Privacy Policy
This policy describes what personal information leads2mail collects, why we collect it, who we share it with, and the choices you have. It covers both the marketing website and the leads2mail application.
Last updated: July 31, 2026
Who we are
leads2mail is operated by Stage Strategy GmbH, Görlitzer Ring 31, 23879 Mölln, Germany. Managing director: Andreas Hartwig. Register: Amtsgericht Lübeck HRB 27433 HL. VAT ID: DE462237858. Contact: info@stage-strategy.de. Full details are in our Imprint.
We are established in Germany, but the service itself runs in the United States: the application and its workers are hosted in Virginia (Render), and the database is in the same region (Neon, AWS us-east-1). Personal data you enter is therefore stored and processed in the United States. We chose that location because the companies searched for are in the United States and every request would otherwise cross the Atlantic twice.
Two different roles
This distinction matters for your rights, so we state it plainly:
- For our customers' account data we decide the purposes of processing (we are the "controller" / "business").
- For the prospect contact data our customers process through leads2mail we act on our customer's instructions (we are the "processor" / "service provider"). Our customer decides who is contacted and what is written. If you received an email sent through leads2mail and want your data removed, use the unsubscribe link in that email — it takes effect immediately — or contact the sender directly. You may also write to us and we will forward your request to the customer responsible.
The marketing website
The website you are reading uses no analytics, no advertising pixels and no tracking cookies. Fonts are served from our own servers, not from a third-party font service. We do not build visitor profiles.
Two features involve additional processing:
- Free deliverability tools (/tools/): when you check a domain or address, your browser queries public DNS resolvers operated by Google and Cloudflare directly. Those providers see the query and your IP address. We do not receive, log or store what you check.
- Hosting: the site is served by Netlify, which processes request data (including IP address) to deliver pages and for security.
The leads2mail application
Account and company data
When you register we collect your username, email address and a password (stored only as a cryptographic hash — we cannot read it), together with the company data you enter: company name, contact name, physical postal address, website, and the description of your customers, product, the problem you solve and the benefit you offer. The postal address is used in the footer of every email you send, because US law (CAN-SPAM) requires a valid physical address in commercial email.
Your mailbox credentials
To send from your own inbox you provide SMTP credentials, and optionally IMAP credentials so replies can be matched. Passwords are encrypted at rest using symmetric encryption; they are decrypted only in memory at the moment a connection is opened. With IMAP configured, the application reads your inbox to identify sender addresses of replies and to detect delivery failures. It opens the mailbox read-only and does not delete, move or send from it.
Prospect contact data
The application stores the business contacts you upload, import or that it finds for you: email address, name where available, company, city, and the status you assign. It records when an email was sent, when a reply arrived, and — for replies — a short note in the contact's timeline. Unsubscribes and hard bounces are stored on a suppression list so the address is never contacted again through your account.
Data we collect about businesses from public sources
When you use the lead finder or a regional campaign, the application queries a search provider and visits the public websites of the businesses found, in order to extract publicly published business contact details (typically an office email address, phone number and postal address). This is business contact information published by those businesses themselves. We do not scrape private individuals' data, social networks, or password-protected pages.
AI email drafting (optional)
If AI drafting is enabled for your account and you use the email composer, the brief you enter — your target audience, product, the problem you solve, the benefit, plus your name and company name — is transmitted to Anthropic to generate the draft. No prospect data and no mailbox contents are sent. If AI drafting is not enabled, the draft is produced locally from a template and nothing leaves our servers.
Payment data
Payments are processed by Stripe. Card details are entered on Stripe's own checkout page and never reach our servers. We store the Stripe customer and subscription identifiers, your plan, its status and the billing period, so we know what you are entitled to.
Who we share data with
We do not sell personal information and we do not share it for cross-context behavioural advertising. We use the following service providers, each only to run the service:
| Provider | Purpose | Data involved |
|---|---|---|
| Netlify | Hosting the marketing website | Request data, IP address |
| Render | Hosting the application | All application data, request data |
| Neon | Database | All application data at rest |
| Stripe | Payments and subscriptions | Name, email, payment details (entered directly with Stripe) |
| DataForSEO | Business search for the lead finder (Google Maps data) | Your search terms and locations |
| Render | Hosting of the application and its background workers (Virginia, USA) | All application data in transit and in memory |
| Anthropic | AI email drafting, only if enabled and used | The brief you enter, your name and company |
| Google / Cloudflare public DNS | The free tools on the website | The domain you check, queried by your own browser |
We may also disclose information where we are legally required to, or to establish or defend legal claims.
How long we keep it
Account, company and campaign data is kept for as long as your account exists. When you close your account we delete it, except where we must keep records longer — in particular invoices and payment records, which German commercial and tax law requires us to retain for up to ten years.
Suppression entries are kept even after deletion of the underlying contact. That is deliberate: an unsubscribe or hard bounce must keep working, and forgetting it would mean contacting someone who asked not to be contacted.
Security
Traffic is encrypted with HTTPS. Mailbox passwords are encrypted at rest. Account passwords are stored only as hashes. Access to production systems is restricted. No system is perfectly secure, and we do not claim otherwise.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to obtain a copy in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. California residents additionally have the right not to be discriminated against for exercising these rights; we do not sell or share personal information, so there is nothing to opt out of in that respect.
To exercise any of these, write to info@stage-strategy.de. If your data was processed by one of our customers through leads2mail, we will pass your request on to them. You also have the right to complain to a data protection authority.
Children
leads2mail is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.
Changes
If we change this policy we will update the date above and, for material changes, notify account holders by email.