Privacy Policy

Lead Logger LLC, an Illinois limited liability company operating ProspectDog (“we,” “us,” or “our”), explains in this Policy how we collect, use, disclose, and retain personal information through https://prospect.dog, our account dashboard, and related email services. It covers visitors, customers, people who contact us, referral partners, and individuals whose business information appears in our research.

We use account and prospecting information to research companies and deliver briefs you request. We use Stripe for billing, Exa for research, Resend for email delivery, and OpenAI’s Sites and Cloudflare infrastructure for hosting, authentication, and storage. Optional advertising and session-replay technologies are controlled through Privacy choices. Signing up or paying does not by itself consent to those technologies.

1 Who is responsible and how to contact us

Lead Logger LLC is responsible for the processing described in this Policy, including account administration and the operation of our business-research service. Privacy requests can be sent to legal@prospect.dog. Customer support and billing help are available at support@prospect.dog.

Business mailing address: 4815 N Neva Avenue, Chicago, IL 60656, United States

Customers who independently use research in their own outreach are responsible for their separate processing and notices. This Policy does not govern those customers’ email systems or the independent practices of websites you visit through source links. If we agree to process personal information solely on a business customer’s behalf, a separate data-processing agreement governs that processing. The standard research fields are not intended for uploading private client records.

2 Information you provide or authorize

Account information. When you sign in through ChatGPT, we receive a site-specific account identifier, your email, and available name information. We use them for authentication, account display, records, and delivery. We do not receive your ChatGPT password or obtain access to your ChatGPT conversation history through this sign-in. Google sign-in is currently unavailable.

Prospecting preferences. Onboarding collects your offer, specialty, ideal customer, target market, project-value preference, selected delivery time and time zone, and plan preference. Unfinished onboarding can be saved in your browser before you sign in. When you save your profile after sign-in, it becomes an account record. A saved plan preference is not evidence that you bought that plan.

Research and feedback. We collect your searches, saved companies, edited outreach drafts, yes/no fit ratings, optional reasons, notes, and associated times. We also retain research requests, the context supplied to the research provider, complete returned responses, generated summaries and outreach starters, source links, and email-brief snapshots.

Delivery and free-brief records. We store the recipient email, display name, delivery preferences, time-zone settings, job status, message identifiers, attempts, and delivery events. For the free introductory brief, we record your account identifier, a hash of your normalized email, research and confirmation details, attempts, and recovery information to administer the offer and prevent repeated claims. A hashed email remains potentially linkable information, not anonymous information.

Billing information. Stripe collects payment details through its hosted checkout and portal. We store or receive account-linked customer, checkout, subscription, invoice and transaction identifiers; plan and payment status; trial, renewal, cancellation and transaction dates; and relevant amounts, currency, refund, and dispute information. Our application does not receive raw payment-card numbers or card security codes. Stripe may process billing contact, address, payment, and fraud-prevention information under its own applicable terms and privacy notices.

Discovery and referral information. You may tell us where you found ProspectDog, select multiple sources, and supply an optional “Other” answer. You can skip the survey. Referral records can include a creator code, landing page, campaign tags, attribution times, and account-linked commission records. Referral partners’ administrative records include their name, email, code, status, and agreed rate.

Support communications. If you contact us, we receive the address you use, your message, and any attachments or other information you choose to provide. Do not send full payment-card details, credentials, sensitive personal information, or confidential client records.

3 Information collected automatically and from public sources

Our hosting, authentication, security, and delivery infrastructure processes information needed to handle requests, such as IP address, browser and device details, requested URLs, timestamps, referrers, errors, and security or access logs. Your browser can supply an initial time zone for scheduling. We do not request precise device location through a geolocation permission.

If you allow optional tracking, Meta and Microsoft can receive browser and advertising identifiers, page visits, device and connection information, and the interaction data described in section 6. First-party records can associate permitted campaign or click identifiers with your signed-in account. These records are separate from payment processing required to provide your subscription.

