This Privacy Policy explains how LeadQuasar (“LeadQuasar”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data in connection with our website at leadquasar.com and our B2B lead-generation and sales-intelligence platform (the “Service”). It covers three groups of people: our customers (anyone with an account), visitors to our website, and the business contacts whose details appear in our database.
1. Who we are
LeadQuasar is a trading name of Answerflix Ltd, a company registered in England and Wales (company no. 15968747), whose registered office is at 44 Church Street, Stoke-on-Trent, ST4 1BL, United Kingdom. “LeadQuasar”, “we” and “us” in this policy mean Answerflix Ltd.
Answerflix Ltd operates the Service and is the controller of the personal data described in this policy — with one exception: for data a customer brings to the Service and manages there (for example their own imported contact lists, CRM notes and outreach), the customer is the controller and we process it on their behalf under our Data Processing Addendum.
The Service runs on a server we rent from Contabo GmbH, located in France (EU). The application, its PostgreSQL database and our nightly backups are all on that server. For any privacy question or request, email support@leadquasar.com.
2. Data we collect about you
Account data
When you create an account we collect your name, email address and a password, which is stored only as a salted hash. If you sign in with Google instead, Google gives us your name, email address and profile photo. We also store what you set up in the product: saved lists, unlocked leads, CRM notes, your ideal-customer profile and settings.
Billing data
Payments are handled by Stripe on Stripe’s own hosted checkout and billing portal. Your card details are entered there and never reach our servers. We keep a Stripe customer reference and your plan and subscription status.
AI features
When you use the LeadQuasar AI assistant, your conversations (your messages, the replies and the tools the assistant used) are saved to your account so you can come back to them. You can delete a conversation at any time. For each AI request we also keep a usage record — the model, token counts, cost and a shortened copy of the request — for billing and your usage history. If you use the voice assistant, audio from your microphone is streamed from your browser directly to our AI provider (see section 7) for the length of the call. Files and images you attach are sent to our AI provider to answer your request; attachments are kept for 30 days.
The free AI assistant on our public pages works without an account. Your recent messages are kept in your own browser so the conversation survives a reload, and are sent with your next question so the assistant has context. We store the first 180 characters of each question to understand what people are looking for.
AI assistant connections (ChatGPT, Claude and other MCP clients)
Our MCP server at /api/mcp lets AI assistants such as ChatGPT and Claude look up counts and business details in our database. It needs no account and never returns a name, email address, phone number or street address. For each request we record which tool was called, the search terms the assistant sent (such as an industry and a place), how many results came back, the time, and a salted, shortened hash of the calling IP address, which tells one caller from many without identifying anyone. We use this to prevent abuse and to see which markets people ask about. The AI assistant you use has its own privacy policy for what you type into it.
We send account emails (such as verification and welcome messages) and, from time to time, product emails about your account — for example a reminder about a checkout you didn’t finish. Emails we send can include a tiny image and tracked links that tell us whether the email was opened or a link was clicked; blocking images in your email app stops the open signal. Recurring product emails carry a one-click unsubscribe link, and you can always email us to stop any of them.
If you send outreach from LeadQuasar, we store the recipient, subject, a preview of the message and its delivery status. If you connect your own mailbox, the login details you give us are encrypted at rest (AES-256-GCM) and used only to send the mail you ask us to send. If you switch on open or click tracking for a sequence, each email in it carries a tiny image and, for clicks, links that pass through LeadQuasar before reaching the page. When a recipient’s email app loads the image or they click a link, we record the time and count it against that email to show you; we don’t record the recipient’s IP address or device. Email apps that block images stop the open signal.
Usage, device and security data
Like most websites, our server receives your IP address and browser details with every request. We use them to operate the Service, to enforce rate limits and free-usage caps (the free lead-unlock limit is keyed on a salted hash of your IP address, not the address itself) and to detect abuse. We log what you enter into our free tools and the result you were shown (with your IP address, approximate location and browser), errors that happen in your browser (the error message, the page and your browser type) and the actions you take in the product, such as searches, unlocks and exports.
