Privacy Policy — LPH Prospect
Version 2.0 — May 2026
Leads Per Hour LTDA ("LPH") operates an artificial intelligence platform for B2B sales. This Privacy Policy applies to LPH Prospect (LeadGen AI): an AI system that automates commercial prospecting: lead identification, multichannel outreach cadences, contact qualification, and meeting scheduling.
By accessing or using LPH Prospect (LeadGen AI), you represent that you have read, understood, and accepted this Policy. If you do not agree, do not use the Services. This Policy is designed to comply with the Brazilian General Data Protection Law (LGPD), the European General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
1. Who We Are and Our Roles in Data Processing
1.1 When LPH Acts as Processor
In most situations, LPH acts as data processor, processing personal data in accordance with the Customer's instructions, who is the controller. In these cases, the obligations of transparency and obtaining consent from data subjects belong to the Customer.
1.2 When LPH Acts as Controller
LPH acts as controller when it autonomously defines the purposes and means of processing — for example, when processing data of LPH's own Customers and platform users for managing the commercial relationship, when developing AI models with genuinely anonymized data, or when complying with LPH's own legal obligations.
2. What Data We Collect
2.1 Customer and Platform User Data
To enable the provision of the Services and the management of the commercial relationship, LPH collects the following data from the Customer's representatives and Authorized Users:
- Identification data: full name, role, company, tax ID;
- Contact data: business email, phone, WhatsApp;
- Access data: login credentials, access logs, IP address, device used;
- Platform usage data: features accessed, configurations, history of support interactions;
- Financial data: billing information, tax ID for invoice issuance (we do not store credit card data).
2.2 Automatically Collected Data
When accessing the platform, LPH automatically collects:
- IP address, device and browser type, operating system;
- Pages accessed, session duration, and navigation flow;
- Cookie data and similar technologies, as described in Section 10.
2.3 Product-Specific Data
LPH Prospect (LeadGen AI) processes additional categories of data specific to its function, including data accessed through Google Workspace APIs. See the product-specific section below for the complete description and the Google Limited Use disclosure.
3. Why We Use the Data — Purposes
3.1 Provision of Contracted Services
The primary use of data is the operation of the Services contracted by the Customer. Without this data, it is not possible to deliver the Services.
3.2 Management of the Commercial Relationship
Customer and platform user data is used for: invoice issuance and billing; communications about contracted Services; technical support; and renewals or contract changes.
3.3 Service Improvement and AI Development
LPH uses anonymized and aggregated data for identifying errors and improvements in the platform and developing AI models. Identifiable personal data obtained from Google Workspace APIs is never used to train, develop, or improve generalized or non-personalized AI/ML models. See the Google Limited Use disclosure below.
3.4 Compliance with Legal Obligations
LPH may process personal data to comply with legal, regulatory, judicial, or administrative obligations, disclosing only the minimum necessary.
3.5 Security and Fraud Prevention
Platform access and usage data are used for security monitoring, detecting improper use, fraud prevention, and protection of system integrity.
4. Legal Bases for Processing
LPH processes personal data only when a valid legal basis exists under the LGPD (arts. 7 and 11), the GDPR (art. 6 and art. 9), and applicable U.S. state privacy laws including the CCPA/CPRA.
| Purpose | LGPD Basis | GDPR Basis |
|---|---|---|
| Provision of contracted Services | Performance of contract (art. 7, V) | Performance of contract (art. 6(1)(b)) |
| Customer relationship management | Performance of contract (art. 7, V) | Performance of contract (art. 6(1)(b)) |
| Platform / AI model improvement | Legitimate interest or anonymized data | Legitimate interest or anonymized data |
| Compliance with legal obligation | Legal obligation (art. 7, II) | Legal obligation (art. 6(1)(c)) |
| Security and fraud prevention | Legitimate interest (art. 7, IX) | Legitimate interest (art. 6(1)(f)) |
Additional legal bases specific to LPH Prospect (LeadGen AI) are described in the product-specific section below.