Research comes from Exa and underlying public web sources, including company websites. It generally concerns company identity, website, industry, services, business activity, and source evidence. Retrieved pages and full provider responses can also contain information about individuals, such as a business owner’s or employee’s name, role, work contact information, or statements attributed to them. We do not independently verify every item or promise that research contains no personal information. Public availability does not remove every privacy obligation.

4 Why we use information

We use the information described above to establish and protect accounts; save preferences and research; find and assess companies; prepare and deliver briefs; personalize new research using your feedback; administer subscriptions, free offers, and referral attribution; provide support; and diagnose service problems.

We also use necessary records to prevent fraud and repeated free claims, respect email suppressions and privacy choices, enforce our terms, meet legal and accounting obligations, and establish or defend legal claims. Optional measurement helps us understand website use, evaluate advertising, and improve the Service. We do not require optional tracking to provide paid access.

Where applicable data-protection law requires a legal basis, we rely on contract necessity to supply a service an individual has requested; legitimate interests in running a secure business service, supporting organizational customers, researching relevant business information, and preventing abuse; consent for optional tracking and other processing that requires consent; and legal obligations for required records and disclosures. Those legitimate interests must be balanced against affected individuals’ rights. The legal basis depends on the activity, relationship, and applicable law.

Account identity, relevant preferences, and subscription status are needed for the features they support. You can choose not to provide optional survey responses, feedback notes, or tracking consent. Without necessary information, we may be unable to provide the corresponding feature.

5 Research providers and automated processing

Exa receives your query and selected research context: your offer, specialty, ideal customer, target geography, and eligible company feedback. New research can include up to 140 recently rated companies from the preceding seven days, with company name, industry, short source summary, vote, reason, note, and rating time. Your feedback notes are included as written within the allowed length. Do not enter personal or confidential information in these fields.

We do not deliberately add your account identifier, account email, payment details, delivery schedule, or edited outreach drafts to that research context. Information you type into a query, offer, or note can nevertheless be transmitted as part of that text. The original requests and complete responses are archived in your account. Clearing a current rating does not automatically rewrite an earlier research archive.

We use automated retrieval, qualification, and source checks to generate company research. New outreach starters combine your saved offer with a checked source excerpt. ProspectDog does not use a separate OpenAI or Anthropic model API to produce these research outputs. OpenAI separately supplies the Sites and sign-in infrastructure.

ProspectDog does not operate a separate model-training pipeline using customer feedback; feedback is supplied as context for new research. This is not a promise about Exa’s own model training. Exa’s public policy describes training and model improvement using query data and excludes certain processor activities governed by customer agreements. Exa’s processing of our requests depends on the applicable agreement and service settings. Do not assume research inputs receive a blanket no-training or zero-retention treatment. Exa’s policy is available at https://exa.ai/privacy-policy.

Our research ranks potential business matches for your review. It is not used by ProspectDog to make decisions about an individual’s eligibility for employment, housing, credit, insurance, or comparable opportunities. Outputs can be inaccurate; you can edit preferences, change feedback, and request correction of personal information.

6 Cookies advertising and session replay

Essential storage. Authentication, security, and core preferences may use cookies and browser storage. The unfinished onboarding draft uses local storage. Privacy choices stores your consent preference. Blocking essential storage may prevent sign-in or other requested features.

Your optional choice. Choose Accept all on the cookie banner, or open Cookie settings to review essential storage and switch optional advertising, referral, and analytics technologies on or off, then select Save preferences. For a visitor without a saved choice, Optional cookies is initially checked in settings; opening settings alone does not activate tracking. A saved rejection and detected browser privacy signals keep it off. Privacy choices reopens these settings so you can withdraw a previous acceptance. The optional tags are not loaded before acceptance. The application also blocks its optional tracking when it detects Global Privacy Control or a Do Not Track value of “1.” These controls do not prevent the connection and security processing required to serve a page.

