevent and investigate fraud, abuse and security incidents, and fix errors.
• Understand how the Service is used so we can improve it.
• Comply with legal obligations and enforce our Terms.

We use AI providers to analyze websites, draft ideal customer profiles, score prospects and write messages. We do not use your data or prospect data to train our own or third-party general-purpose AI models.

5. Legal bases

Where laws such as the GDPR apply, we rely on these legal bases:

• Contract - to provide the Service you signed up for.
• Legitimate interests - to secure, maintain and improve the Service, and to communicate with you about it, balanced against your rights.
• Consent - where we ask for it; you can withdraw it at any time.
• Legal obligation - for example, keeping tax and accounting records.

Where India’s Digital Personal Data Protection Act, 2023 applies, we process your data for the purposes you provided it for (such as using the Service) and other legitimate uses the Act permits.

6. Service providers and sharing

We share personal data only with service providers that help us run the Service, under contracts that limit how they can use it, and when the law requires it. Our current providers (sub-processors) are:

• Supabase - database, authentication and file storage.
• Vercel - hosting and content delivery.
• Vercel Analytics - aggregate, privacy-friendly website analytics.
• Dodo Payments - payment processing and subscription billing.
• Resend - transactional email delivery.
• Sentry - error monitoring and diagnostics.
• Crisp - the in-app support chat.
• OpenAI and Groq - AI processing (for example, website analysis, prospect scoring and message drafting).
• Google - sign-in with Google (OAuth).
• A third-party LinkedIn outreach and data-enrichment provider - connecting your LinkedIn account, delivering outreach, syncing replies, and finding contact details when you request enrichment.

We may also disclose information if required by law or a valid legal request, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

7. Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Essential cookies keep you signed in and protect your session. The Service does not work without them.
• Support chat (Crisp). The Crisp chat widget loads on our pages and sets its own cookies on your first visit, so that a conversation you start can continue across pages and visits. Crisp may also record basic device and location information for that purpose.
• Analytics (Vercel Analytics) measures page views and performance in aggregate. It does not use cookies to identify you.
• Local storage remembers preferences such as your theme, and keeps form progress during signup.

We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; if you block Crisp’s cookies, the support chat may not work, but you can always reach us at support@gtmplays.io. Checkout pages hosted by Dodo Payments set their own cookies under their policy.

8. International transfers

Warmleadz is based in India, and our providers operate in several countries, including the United States and countries in the European Union. Your data may therefore be processed outside the country where you live. Where required, we rely on appropriate safeguards, such as standard contractual clauses, and we transfer data only as permitted by applicable law.

9. Retention

• Account data, agents, leads and orders are kept while your account is open, so you can see your history and download past results.
• Billing records are kept for as long as tax and accounting laws require.
• Logs and error reports are kept for a limited period, for security and debugging.
• When you delete your account, we delete your account data as described in section 10. Residual copies may remain in encrypted backups for a limited period until they are overwritten.

10. Deleting your account

You can delete your account yourself at any time in Settings → Account → Delete account. This permanently deletes your account, agents, leads, orders and credits, and stops any Agent plan from renewing. You can also ask us to delete it by emailing support@gtmplays.io from the address on your account.

If you want to keep your account but remove specific order or lead data, email support@gtmplays.io and tell us what to delete.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate or incomplete data;
• delete your data;
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent where we rely on it, without affecting earlier processing; and
• complain to a data protection authority.

California residents have the right to know, delete and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising your rights.

Under India’s Digital Personal Data Protection Act, 2023, you can ask for a summary of the personal data we process and who we have shared it with, ask us to correct, complete, update or erase it, use our grievance process (section 15), and nominate another person to exercise your rights if you die or become incapacitated.

To exercise any right, email support@gtmplays.io. We may need to verify your identity, and we will respond within 30 days or sooner if the law requires. If your request is about prospect data a customer controls, we will help that customer respond.

12. Security

We use industry-standard measures to protect data, including encryption in transit (TLS), encryption at rest by our infrastructure providers, access controls, row-level security in our database, optional two-factor authentication, and hashed API keys. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities as the law requires.

13. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above, and if a change is material we will tell you by email or in the app before it takes effect.

15. Contact and grievances

Questions, requests and grievances about privacy go to support@gtmplays.io. This address also serves as our grievance contact under India’s Digital Personal Data Protection Act, 2023. We aim to acknowledge requests within a few business days.

Warmleadz (operator of GTM Plays), India.
For sales and demo requests, email hello@gtmplays.io.