Analytics
With your permission where the law requires it (see Cookies), we also use:
- First-party page analytics — each page view is recorded on our own server with the page, referrer, device and browser type, your IP address and your approximate location (country and city, looked up from the IP address on our own server with an offline database — no third party is involved).
- Session recordings — a reconstruction of how pages were used (page structure, scrolling, clicks and mouse movement), stored on our own server and viewable only by our team. Everything typed into form fields is masked before it leaves your browser except search and question boxes — the lead search, the AI assistant and the free tools’ website and description boxes — whose contents may appear in a recording. Password, email-address, phone and payment fields are always masked, and sign-in, registration, billing and admin pages are never recorded at all.
- Google Analytics 4 — aggregate traffic reports. Google Analytics 4 does not log or store IP addresses. We have not enabled Google’s advertising features and we don’t send it data for ads.
Messages you send us
If you email us or text a LeadQuasar phone number, we keep the message and your contact details so we can reply.
3. The B2B contact data in our product
The core of the Service is a database of businesses and business contacts that customers search and unlock for B2B sales and marketing. This section is for you if your business or your work details appear in it.
What a record contains
Most records describe a business: its name, category, address, business phone number, business email address, website, public ratings and review counts, and links to public profiles. Some records name a person in their professional role — name, job title, company, work email, work phone and a public professional profile link such as LinkedIn. We do not knowingly include special categories of personal data (such as health, religion or political views), and we do not collect consumer or home contact data for this purpose.
Where it comes from
Records are aggregated from public and commercially licensed sources: public business listings, company websites, and professional data providers. We do not add the people our customers contact to the database.
What happens to it
Contact details stay hidden until someone unlocks a record, and that masking is enforced on our server. Customers — on free and paid plans — can view the records they unlock, save them to lists, send outreach and, on paid plans, export them. Visitors without an account can unlock a small number of records as a free preview. Business listings without contact details, and counts by industry and location, also appear on our public pages and through our AI assistant integrations.
Lawful basis
Where the GDPR or UK GDPR applies, we rely on legitimate interests — ours and our customers’ — in business-to-business communication, balanced against the rights of the people concerned. Keeping data limited to professional details, masking contact details until unlock, rate limiting to stop bulk extraction, and honouring removal requests are how we keep that balance. Customers are responsible for making their own outreach lawful.
How to see, correct or remove your record
Email support@leadquasar.com from the address in question, or with enough detail to identify the record. You don’t need an account and there is no charge. We will tell you what we hold, correct it, or remove it and take steps so it is not re-added from a future import. You can also simply object to us using your details, which we will treat as a removal request.
4. Your CRM and connected mailboxes
Contacts you add to your CRM
When you type in or import contacts (for example from a CSV or Excel file), we store them so you can manage them in your CRM. They are visible only to you. We never add them to the LeadQuasar lead database, share them or sell them. For these contacts we act as your data processor, and you are responsible for having a lawful basis to hold and contact them. You can delete any contact at any time. All of them are deleted when you close your account.
Mailboxes you connect
If you connect a mailbox with an app password, we store that password encrypted (AES-256-GCM). We use it only to:
- send the emails you choose to send from LeadQuasar, one at a time or in the email sequences you set up, on the days and hours you choose
- check that mailbox for replies
- show you that mailbox when you open the Inbox in LeadQuasar, and send the emails, replies and forwards you write there
- pause sending from it if too many of its recent emails bounce or are marked as spam, until you resume it
When we check for replies, we keep a message only if it answers an email you sent from LeadQuasar or comes from someone in your CRM. For those messages we keep the sender, the subject, the date and the first 500 characters, so they can be shown on the lead and in your Replies inbox. To sort that inbox, the subject and those 500 characters may be sent to OpenAI to suggest a label such as Interested or Not now; you can change any label, and nothing else from the message is sent. When you open the Inbox in LeadQuasar, we read the folders and messages you view straight from your mailbox and show them to you; we do not store them, apart from the replies described above. We do not copy, read for any other purpose, or store the rest of your inbox. Disconnecting the mailbox deletes the stored password straight away.