PostHog product analytics. With updated optional consent, we measure page visits, button and link clicks, form submissions and validation failures, onboarding steps, sign-in progression, free-brief activation, checkout, and verified subscription or payment milestones. The integration uses PostHog US Cloud through our server. A random first-party browser identifier can persist for up to 30 days so events in a funnel can be connected. This is pseudonymous measurement, not a claim that all events are unidentifiable. We do not send PostHog your email, name, account ID, form values, lead details, outreach drafts, raw URLs, query strings, referrers, visitor IP, or browser user-agent. Person profiles, PostHog session replay, and GeoIP enrichment are disabled. Event fields are limited to predefined page and control labels, bounded control positions, steps, plan names, operation outcomes, and similar product categories. The server sees ordinary connection information required to receive a request; it does not forward your visitor IP to PostHog. Rate limits and event ceilings can cause some events to be omitted. Forwarding is controlled by a server-side enable switch.

Google Tag Manager. With optional consent, Google Tag Manager loads and manages website tags. Google can receive page and connection information when its container is requested. The container waits for your optional acceptance and receives updates when that choice changes. We do not deliberately place account emails, phone numbers, saved research, or outreach drafts in its data layer. Tags delivered through the container remain subject to the purposes and privacy controls described in this Policy.

Meta Pixel. With optional consent, Meta’s tag measures page views and eligible trial-start and return-visit events. The named return events reflect dashboard visits on elapsed days 2, 7, and 14 after the first measured open; they do not measure whether you opened a brief email. Meta can receive page URLs, IP and device information, cookies, and advertising identifiers, and may connect activity to information it already holds. Our custom event fields do not include your account email, queries, leads, or drafts; automatic advanced matching is not enabled in our integration.

Microsoft Advertising and Clarity. With optional consent, our Microsoft Advertising UET tag measures visits, completed signup setup, plan selections, opened checkouts, external-link clicks, and eligible trial/return events. Completed signup setup means saving a profile and requesting the first free brief. Events may include the selected Starter or Pro plan and an opaque event identifier used to reduce duplicate counting. A plan click, opened checkout, or free trial is not reported as a payment. We do not send raw account emails, phone numbers, prospect details, or external-link destinations as custom event fields. After you accept the updated optional-tracking notice, signup and trial events can include a SHA-256 hash of your normalized sign-in email for Microsoft enhanced conversion matching. Hashing does not make the email anonymous: Microsoft can match it to information it holds. This hash is sent directly to Microsoft, not added to Google Tag Manager’s data layer or Meta event fields. Where Clarity is enabled for that tag, Microsoft also processes behavioral metrics, clicks, scrolling, interaction timing, page structure, heatmaps, and session replays to help us understand and improve the website and advertising. Microsoft may use first-party and third-party cookies and similar identifiers and process information for its own purposes under its Privacy Statement.

Before the tag loads, the application marks private application-page content, forms, and editable fields for Clarity masking. We do not assign your email or account identifier as a Clarity custom identifier. Masking is a measure to reduce recorded content; it does not eliminate connection or interaction metadata or guarantee that all personal information is excluded. The application removes known campaign parameters and fragments before advertising tags load and suppresses those tags on URLs with unrecognized query parameters.

Meta server-side payments. After you accept the updated optional-tracking notice, we report successful subscription payments, including renewals, through Meta Conversions API. We send the actual amount paid, currency, payment time, plan, invoice/event identifiers, a hashed internal account identifier and normalized sign-in email, and permitted Meta browser/click identifiers. For a first payment, we can also send the IP address and browser user-agent captured during a consented signed-in request within the preceding hour. These browser details are sent without hashing and are omitted for renewals or when that context is missing or too old. A separate Subscribe event identifies the first paid invoice of a subscription without adding revenue again. Hashes can be matched by Meta and are not anonymous. We do not send phone numbers. Failed payments and zero-value invoices are not purchases. Withdrawing optional consent stops subsequent reporting. Advertising attribution windows may exclude later renewals from campaign reports; reporting is not a guarantee of lifetime-value optimization. Refunds are not currently automatically deducted from Meta purchase reporting.

