Privacy Policy

LeadNarline ("we", "us", "our") operates leadnarline.com (the "Service"). This page explains what data we collect when you use it, why, and the choices you have over it.

Account information

When you create an account, we collect:

• Email address
• Password (hashed with bcrypt — we never store it in plain text)
• Account creation date

Search data

When you search for businesses, we log the query, when you ran it, how many results came back, and your user ID — this is how trial limits and credit metering work, and how we catch abuse.

Saved leads and generated sites

When you save a lead or build a site for it, we store the business's public details, the page the AI generated, and your edit history. You own this data and can export or delete it at any time.

Business data (from Google Places)

We fetch public business information — name, address, phone, rating, hours, category — from the Google Places API. This is public data, not yours, and we cache it only long enough to avoid re-billing the same lookup (Google's terms cap this at 30 days).

Usage data

Vercel Analytics automatically collects pages visited, browser/OS, device type, city-level location, and referrer, to help us understand how the product is actually used.

• To provide and improve the Service
• To authenticate you and keep you signed in
• To meter credits and enforce plan limits
• To send transactional email (receipts, account notices)
• To detect and prevent fraud or abuse
• To comply with legal obligations

We do not use your data for marketing, advertising, or third-party sale — ever, not just "without consent."

Your data lives in Supabase, an encrypted Postgres database. In practice:

• Passwords are hashed with bcrypt — salted and non-reversible
• All traffic is encrypted in transit (HTTPS/TLS)
• Row-level security means your account can only ever read its own rows
• Automatic encrypted backups

No method of transmission or storage is 100% secure, and we can't promise otherwise. If you think your account has been compromised, email narlineweb@gmail.com right away.

We do not sell or rent your personal information. We share it only:

• When required by law, court order, or a government request
• With the service providers below, under their own confidentiality and security commitments
• With your explicit consent
• If the business itself is acquired or merged, with notice to you

The service providers we actually use:

• Supabase — database and authentication
• Vercel — hosting and analytics
• Stripe — payment processing (PCI DSS Level 1)
• Google (Gemini API) — generates the site content from a business's own real data. Free-tier usage may be used by Google to improve their models — see the Gemini API policy below. We're able to switch this to a paid provider (Anthropic's Claude) that doesn't use your data for training; we'll update this notice if and when we do
• Google Places API — public business data, subject to Google's own privacy policy
• SendGrid — transactional email delivery

You can, at any time:

• Access your data (export your account, leads and sites)
• Correct inaccurate data
• Delete your account and everything tied to it within 30 days
• Object to or revoke consent for any processing

To exercise any of these, email narlineweb@gmail.com.

The Service uses an httpOnly session cookie to keep you signed in — that's it for anything essential. It can't be read by page JavaScript, which is deliberate: it's what keeps a signed-in session from being lifted by a script. Vercel Analytics may set its own cookies; you can block those in your browser without affecting sign-in.

Once you leave leadnarline.com, the destination's own policy applies:

• Google Privacy Policy
• Supabase Privacy Policy
• Vercel Privacy Policy
• Stripe Privacy Policy
• Gemini API Additional Terms of Service

• Active accounts: kept for as long as the account exists
• Deleted accounts: erased within 30 days, except where law requires longer
• Search logs: kept 12 months for abuse prevention and metering
• Backups: rolled off after 30 days

LeadNarline isn't intended for anyone under 13. We don't knowingly collect data from children, and we'll delete it immediately if we learn we have. If you believe a child has used the Service, email narlineweb@gmail.com.

If you're in the EU, UK, or California, you additionally have the right to request deletion, request a portable export of your data, object to processing, and lodge a complaint with your local data protection authority. Same contact: narlineweb@gmail.com.

If this changes in a way that matters, we'll update the date at the top of this page. Continuing to use the Service after a change means you accept the new version.

Questions about this policy or how your data is handled: narlineweb@gmail.com. One developer reads this inbox — no support queue.