An email sequence keeps, for each person you add to it, which of its emails went and when, and why it stopped (for example because they replied), until you delete the sequence or close your account.
CRMs and tools you connect
If you connect HubSpot, Pipedrive, GoHighLevel or Zoho CRM, we send it the leads and contacts you choose, with a short company card (the type of business, its location, Google rating, LeadQuasar quality score and website). If you switch on two-way sync, we check the status of the records we sent, about every 30 minutes, to keep your LeadQuasar CRM up to date. If you connect Slack, Microsoft Teams, Zapier, Make, n8n or another webhook address, we send it the events you pick. These are your own accounts with those companies, and their terms govern what happens to the data there. You can disconnect any of them in Settings → Integrations, which deletes the token we stored.
Websites you track with LeadQuasar
If you add the LeadQuasar snippet to your website, we record page views on it for you: the page, the referring site, any campaign tags, and the visitor’s country, device and browser type. The snippet sets no cookies. We do not store visitors’ IP addresses: an IP address is used only at the moment of the visit, to make a visitor code that changes every day and cannot be traced back. We delete page views after 400 days. For this data we act as your processor, and you are responsible for telling your visitors about it in your own privacy notice.
Session recordings. If a LeadQuasar customer switches on session recordings for their website, we record how visitors use that website on the customer’s behalf: the pages they see, how they move the mouse, click and scroll. Anything typed into a form is hidden in the visitor’s browser before anything is sent to us. Recordings are kept for up to 90 days and then deleted, or sooner when the customer deletes them. We act as the customer’s processor for these recordings; the customer decides whether to record and is responsible for telling their visitors and, where the law requires it, asking for their consent.
5. How we use data, and our legal bases
The GDPR asks us to name a legal basis for each use of personal data. For customers and visitors they are:
| What we do | Legal basis |
|---|---|
| Create and run your account, unlocks, lists, exports and AI features | Performing our contract with you |
| Take payments and manage your subscription | Performing our contract with you |
| Send account emails (verification, security, service notices) | Performing our contract with you |
| Send product emails such as an unfinished-checkout reminder | Legitimate interests — you can unsubscribe at any time |
| Rate limits, free-usage caps, abuse detection, error logs and keeping the Service secure | Legitimate interests in protecting the Service and its data |
| Analytics cookies, first-party visitor identifiers and session recordings | Consent in the EEA, UK and Switzerland; legitimate interests in improving the Service elsewhere, and you can switch them off at any time |
| Compile the B2B contact database and make it available to customers | Legitimate interests (see section 3) |
| Keep accounting records and respond to lawful requests | Legal obligation |
Automated decisions. A nightly automated check looks for unusual unlock activity — very high volume, many addresses at once, or non-browser clients — and can suspend an account to stop bulk extraction. If that happens to you, email us and a person will review it.
6. Cookies and similar technologies
We use cookies and browser storage in two categories, and nothing else. We don’t use advertising or cross-site tracking cookies.
- Strictly necessary — keeping you signed in, remembering your cookie choice, securing sign-in, and remembering things you did on the site (like closing a banner). These are always on.
- Analytics — Google Analytics, our first-party page analytics and session recordings. These are optional.
Your choice
The first time you visit, a banner lets you accept all, reject non-essential cookies, or customize. Until you choose:
- If your browser’s time zone suggests you are in the EEA, the UK or Switzerland, analytics stay off until you accept. Google Analytics additionally applies this default based on its own location lookup.
- Elsewhere, analytics run as described above until you choose “Reject non-essential”.
When you reject or later switch analytics off, recording and page tracking stop immediately, and we delete the analytics cookies and storage your browser lets our pages remove (the Google Analytics cookies and the session-recording keys). Your choice is saved in this browser for 180 days; clearing cookies or using another device means we’ll ask again. You can change it at any time from “Cookie settings” in the footer of every page, or here: .