Campaign attribution. With optional consent, we may capture supported campaign tags, Meta browser/click identifiers, and a Microsoft advertising click identifier, together with its capture time. Permitted identifiers can be linked to your account after sign-in. The current configuration does not forward billing events through Zapier. Microsoft server-side subscription reporting is configured to report the first successful paid subscription with optional consent. It sends the Starter or Pro plan, the actual amount paid and currency, payment time, invoice/event identifiers, and an eligible Microsoft click identifier and/or the consented email hash. Renewals and free trials are excluded from these new-paying-customer events. Additional materially different disclosures require an updated notice and any necessary consent.

Withdrawal. Rejecting optional cookies stops future application tracking on that browser, sends available provider withdrawal signals, clears local attribution, and requests removal of account measurement records and suppression of future account forwarding. Account-level changes require a successful request while signed in. A failed account-measurement deletion displays a retry notice. Browser preferences do not automatically synchronize across devices. Withdrawal does not recall information already received by a provider or necessarily erase cookies the provider already set; use browser and provider controls for those records.

Disclosures to advertising partners may be treated as a “sale,” “sharing,” or “targeted advertising” under applicable privacy law even without a money payment. Use Privacy choices to opt out of these disclosures. We do not provide account profiles, saved research, or edited drafts as custom advertising-event fields. Providers may collect activity across other websites and services under their own policies.

7 Referrals and affiliate records

If you accept optional cookies, a valid referral or campaign visit can create an opaque first-party referral cookie lasting up to 90 days. The associated record contains a hashed token, creator identifier if applicable, landing path, permitted campaign fields, and creation and expiry times. The referral record itself does not store an IP address or browser user agent, although hosting logs can process those details.

A valid referral may be attached to a new account when you save your profile. That account association is separate from the browser cookie. It can remain after the cookie expires or is withdrawn to administer an existing referral relationship, prevent disputes, and reconcile transactions. Relevant creator identifiers and commission rates can be included in Stripe subscription metadata.

The operator can review referral and invoice-based commission records. The current product does not give referral partners access to your research queries, company lists, or outreach drafts, and automatic affiliate payouts are not active. Clearing your discovery survey removes those answers and associated campaign details, but does not erase locked referral credit or financial records.

8 Email delivery and external resources

Resend receives your recipient address and the subject, HTML, and text of requested briefs. We store delivery attempts and relevant sent, delayed, delivered, failed, bounced, suppressed, and complaint events, including provider identifiers, recipient address, and timestamps. Bounces or complaints can pause briefs and create a hashed-email suppression record to prevent further sends.

Our application processes delivery events rather than email-open or click events. Provider-side email tracking can depend on the sending provider’s settings; the application’s day-2, day-7, and day-14 events are dashboard events. We do not promise that a provider or email client generates no additional technical records.

Briefs can load company icons from company websites and the ProspectDog logo from our site. Your email client, browser, or its image proxy may send connection information to those hosts when images load. We do not append a recipient identifier to company-icon URLs. You may disable remote images in your email client. Opening a source link sends a request to the source website, which applies its own practices.

The website uses Google Fonts; font requests can disclose connection details to Google even if you decline optional advertising tracking. Gmail outreach and inbox access are not offered. If an older Gmail connection exists, you can disconnect it in account settings; retained historical records can be addressed through workspace deletion and a privacy request.

9 When we disclose information

We disclose information to the providers needed to perform the activities described here: OpenAI’s Sites and authentication infrastructure, Cloudflare hosting and database infrastructure, Exa research, Stripe billing, Resend delivery, and supporting technical services. Google supplies external fonts and, with optional consent, tag management. Meta and Microsoft receive the optional measurement information described above. A provider may act on our instructions for some activities and as an independent controller for others, such as its own fraud prevention or advertising services.

