Leama plugin privacy notice

Effective 2 October 2026. This notice explains the ChatGPT and Codex plugin and supplements the Leama Privacy Policy.

Who is responsible

Prospactive B.V., Middelerf 8b, 3851 SP Ermelo, the Netherlands, KVK 89103548, is the controller of Leama account and plugin data. Contact jessy@prospactive.nl for privacy questions and requests.

Data and purposes

• Account and connection: account identifier, name and email, authorized scopes, OAuth client and token records. We use these to sign you in, isolate accounts, authorize actions, refresh connections and revoke access. Passwords are entered only in the sign-in flow, not the conversation or prospecting tools.
• Profiles and workers: your saved target criteria, offer, markets, exclusions, required evidence and manual-run settings. We use these to select and qualify prospects.
• Research and results: submitted public company details, named business contacts and roles, public work-email evidence, source URLs and short quotes, qualification reasoning, validation results and saved prospects. We use these to check evidence and contact identity, validate emails, deduplicate and let you review results.
• Operations: run and submission identifiers, status, timestamps, daily allowance and reservations, retry records and service diagnostics. These support reliable runs, limits, troubleshooting and abuse prevention.

The tools receive their structured inputs, not your entire conversation history. Do not submit passwords, API keys, private personal contact details or unrelated sensitive information. Research is limited to public business information and public work-contact evidence.

Who receives data

OpenAI’s ChatGPT or Codex processes the conversation and tool results under the terms and privacy settings that apply to your OpenAI account. Leama receives the tool inputs needed to perform requested actions and returns account-scoped results to that connected host. Clerk supports Leama authentication; Railway supports hosting and databases. Leama’s in-house email-verification service processes work-email candidates. Website and mail-server checks necessarily communicate with the relevant public website or domain infrastructure.

The plugin research path does not send requests to Jev, Qwen, Serper, BetterContact or Hunter and does not make separately billed model calls. It does not deliver prospects to a CRM or send outreach. Other Leama product features have their own processing described in the general Privacy Policy. International transfers and applicable safeguards are described there.

Retention

• Profiles, workers and saved prospects: retained while your account uses them, until deleted through available account controls or an applicable deletion request. There is no automatic inactivity-based deletion period.
• Run history, evidence, submissions and quota records: retained for review, deduplication, reliable retries and operation of the account; currently there is no automatic age-based purge. Signing out or reconnecting does not reset allowances or erase this data.
• OAuth records: connection requests expire after 10 minutes, authorization codes after 2 minutes, access tokens after 15 minutes and refresh tokens after 30 days. Expired records become eligible for cleanup after one additional day; maintenance normally checks every 15 minutes. Revocation ends access earlier.
• Operational logs: the current Railway plan provides a 30-day log-access window. This is not a promise of irreversible deletion from every provider system. Authentication providers may retain security records under their own policies.
• Database backups: automated daily backups have a 6-day retention window and weekly backups 27 days. Existing manual recovery snapshots do not have automatic expiry. Deleting active records does not immediately remove all backup copies; privacy requests must also account for applicable backup and legal-retention obligations.

Your controls and rights

You can edit your profiles, inspect saved results and disconnect the plugin. Disconnecting revokes the connection but preserves saved data. For access, correction, export, deletion, restriction or objection requests, contact jessy@prospactive.nl; we may need to verify your identity. The general Privacy Policy explains these rights, legal bases, applicable exceptions and your right to complain to the Dutch Data Protection Authority. We do not promise that a sign-out action deletes your account or that all backup copies disappear immediately.