How we handle data and sending

Every regime we operate under asks the same five questions of a marketing email: who sent it, how do I stop it, does stopping actually stop it, is my data safe, and can I have it deleted. Those answers are the same for a recipient in Cape Town, London, or Boston, so they come first. The jurisdiction-specific reasoning follows.

• Identity on every message. The sender's name, role, and the business they represent are composed by the system at send time, not left to a template or to the person writing.
• Opt-out on every message, honoured permanently. A signed unsubscribe link, standard one-click headers, or simply replying "unsubscribe" — any of them works, and the result is recorded against the address rather than against a campaign.
• Suppression that survives rediscovery. An opt-out is checked on every send, under every sender identity and mailbox that workspace owns, and it holds even if the same company is discovered again months later.
• The system refuses to send what it cannot make compliant. If a sender identity and a working unsubscribe link cannot be attached, the send fails. It does not go out without them.
• Security and deletion. Mailbox credentials are encrypted at rest, no employee reads mailbox content, and we handle deletion requests sent to us ourselves (section 10).

Both of these come up in sales conversations, so they belong on this page rather than in an email.

• You choose the domain you send from, and it stays yours. Outreach only ever sends from a mailbox you connect — Google, Microsoft, or your own SMTP server. LeadAtomic does not own, share, or provision a sending domain, and does not send on a pooled one. If you would rather build reputation on a separate domain from your main one, that is a matter of connecting a mailbox on it. The reputation you build is on infrastructure you control, and it leaves with you.
• We don't sell your data, and your research is your own copy. We don't sell, license or broker it to anyone: not advertisers, not data vendors, not other customers. There is no data feed out of the product and no resale path through it. Every company in your workspace, everything researched about it and every email check belong to your workspace alone. No other customer can see them, and we never reuse them for anyone else.
  Stated precisely, because the distinction matters: two records are kept across workspaces. One is a list of companies that asked us to delete their data, so they are never researched again. The other is an anonymous count of common email formats, derived with every company and person removed, that names no one. And your own copy is not exclusivity: two customers working the same market can find and research the same company independently, as they could without us. What stays private is everything in your workspace: your ICP, your research, your scores and their reasoning, your contacts, your messages and your outcomes.

LeadAtomic is a B2B account-research and outreach platform. We help businesses find and contact other businesses that fit their ideal customer profile, at a deliberately human scale, with messages a person reviews before they send unless the customer chooses otherwise. We designed the product so that doing outreach well and respecting data-protection law point in the same direction.

This page explains, in plain terms, how we align with South Africa's Protection of Personal Information Act (POPIA) and why — and how those same controls map onto comparable regimes elsewhere. It is written in good faith to describe our engineering and operational practices; it is not legal advice and does not create a warranty. Each customer remains responsible for their own lawful use of the platform.

When a customer connects a Gmail mailbox, LeadAtomic sends the outreach they approve and detects the replies to it. Nothing else. Our reply checker matches each incoming message against outreach sent through LeadAtomic before anything is stored, so unrelated mail in that inbox — personal correspondence, invoices, newsletters — is discarded in memory and never written to our systems. No LeadAtomic employee can read mailbox content, and none of it is ever used to train AI models.

LeadAtomic's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. The full detail — scopes, storage, retention, sub-processors — is in our Privacy Policy.

POPIA protects "personal information," which under South African law includes information relating to both natural persons and juristic persons (companies). We do not treat "it's just business data" as a reason to opt out of the law. Where we hold a named contact, a work email, or a phone number, we treat it as personal information and apply the protections below.

Most of the contact data in the platform comes from information a business has deliberately made public: its own website and public business listings. Some addresses are constructed from a company's naming pattern and then checked by a verification service before use. When our customer asks us to find the people who decide at a company, or one person's phone number, we may obtain a business email address or phone number from a contact-data provider (Hunter, BetterContact or FullEnrich). That data was not necessarily made public by the business itself, so we rely on the provider's own sourcing, label every such detail with the provider it came from, check it before use, and honour erasure and objection requests for it exactly as for any other data. POPIA permits collecting personal information from sources a business has made public, but that does not switch off the direct-marketing, openness, security or data-subject-rights obligations, so we honour those regardless. We do not use covert techniques to obtain data, and the Privacy Policy describes our sources.