Customers receive the business research prepared for their accounts. If that research contains personal information from public sources, it is disclosed to those customers for their independent business assessment. We do not sell our subscriber account list for money. This statement does not characterize every advertising disclosure or distribution of prospect information as exempt from privacy-law definitions of sale or sharing. People described in research may request access, correction, deletion, or an applicable opt-out under section 11.

We may also disclose information to professional advisers bound by appropriate confidentiality obligations; to comply with a lawful requirement; to protect rights, safety, and security; or in connection with a merger, financing, reorganization, or sale of the relevant business, subject to applicable legal protections. We may make another disclosure at your direction or with valid consent. We do not publicly post your private saved workspace merely because you use the Service.

10 Retention and what deletion does

Browser drafts. The onboarding draft and ordinary local campaign record use a seven-day inactivity expiry checked when the application next reads them. Browser storage does not automatically erase itself at that deadline. You can clear the onboarding draft or browser storage sooner. Consent preferences and duplicate-event markers can remain until changed or cleared.

Research and profile records. Saved profiles remain until deleted or replaced. Research history, results, drafts, ratings, brief contents, and raw research archives remain until you delete the relevant workspace records or we complete an applicable broader deletion request. The display of only a limited number of history items does not mean older records have been erased. Seven days is the active feedback-personalization window, not a deletion period. Earlier archives can retain the feedback used when they were created.

Usage and operational records. Workspace deletion removes the active research content, while some account-linked job and queue metadata and current-day usage records remain. Deleted research-job records become eligible for cleanup on a later research request after the UTC day ends. Cleanup is request-driven, not a promise of deletion at midnight. Free-brief claim markers, confirmation/attempt metadata, email suppression hashes, and some historical operational identifiers are separate records; they are not all removed by a workspace reset.

Product analytics safeguards. The random analytics cookie and checkout-to-browser association expire after up to 30 days. Local abuse-control counters use rotating keyed IP hashes without storing raw IPs, and expire within about two days; monthly counters and deduplication records can persist until the following month or up to 31 days. Expired server records are deleted on subsequent new analytics sessions, rather than by an automatic deletion job at the deadline. Withdrawing consent revokes that browser identifier and removes its checkout association. Previously received PostHog events are not recalled by browser withdrawal; their retention and deletion depend on the service configuration and applicable requests.

Referrals and attribution. Referral cookies expire after up to 90 days; expired server visit records are removed in batches on later referral requests. Microsoft click identifiers are eligible for matching for up to 90 days from capture, without visits extending that limit. An email hash saved for server-side Microsoft matching is eligible for up to 90 days after it is refreshed during a consented signed-in visit. Expired identifiers are ignored and are removed or replaced on a subsequent attribution refresh or withdrawal; this is request-driven cleanup, not automatic deletion at the expiry time. The latest consented IP address, browser user-agent and capture time are stored in account attribution and replaced on a subsequent attribution refresh or cleared on withdrawal. The one-hour eligibility limit for Meta matching is not an automatic deletion deadline. Account-linked referral and financial records have a different retention basis from an anonymous visit cookie.

Billing and administration. Subscription, invoice, financial reconciliation, dispute, fraud-prevention, suppression, and legal records may need to be retained after cancellation or a deletion request. We determine applicable retention by the purpose, transaction or dispute status, legal requirements, and the need to prevent repeated abuse or unwanted email. Where a deletion exception applies, we will explain it and limit use of the retained information to the relevant purpose.

Provider copies. Deleting active application data does not instantly erase provider logs, backups, payment records, messages already sent, or copies downloaded to a device. Provider records are governed by the applicable agreements, settings, and legal obligations. We do not promise a universal backup-erasure deadline or zero retention. Contact us about records beyond the self-service controls.