Cookies
| Name | Purpose | Category | Lasts |
|---|---|---|---|
better-auth.session_token | Keeps you signed in. Sent as __Secure-better-auth.session_token on our HTTPS site. | Strictly necessary | 7 days, renewed while you use the Service |
better-auth.session_data | A short-lived signed copy of your session, so pages load faster | Strictly necessary | 5 minutes |
better-auth.state | Protects “Continue with Google” sign-in against forged requests | Strictly necessary | 5 minutes |
lq_consent | Remembers your cookie choice | Strictly necessary | 180 days |
lq_ex, lq_impersonator, lq_impersonating, li_oauth_state | Staff only — keep our own testing out of analytics, let support see an account the way its owner does, and connect our LinkedIn page. Never set for customers or visitors. | Strictly necessary | 10 minutes to 1 year |
_ga, _ga_<ID> | Google Analytics: tells visits and visitors apart | Analytics | 2 years |
lq_vid | Our first-party visitor ID for page-view counts | Analytics | 1 year |
lq_sid | A signed first-party visitor ID that links page views, free-tool use and free AI assistant questions and unlocks into one visit. Set by page analytics, or when you use the free AI assistant or unlock a lead without an account — in each case only if analytics is allowed. If you reject analytics, we stop setting it and expire it on your next page view. | Analytics | 1 year |
lq_rs | Links a session recording to the page views it covers | Analytics | 24 hours |
All of these are first-party cookies set by leadquasar.com, except _ga and _ga_<ID>, which are set on our domain by Google Analytics’ script.
Browser storage
Some features use your browser’s local or session storage instead of cookies. Session storage is cleared when you close the tab; local storage stays until you clear it.
| Key | Purpose | Category | Lasts |
|---|---|---|---|
lq.publicChat | Your last 12 messages with the free AI assistant, so a reload doesn’t lose them | Strictly necessary | Until cleared (local) |
lq.navOpen, lq.navRail, lq.filtersOpen, lq.chatHistoryDocked | Layout preferences in the app | Strictly necessary | Until cleared (local) |
lq.tour.leads, lq.icpOnboardingDone | That you finished the product tour or onboarding | Strictly necessary | Until cleared (local) |
lq_mobile_cta_dismissed, lq_chunk_reload | That you closed the mobile sign-up bar; stops a reload loop after we release an update | Strictly necessary | Until the tab closes (session) |
lq_rs_id, lq_rs_start, lq_rs_seq, lq_rs_touch | The current session recording and its progress | Analytics | Until the tab closes (session) |
lq_rs_seen | Whether this browser has visited before (new or returning visitor) | Analytics | Until cleared (local) |
lq_rs_pending | Recording uploads that failed and will be retried | Analytics | Until sent (local) |
lq_signup_conversion | Stops a new sign-up being counted twice in Google Analytics | Analytics | Until cleared (local) |
Advertising
Free accounts may see promotional units inside the app. Where these are our own upgrade prompts, no third party is involved and no data leaves us. If we ever add a third-party advertising network, we will update this policy first and ask for your consent where the law requires it before any advertising cookie is set. Paid accounts are never shown promotional units.
7. Who we share data with
We use a small number of service providers who process personal data on our behalf, under contract, and only to provide their service to us:
| Provider | What for | Data involved | Where |
|---|---|---|---|
| Contabo GmbH | Hosting: the server that runs the Service, its database and backups | All data described in this policy | Server in France (EU) |
| Stripe | Payments, subscriptions, invoices and the billing portal | Name, email, payment card and billing details (entered on Stripe’s pages), transaction history | US-based provider |
| OpenAI | AI features: the AI assistant, natural-language search, lead insights, website analysis, free AI tools, the voice assistant, drafting email sequences and labelling replies in your Replies inbox | What you type into AI features, the business records needed to answer, the subject and first 500 characters of replies being labelled, and voice-assistant audio streamed from your browser | US-based provider |
| Resend | Delivering email: account and product emails, and outreach you send through LeadQuasar | Sender and recipient addresses, subject, message content, delivery status | US-based provider |
| Optional “Continue with Google” sign-in; Google Analytics (only as described in Cookies) | Sign-in: your Google name, email and profile photo. Analytics: pages viewed, device and browser data, approximate location, cookie IDs | US-based provider | |
| Telnyx | Receiving text messages sent to a LeadQuasar phone number | The sender’s phone number and message | US-based provider |
OpenAI’s API terms state that data sent through its API is not used to train its models by default. If you connect your own mailbox to send outreach, that mail goes through your own email provider, which you choose and which is not our provider. When our public pages change we notify search engines through IndexNow; that sends page addresses only, never personal data.