• Accountability. Data-protection responsibilities are owned internally, and customer-facing requests route to hello@leadatomic.com.
• Processing limitation. We collect business-contact data in proportion to a legitimate outreach purpose, and keep volumes at a human, non-spam scale.
• Purpose specification. Data is used to research and contact prospects that fit a customer's stated ideal customer profile. It is never sold or repurposed.
• Further-processing limitation. Enrichment and scoring serve that same outreach purpose and nothing incompatible with it.
• Information quality. Records are deduplicated and kept current; bounced or invalid addresses are detected and suppressed automatically.
• Openness. This page and our Privacy Policy explain what we process and why, including a dedicated section for people who receive outreach.
• Security safeguards. See section 9 below.
• Data-subject participation. Anyone can ask what we hold, correct it, or have it deleted — see section 10.

Every marketing email should say who sent it and offer a way to ask them to stop. We build both into the product so they cannot be skipped. These controls are not the whole of the law on direct marketing, which differs by country and sets its own rules on when a first message may be sent; each customer is responsible for having a lawful basis to contact the people they reach.

• Every email identifies who is writing. Each message carries a sender identity — the person's name, role, and the business they represent — added by the system at send time rather than left to chance.
• Every email offers a one-click opt-out. Messages include a personal unsubscribe link and standard one-click List-Unsubscribe headers, and recipients can simply reply with "unsubscribe." Any of these works.
• Opt-outs are honoured permanently and immediately. An opt-out is recorded against that recipient for that customer and permanently ends all marketing to them — every campaign, sequence and follow-up, under every sender and mailbox the customer uses — even if the same company is rediscovered later. Nothing automated can email that address again.
• The single exception is a reply the recipient asked for. If someone who has opted out writes to the customer afterwards, a person may answer that message by hand. Correspondence a recipient themselves started is not marketing, and the system enforces the distinction rather than trusting it: the exception applies only to a human-written message, only to the address that wrote in, and only while that address's own last message is no older than its opt-out. Every such send is logged against the reply that authorised it.
• We fail safe. If a compliant sender identity and working unsubscribe link cannot be attached to a message, the system refuses to send it rather than send a non-compliant email.
• Human scale and human approval. Outreach is low-volume, and approval by a person is on by default. A customer can switch it off for drafts that clear their score and verification thresholds; the send limits and the identity and opt-out rules above still apply.

Unsubscribe links are signed so they cannot be forged or used to guess other recipients, and the link itself contains no account login. Because email security scanners automatically open links, simply opening the page never unsubscribes anyone — the opt-out is only recorded after an explicit confirmation (or the mailbox provider's native one-click action). Recipients can also resubscribe if they change their mind.

• Account passwords are hashed, never stored in plain text.
• Connected-mailbox credentials and OAuth tokens are encrypted at rest.
• Authentication and sensitive public endpoints are rate-limited and abuse-resistant.
• Operational and audit records support investigation and accountability.
• Access to customer data is limited to what operating the service requires.

No system can promise absolute security, and customers remain responsible for protecting their own devices, mailboxes, and credentials.

Whether you are a LeadAtomic customer or someone who received outreach through the platform, you can ask us to tell you what personal information we hold about you, correct it, or delete it. The fastest way to stop receiving outreach is the unsubscribe link in any message or replying "unsubscribe" — that permanently stops the customer who contacted you. For anything else, contact hello@leadatomic.com. We act on deletion requests ourselves rather than forwarding them. When a company asks, we remove it from every customer's workspace and keep only the identifiers we need to make sure it is never researched again. For a request about an individual, contact us and we will help.

We use a small set of trusted providers to operate the service — transactional email infrastructure, the mailbox providers customers connect (such as Google or Microsoft), and AI/model providers used for tasks like profile extraction, enrichment, scoring, and drafting. Some of these process data outside South Africa. Each uses the data only to deliver its part of the service, and the Privacy Policy lists them.

The controls above are built on principles shared across modern data-protection and anti-spam law, so the same product behaviour supports compliance beyond South Africa:

• GDPR / UK GDPR (EU & UK). Lawful-basis thinking, transparency, data-subject access and erasure, security of processing, and an objection/opt-out route.
• PECR & similar e-marketing rules. Clear sender identification and a simple, free, always-available way to opt out of electronic marketing.
• CAN-SPAM (US). Accurate sender identity, honest subject lines, a working unsubscribe mechanism honoured promptly, and (optionally) a postal identifier on the sender identity.

Where a customer operates under a specific regime, they should confirm their own obligations; we provide the mechanisms (identity, opt-out, suppression, security, deletion) that make meeting them practical.

We will keep this page current as the product and the law evolve. If we make a material change, we will update the effective date above.