Privacy Policy

Last updated 22 October 2026

ClientHunter is operated by WPVelocity, Executive Lodge, D33, Peshawar 25000, Pakistan. This policy explains what we hold, why, and what you can ask us to do about it. Contact: info@clienthunterapp.com.

Two different roles

It matters which data we're talking about:

Your account data — we decide how it's handled, so we're the controller.
Your leads — the business contacts you find, import or upload. You decide who goes in and what happens to them, so you are the controller and we act as your processor, handling that data only to run the Service for you.

What we collect

Data	Why
Email address, optional name, password (hashed with scrypt — never stored in readable form)	To create and secure your account
Google account ID and email, if you use Sign in with Google	To authenticate you. We request only your email address and basic profile. Signing in with Google never gives ClientHunter access to your Gmail.
Session tokens	To keep you signed in
Plan name (e.g. "free"), and whether you joined the Pro waitlist (with any note you add)	To apply your plan's usage limits and tell you when Pro opens. We never collect or store card details — when Pro opens, payment is handled entirely by the payment processor
Leads you find, import or add — business names, addresses, phone numbers, business email addresses, ratings, websites, your notes and statuses	To provide the CRM and campaign features. Processed on your instructions
Sending credentials — mailbox passwords or provider API keys	Encrypted at rest and used only to send your campaigns and, if your sending mailbox has reply checking connected, to read replies from your leads in that mailbox
Campaign activity — what was sent, when, delivery failures, opens, unsubscribes	To run sequences, stop on reply or opt-out, and show your stats
Usage counters and IP addresses (short-lived, in memory)	Plan limits and rate limiting to prevent abuse

We don't use advertising cookies or third-party analytics. The app stores your settings and a cache of your leads in your browser's local storage; signing out clears that cache.

Open tracking, in plain terms

Campaign emails include a 1×1 tracking pixel so you can see who opened. That means recipient opens are recorded against the lead. You control whether to use this feature by choosing to send campaigns, and as the sender you're responsible for disclosing it where the law requires.

Where your data lives

On servers operated by IONOS in Kansas City, Missouri, United States. If you're in the UK, EU or elsewhere, your data is transferred to and processed in the US. Encrypted database backups are kept for 14 days on the same infrastructure and then deleted automatically.

Who we share it with

Creem (Armitage Labs OÜ, Estonia) — our payment processor and merchant of record for Pro. When you subscribe you pay on Creem's checkout page; Creem collects your name, email, billing address and card details under its own privacy policy and handles sales tax/VAT. We receive only your email, your plan status and Creem's customer and subscription IDs — we never see or store your card number.
Brevo — sends our own system email (verification, password resets), and your campaigns too if you connect a Brevo account.
Your own email provider — when you connect a mailbox, your campaign email and recipient addresses pass through it. If your mailbox has reply checking connected, ClientHunter also reads that mailbox to find replies from your leads, as described in the Inbox section.
Google — only if you choose Sign in with Google.

We don't sell personal data, and we don't share it for advertising. We may disclose data if legally required, or to protect the Service and its users from abuse.

Inbox: reading your replies

If you connect a mailbox as a sending account (using its server login or an app password), ClientHunter reads that mailbox to show you replies from your leads.

What we save: messages from people who are your leads (in a campaign or in your lead list), the campaign emails you send them (stored with the conversation for every sender, whether or not you use the Inbox screen), and the replies you send from ClientHunter. Message text is stored encrypted.
What we never save: any other mail in your mailbox. We read only each message's headers (sender, subject, date) to decide whether it's from one of your leads; other messages are never downloaded or stored. If you turn on the optional "Everything else" view (off by default), those messages are loaded from your mail server when you look at them and are not stored by us.
Attachments are not stored. They are fetched from your mailbox when you click them.
Changes to your mailbox: we only add a copy of replies you send to your Sent folder, and, if you switch it on, mark messages read when you open them in ClientHunter. We never delete or move your mail.
Automatic opt-outs: if a lead replies asking to be removed, we add them to your unsubscribe list and stop all your campaigns to them. You can undo this.

How long we keep it

Account and lead data: until you delete it or close your account.
After account closure: erased within 30 days, except where we must keep records (for example, payment records for tax).
Backups: 14 days, then deleted.
Unsubscribe records: kept after a lead is deleted, so an opt-out can't be undone by re-import.
Inbox messages: 12 months from the date of the message, then deleted automatically. You can delete any conversation sooner. Deleted messages may remain in our backups (where message text stays encrypted) for up to 14 days.

Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or hand it to another provider. Email info@clienthunterapp.com and we'll respond within 30 days. You can export your leads to CSV from inside the app at any time, and delete your account yourself.

If someone you contacted through ClientHunter wants their data removed, they can unsubscribe from any email you sent, or write to us and we'll pass the request to the account holder responsible — they are the controller for that data.

Security

All traffic uses HTTPS. Passwords are hashed with scrypt and salted. Sending credentials are encrypted at rest with AES. Access to production is restricted to the operator. No system is perfectly secure; if a breach affects your data we'll tell you and the relevant authority as required.

Children

ClientHunter is a business tool and isn't intended for anyone under 18.

Changes

We'll post updates here with a new date, and give notice by email or in the app when changes are material.

Please note: this policy is written plainly for clarity and is not legal advice. If you process EU or UK personal data at scale through ClientHunter, you may need a data processing agreement with us and your own lawful-basis assessment — get in touch and have a qualified lawyer review your position.