We do not sell or rent the personal data of our customers or website visitors, and we do not share it for cross-context behavioural advertising. We don’t share one customer’s account data, lists or outreach with other customers. We may disclose data if the law requires it, to protect our rights or the safety of others, or to a buyer or successor if LeadQuasar is sold or merged — in which case this policy continues to apply to your data. For the business contact database, see section 3 and, for US state law, section 11.
8. How long we keep data
- AI assistant connection records (the MCP requests described above): 12 months, then deleted.
- Account data, including saved lists, unlocks and AI conversations: for as long as your account is open. You can delete individual AI conversations yourself; ask us and we will delete your account.
- Billing records: as long as tax and accounting law requires, even after an account is closed.
- Session recordings: kept indefinitely. Ask us and we will delete the recordings of your visits.
- Page-view, free-tool, event and error logs (which can include IP addresses): for as long as they are useful for understanding how the Service is used and for preventing abuse. You can ask us to delete records linked to you.
- Rate-limit counters: removed by a nightly job once they expire.
- Text messages received on our phone number: deleted after 30 days.
- Backups: taken nightly and kept on a rolling seven-day window, so deleted data leaves our backups within a week.
- Removal requests for the B2B database: we keep a minimal record of the request for as long as needed to stop the details being re-added.
9. Security
All traffic is encrypted with HTTPS. Passwords are stored only as salted hashes, and credentials for any mailbox you connect are encrypted at rest. Contact details in the database stay hidden until a record is unlocked, enforced on the server, and unlocking is rate limited to prevent bulk extraction. Administrative access is limited to our team. No system is perfectly secure, so we can’t promise absolute security — our Security page describes our measures, and what we don’t claim, in more detail. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities as the law requires.
10. International transfers
Our own server and database are in the EU. Some of the providers listed in section 7 are based in the United States and may process data there or in other countries. Where personal data from the EEA, UK or Switzerland goes to a country without an adequacy decision, we rely on the safeguards those providers offer, such as the European Commission’s Standard Contractual Clauses (with the UK Addendum) or the EU–US Data Privacy Framework where the provider is certified.
11. Your rights (GDPR, UK GDPR and US state laws)
If you are in the EEA, the UK or Switzerland
You have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use it, or object to our use of it — including an absolute right to object to direct marketing;
- receive data you gave us in a portable format;
- withdraw consent at any time, without affecting what happened before — for cookies, use “Cookie settings” in the footer;
- complain to your data protection authority. We’d appreciate the chance to put things right first.
If you are in California or another US state with a privacy law
You have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of the sale or sharing of your personal information; and not to be treated differently for using any of these rights. You can use an authorised agent. We do not use sensitive personal information to infer characteristics about you.
Customers and website visitors: we do not sell or share your personal information, as those terms are defined by California law.
People in our B2B contact database: we make business contact records available to our customers, including paying customers. Some US state laws may treat that as a “sale” of personal information. You can opt out, and have your record removed, by emailing support@leadquasar.com as described in section 3.
How to make a request
Email support@leadquasar.com. We may ask you to confirm the request from the email address involved, so that we don’t hand your data to someone else. We respond within the time the law allows — one month under the GDPR, 45 days under California law — and there is no charge.
12. Children’s data
The Service is for business use by adults and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We update this policy when what we do changes — for example when we add a provider or a cookie. The “Last updated” date above always shows the latest version. When a change materially affects how we use your data we will, where appropriate, also tell account holders by email or in the Service, and where a change needs your consent we will ask for it.
14. Contact
Questions about this policy or your data? Email us at support@leadquasar.com or use our contact page. By post: Answerflix Ltd, 44 Church Street, Stoke-on-Trent, ST4 1BL, United Kingdom.