Security & Trust
How LeadSleuth handles data — in plain language, with the specifics you'd want to check.
Public data only
LeadSleuth researches people who have publicly expressed a business need: public posts on Hacker News and Bluesky (Reddit coming soon), and public web pages such as personal sites and company pages. We never access private messages, content behind logins, or non-public profiles, and our systems are instructed to exclude special-category data (health, religion, politics, sexual orientation, etc.) even when it appears in public sources. Every claim in a dossier links back to its public source.
Nothing is ever sent on your behalf: LeadSleuth drafts, humans send.
Encryption
- In transit: all traffic is served exclusively over HTTPS (TLS 1.2+) at Cloudflare's edge; internal service-to-service calls are encrypted as well.
- At rest: application data lives in Cloudflare D1 and Cloudflare KV, which encrypt all stored data at rest by default on Cloudflare's infrastructure.
- Sessions: passwordless magic-link sign-in; sessions use a single HttpOnly, Secure cookie. No passwords are ever stored. No advertising or third-party analytics trackers.
Subprocessors
We use a small, documented set of processors. Model inputs are not used to train models.
| Subprocessor | Purpose | Data involved |
|---|---|---|
| Cloudflare | Hosting, compute (Workers), database (D1), storage (KV) | All application data |
| LLM relay (OpenAI-compatible) | Text analysis, dossier synthesis, drafting | Public post text, ICP settings; not used for model training |
| Brave Search | Web search for identity research | Search queries derived from public handles |
| Hunter | Optional business-contact enrichment | Company domains, public names |
| Resend | Transactional email (magic links, digests) | Account email addresses |
Data retention
- Account data (email, ICP settings): kept while your account is active; deleted within 30 days of account deletion.
- Leads and dossiers: kept while the owning account is active, at most 12 months from creation, then deleted or anonymized.
- Operational logs: retained up to 90 days for security and debugging.
- Deletion-request records: kept for 24 months as evidence of compliance.
Deletion & your rights
Anyone — with or without an account — can request removal of their data via the self-serve removal page. Account holders can also export all of their data (JSON) and delete their account directly in Settings → Data & privacy. Full detail, including GDPR/CCPA specifics, lives in our Privacy Policy.
Reporting a vulnerability
Found a security issue? Email privacy@zalize.com with steps to reproduce. We acknowledge every report within 48 hours and keep you updated until it is resolved. Please practice responsible disclosure: give us a chance to fix the issue before publishing details. Machine-readable contact details live at /.well-known/security.txt.
安全与信任
LeadSleuth 如何处理数据——用大白话讲清楚，并给出你想核实的细节。
只用公开数据
LeadSleuth 只研究公开表达过业务需求的人：Hacker News 与 Bluesky 上的公开帖子（Reddit 即将支持），以及个人网站、公司页面等公开网页。我们绝不访问私信、登录后内容或非公开资料，且系统被明确指示排除特殊类别数据（健康、宗教、政治、性取向等），即使它们出现在公开来源中。报告中的每条论断都链接回其公开来源。
我们绝不代表你发送任何消息：LeadSleuth 起草，人来发送。
加密
- 传输中：全部流量经 Cloudflare 边缘仅以 HTTPS（TLS 1.2+）提供；内部服务间调用同样加密。
- 存储中：应用数据存放于 Cloudflare D1 与 Cloudflare KV，在 Cloudflare 基础设施上默认对所有静态数据加密。
- 会话：免密码魔法链接登录；会话仅使用一个 HttpOnly、Secure Cookie。从不存储密码，无广告或第三方分析追踪。
子处理器清单
我们只使用一组少量且有明确记录的处理器。模型输入不会用于训练模型。
| 子处理器 | 用途 | 涉及数据 |
|---|---|---|
| Cloudflare | 托管、计算（Workers）、数据库（D1）、存储（KV） | 全部应用数据 |
| LLM 中转（OpenAI 兼容） | 文本分析、报告合成、草稿生成 | 公开帖子文本、ICP 设置；不用于模型训练 |
| Brave Search | 身份研究的网页搜索 | 由公开账号派生的搜索查询 |
| Hunter | 可选的商务联系方式补全 | 公司域名、公开姓名 |
| Resend | 事务性邮件（魔法链接、摘要） | 账号邮箱地址 |
数据保留期
- 账号数据（邮箱、ICP 设置）：账号活跃期间保留；账号删除后 30 天内删除。
- 线索与报告：账号活跃期间保留，自创建起最长 12 个月，随后删除或匿名化。
- 运行日志：出于安全与排障目的最多保留 90 天。
- 删除请求记录：作为合规证据保留 24 个月。
删除与你的权利
任何人——无论是否拥有账号——都可以通过自助删除页面请求移除自己的数据。账号持有者还可以在 设置 → 数据与隐私 中导出全部数据（JSON）并直接删除账号。完整细节（含 GDPR/CCPA 说明）见隐私政策。
报告安全漏洞
发现安全问题？请发邮件至 privacy@zalize.com 并附上复现步骤。我们承诺在 48 小时内确认每一份报告，并持续通报进展直至问题解决。请遵循负责任披露：在我们修复之前不要公开细节。机器可读的联系方式见 /.well-known/security.txt。