5. Sharing and International Data Transfer
5.1 Categories of Recipients
LPH may share personal data with the following recipients:
- Service providers and sub-processors: cloud infrastructure providers (including Google Cloud Platform), video conferencing platforms, CRM and analytics tools — contractually obligated to maintain equivalent protection standards;
- Customers: in the course of providing the Services, LPH shares generated outputs with the contracting Customer;
- Competent authorities: when required by law, judicial decision, or administrative authority request, only to the extent strictly necessary;
- Acquirers in corporate transactions: in the event of a merger, acquisition, or sale of LPH's assets, with notice to users.
5.2 International Transfer
LPH uses cloud infrastructure that may be located outside Brazilian territory. International transfers are made under:
- European Union / EEA: Standard Contractual Clauses (SCCs) approved by the European Commission, under art. 46 of the GDPR;
- Brazil: for data sent to countries with an adequate level of protection recognized by the ANPD, the transfer occurs without additional requirements;
- Other countries: SCCs approved by ANPD Resolution No. 19/2024.
5.3 No Sale of Data — CCPA/CPRA Statement
LPH does not sell, rent, share, or assign personal data to third parties for marketing or advertising purposes independent of the Services contracted by the Customer. For purposes of the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), LPH does not "sell" or "share" personal information as those terms are defined under California law.
6. Data Retention and Deletion
LPH retains personal data only for the time necessary to fulfill the purposes that motivated its collection:
| Data Category | Retention Period | Basis |
|---|---|---|
| Customer and platform user data | During contract term + 5 years | Civil claims statute of limitations. |
| Google Workspace API data | Only as long as needed for the user-facing feature | Per Google Limited Use requirements. |
| Access and security logs | 6 months or specific legal term | Art. 15, Brazilian Internet Civil Framework. |
| Tax and financial data | 5 years after invoice issuance | Tax and accounting obligations. |
| Consent records | 5 years after revocation or end of relationship | Required for evidence of legal compliance. |
Additional product-specific retention periods are described in the product-specific section below. After the applicable retention period ends, data is securely deleted or irreversibly anonymized.
7. Information Security
7.1 Technical and Organizational Measures
LPH adopts technical and organizational measures consistent with market standards to protect personal data. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
7.2 Incident Notification
In the event of a Data Breach that may pose risk or harm to data subjects, LPH will notify the Customer within no more than 72 (seventy-two) hours after becoming aware of the incident, with the information necessary to comply with communication obligations to the ANPD (LGPD art. 48) and to affected data subjects under the GDPR (art. 33).
8. Data Subject Rights
Under the LGPD (arts. 17 to 22), the GDPR (arts. 15 to 22), and the CCPA/CPRA, you have the following rights:
| Right | Description |
|---|---|
| Confirmation and Access | Obtain confirmation of the existence of processing and access to the personal data held by LPH. |
| Rectification | Request correction of incomplete, inaccurate, or outdated data. |
| Deletion | Request deletion of data when unnecessary, processed unlawfully, or when consent is withdrawn. |
| Portability | Receive the personal data provided in a structured, commonly used format. |
| Restriction of Processing | Request suspension of processing while there is a dispute about its lawfulness or necessity. |
| Objection | Object to processing carried out on the basis of legitimate interest. |
| Withdrawal of Consent | Withdraw consent at any time, without prejudice to processing carried out before withdrawal. |
| Review of Automated Decision | Request human review of decisions made solely by automated means. |
| Right to Know (CCPA) | Request disclosure of categories of personal information collected, sources, purposes, and recipients. |
| Right to Opt-Out (CCPA) | Opt out of the sale or sharing of personal information (note: LPH does not sell or share). |
| Non-Discrimination | Not be discriminated against for exercising any privacy right. |
| Petition to Authority | File a complaint with the ANPD (Brazil), the relevant supervisory authority (EU), or the California Privacy Protection Agency. |
8.1 How to Exercise Your Rights
You may exercise your rights at any time by contacting privacy@leadsperhour.com. LPH will respond within no more than 15 (fifteen) days (LGPD) or 30 days (GDPR/CCPA).
8.2 Revoking Google Account Authorization
You may revoke LPH Prospect (LeadGen AI)'s access to your Google account at any time by visiting your Google Account permissions page. Revocation immediately stops LPH Prospect (LeadGen AI) from accessing your Google Workspace data. Revocation does not affect lawful processing performed prior to revocation.