11 Your controls and privacy rights

You can edit saved targeting and feedback; clear the local onboarding draft; delete the saved profile through Account settings; delete saved searches, leads, drafts, ratings, brief contents, and research archives through History; clear discovery survey answers; pause brief delivery; and change optional tracking through Privacy choices. These controls have different scopes. Deleting research does not delete the profile, close the account, or cancel billing, and enabled scheduling can create new research later. Pause delivery or request account closure if you want future processing stopped.

For account-wide requests or information not available through those controls, email legal@prospect.dog. Depending on your location and applicable law, you may request access, a copy or portable version, correction, deletion, restriction, objection to certain processing, withdrawal of consent, or an opt-out of sale, sharing, or targeted advertising. You can object to processing for direct marketing where applicable. Withdrawing consent does not invalidate earlier lawful processing. We will not unlawfully discriminate for exercising a privacy right.

You do not need to be a customer to contact us about personal information appearing in research. Identify the information and, if possible, the relevant source URL. We may need to verify your identity and the scope of the request, using proportionate information rather than demanding unnecessary sensitive documents. An authorized agent may act where permitted, with appropriate evidence of authority. You can request the specific sources and recipients relevant to your information where the law provides that right.

We will respond within the period required by applicable law, explain any lawful exception or extension, and provide applicable appeal instructions if we decline a request. You may appeal by replying to our decision at legal@prospect.dog. You may also complain to the competent privacy authority, including an appropriate European supervisory authority or the UK Information Commissioner where their laws apply. These rights are subject to applicable scope and exceptions; listing them does not represent that every privacy statute applies to every user.

12 International processing

ProspectDog is operated from the United States. Information may be processed there and in other countries where our providers operate, and those countries may have different privacy laws. We do not promise a particular data-residency region.

Where applicable law requires safeguards for a restricted international transfer, a valid mechanism must cover that transfer, such as an applicable adequacy decision or appropriate contractual safeguards. Contact legal@prospect.dog for information about the arrangements relevant to your data and any available copy of safeguards. This Policy does not claim that Lead Logger LLC is certified under a privacy framework, and acceptance of this Policy is not a substitute for a required transfer mechanism.

13 Security

We use measures designed to protect information, including authenticated account access, account-scoped data operations, secure transport, and verification of billing and delivery notifications. These measures do not guarantee absolute security or error-free operation. We will address and provide notice of a personal-information breach as required by applicable law.

Protect your sign-in account and device. Browser drafts, copied text, and downloaded files can be accessed through a compromised device, extensions, shared-device access, or your own synchronization settings. Do not enter secrets or sensitive or confidential records into research fields or feedback notes.

14 Children

ProspectDog is a business service for adults aged 18 or older and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has supplied personal information, contact legal@prospect.dog so we can investigate and take appropriate action, including deletion where required. We do not knowingly sell or share personal information of individuals under 16 for targeted advertising.

15 Policy changes and provider information

We will update the effective date when this Policy changes. For material changes, we will provide appropriate notice through the Service or email before the change takes effect, except where law permits or requires a different approach. We will obtain additional consent where required. Publishing an update does not itself authorize an incompatible new use of previously collected personal information.

The providers’ notices explain their own practices and do not replace our responsibilities or establish the exact settings of our account. Relevant notices are available at:

• OpenAI: https://openai.com/policies/privacy-policy/
• Cloudflare: https://www.cloudflare.com/privacypolicy/
• Exa: https://exa.ai/privacy-policy
• Stripe: https://stripe.com/privacy
• Resend: https://resend.com/legal/privacy-policy
• Meta: https://www.facebook.com/privacy/policy/
• Microsoft: https://privacy.microsoft.com/privacystatement
• Google Tag Manager: Google Privacy Policy
• PostHog: https://posthog.com/privacy
• Google Fonts: https://developers.google.com/fonts/faq/privacy

Questions and privacy requests: legal@prospect.dog. Support and billing: support@prospect.dog.