Your data, your
terms.

This Privacy Policy describes how Ctrl+Alt+Design ("ZipLead," "we," "us," "our") collects, uses, and protects information when you use the ZipLead service at ziplead.ai. We're committed to transparency, minimizing data collection, and giving you control over your data.

Account information

• Email address (provided during sign-up via Clerk)
• Name (if provided)
• Billing information (processed by Stripe — we never see card numbers)

Usage data

• Search queries (ZIP codes, cities, categories you search for)
• Pipeline activity (status changes, notes, prospects you save)
• Feature usage and aggregated session analytics

Business data (third-party sources)

• Publicly available business information aggregated from Google Places, OpenStreetMap, and other public sources
• Enrichment data from BuiltWith, ZeroBounce, Hunter.io, and similar providers

• To provide, maintain, and improve the Service
• To process payments and manage subscriptions
• To send transactional emails (account, billing receipts, Dispatch bulletins you configure)
• To respond to support requests
• To detect, prevent, and address fraud, abuse, or security incidents
• To comply with legal obligations

We do not sell your account information. We do not use your account data for advertising.

Note: this refers to your account data as a customer. Separately, the Service provides publicly available businesscontact information to customers — see "Business contact data" below for how that works and how to opt out.

We use the following processors that may handle limited data on our behalf:

• Clerk — authentication and identity
• Stripe — payments and subscriptions
• Neon — encrypted PostgreSQL database
• Vercel — application hosting and edge delivery
• Cloudflare — DNS and CDN
• Resend — transactional email delivery
• Third-party data providers — business data, email verification, and website analysis for the prospects you scrape (no end-user PII shared)

Each has its own privacy policy. We have data processing agreements where required.

We retain your account data for as long as your account is active. Search results, prospects, and pipeline data are retained for the duration of your subscription. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law (e.g. tax records). Aggregated and anonymized data may be retained indefinitely for product analytics.

We implement industry-standard safeguards: TLS encryption in transit, encrypted database connections, scoped API tokens, and authentication via Clerk with enforced session expiry. No method of internet transmission is 100% secure, but we take reasonable precautions and will notify affected users of any confirmed breach within 72 hours.

Privacy laws vary by where you live, but we extend the core rights below to everyone, in every state and country, regardless of whether a specific law requires it. Depending on your jurisdiction you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and personal data
• Export your data in a portable format (CSV export is available in-app)
• Object to processing or restrict it
• Opt out of non-essential communications
• Withdraw consent at any time (without affecting prior lawful processing)

To exercise any right, email privacy@ziplead.ai. We respond within 30 days.

By region. California (CCPA/CPRA) residents can know what personal information we collect, request deletion, and opt out of its sale or sharing. Virginia, Colorado, Connecticut, Texas, Utah, Oregon, and other US states with comprehensive privacy laws grant similar access, deletion, correction, and opt-out rights. EU, UK, and other GDPR-style regimes grant access, rectification, erasure, portability, and objection rights. We honor all of these, and we do not discriminate against anyone for exercising them.

Removal is open to anyone, anywhere. No matter where you live or which law applies, if you are associated with a business in our data you can have it removed at any time via our Do Not Sell or Share My Information page or by emailing privacy@ziplead.ai.

ZipLead helps customers find local businesses to contact. To do that, we collect publicly available business information from sources like Google Places, Foursquare, and the businesses' own public websites, including business names, addresses, phone numbers, published email addresses, websites, ratings, and — where a business publishes them — the names and titles of owners or managers.

We provide this business information to our customers, who use it for their own outreach. Under California law and other US state privacy laws, providing it may be considered a "sale" or "sharing" of personal information; under GDPR-style regimes it is processing of personal data. We do not provide Social Security numbers, financial account details, or other sensitive personal information, and we do not compile consumer profiles.

If you are associated with a business and want it removed — no matter where you or the business are located — use our Do Not Sell or Share My Information page. We add the listing to a suppression list immediately, so it stops appearing in searches, exports, and our API, and we purge existing records within 30 days. You are responsible for compliant use of any data you obtain, including under the TCPA, CAN-SPAM Act, Do Not Call rules, and any laws that apply where you and the recipient are located.

We use strictly necessary cookies for authentication (via Clerk) and session management. We do not use advertising, retargeting, or third-party tracking cookies. Because we only use essential cookies, no consent banner is required under the ePrivacy Directive.

The Service is not intended for users under 18. We do not knowingly collect data from children. If you believe a minor has provided us with personal information, please email privacy@ziplead.ai and we will promptly delete it.

Our infrastructure (Vercel, Neon, Clerk, Stripe) processes data primarily in the United States. By using the Service from outside the U.S., you consent to your data being transferred and processed in the United States, which may have different data protection laws than your country. Where required, we rely on Standard Contractual Clauses for international transfers.

We may update this Privacy Policy from time to time. We will notify active users of material changes via email at least 30 daysbefore they take effect. The "Last updated" date at the top reflects the most recent revision.

Privacy questions or requests: privacy@ziplead.ai
General contact: support@ziplead.ai
Operated by Ctrl+Alt+Design, Costa Mesa, California, USA.