9. Minors
LPH's Services are intended exclusively for individuals over 18 years of age or for companies represented by their legal representatives. LPH does not knowingly collect personal data from minors under 18. If LPH becomes aware that data from minors has been inadvertently collected, it will take steps to delete it promptly.
10. Cookies and Tracking Technologies
LPH uses essential, analytical, and performance cookies on the platform. LPH does not use third-party cookies for targeted advertising. Users can manage cookie preferences in their browser settings.
11. Changes to This Policy
LPH may update this Policy from time to time. Material changes will be communicated to the Customer with at least 15 (fifteen) days' prior notice via the registered email.
12. Contact and Data Protection Officer
To exercise rights, clarify questions, file complaints, or report incidents related to personal data, you may contact LPH's Data Protection Officer (DPO):
| Item | Information |
|---|---|
| Controller | Leads Per Hour LTDA |
| CNPJ | 57.835.053/0001-40 |
| Address | Rua Nereu Ramos, 165, Sala 201, Andar 2, Centro, Blumenau, SC, CEP 89010-019, Brazil |
| Privacy Email | privacy@leadsperhour.com |
| Response Time | Up to 15 business days (LGPD) / 30 days (GDPR & CCPA) |
13. LPH Prospect — Specific Data Practices
13.1 Data Processed
When operated by the Customer, LPH Prospect processes the following categories of data, in addition to those described in Section 2:
- Lead contact data: name, email, phone, company, role, and professional profile of natural persons used as prospects;
- Interaction data with sent communications: email opens, clicks, replies, opt-out requests;
- Engagement and qualification history generated by the system;
- Meeting-scheduling data exchanged with the Customer's calendar.
Lead data is retained while the campaign is active plus the period defined by the Customer, then deleted or returned to the Customer after termination.
13.2 Legal Basis and Customer Documentation
LPH Prospect processes contact data of natural persons for commercial prospecting purposes. The Customer is responsible for:
- Documenting the legal basis used for each database — legitimate interest (LGPD art. 7, IX) for B2B or consent for B2C;
- Performing and documenting the legitimate-interest balancing test before use;
- Documenting the origin of each database by keeping logs with source, collection method, and date;
- Ensuring that data obtained from third-party platforms is used in compliance with those platforms' terms of use.
13.3 Opt-Out and Data Subject Rights
LPH Prospect incorporates a mandatory opt-out mechanism in all communications. The Customer must:
- Process all opt-out requests within a maximum of 10 (ten) business days;
- Maintain a documented record of all requests and their processing;
- Not contact data subjects who have requested opt-out again, except upon new express consent.
13.4 Automated Decision-Making
To the extent that LPH Prospect selects and qualifies leads through algorithmic logic, the Customer acknowledges that these processes constitute automated decision-making (LGPD art. 20; GDPR art. 22). The Customer agrees to make available a human review process to any data subject who requests it.
Google API Services — Limited Use Disclosure
LPH Prospect requests authorization to access the following Google Workspace API scopes. Each scope is requested in a distinct authorization flow, as described below:
| API | Scope | Purpose |
|---|---|---|
| Google Calendar API | calendar.events | Detect availability and create meetings on the user's calendar when a qualified lead books a slot through the outreach campaign. |
calendar.eventsLPH Prospect's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Specifically, LPH Prospect affirms that:
- The use of information received from Google APIs is limited to providing or improving user-facing features that are prominent in the requesting application's user interface.
- Data obtained from Google APIs is not transferred to others except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice to users).
- Data obtained from Google APIs is not used or transferred for serving advertisements, including retargeted, personalized, or interest-based advertising.
- Humans do not read the data unless: (a) we have the user's affirmative agreement for specific messages, (b) it is necessary for security purposes such as investigating abuse, (c) it is needed to comply with applicable law, or (d) the data has been aggregated and anonymized for internal operations.
- Data obtained from Google APIs is not used to train or improve generalized / non-personalized AI or machine learning models.
14. Jurisdictional Notices
Blumenau, May 2026.
Leads Per Hour LTDA
leadsperhour.com · lphmeet.com
Privacy Channel
Questions about your data, requests for access, correction, deletion, portability, or to exercise any right under the LGPD, GDPR, or CCPA/CPRA. Email privacy@leadsperhour.com. We respond within 15 business days (LGPD) or 30 days (GDPR/CCPA).