Privacy & terms

What we store, and on what terms

Leadgen is a web app, an API and an MCP server over Romania's official company registry. This page is the whole policy; there is no longer version. Last updated 20 October 2026.

Who is responsible for your data

The controller of the personal data described on this page is the operator of Leadgen:

• Operator: OAIDA A. IOAN-ADRIAN PERSOANĂ FIZICĂ AUTORIZATĂ
• Tax ID (CUI): 55685084
• Trade Register no.: F2026045821000
• Registered office: București, Sector 1, Bd. Dinicu Golescu nr. 7, Parter, SP. COM. 3
• Phone: +40 787 821 226
• Email: contact@adrianhomelab.com

Write to contact@adrianhomelab.com to see, correct, export or delete your data, or to object to its use; we answer within a month (the legal deadline), usually within 2 working days. If you think we handle it unlawfully you can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro).

What we store about you

• If you get a free key at /start: your email address, the key, the day it was issued, the IP address that asked for it, the channel label of the link you arrived through (for example ?ref=newsletter, if the link carried one), and a per-day count of calls made with the key. Nothing else — no name, no payment details.
• If you subscribe to Pro or Business (a monthly or annual Stripe subscription on your key): Stripe handles the card, the billing address and the tax ID you enter, and keeps the payment record; we never see the card. We keep your email address, your key (shown in our logs and tools only by its prefix), the plan and its billing period, the Stripe customer and subscription IDs that tie the plan to your key, and the order (when, buyer type, the company's CUI or VAT number if any, the boxes you ticked and when, and the country of the billing address, for the invoice). When you cancel, we keep the reason you pick in the subscription portal, if you pick one (it is optional), to improve the product. Invoices are issued through our accounting provider from that payment data and kept, like the payment records, for the 10 years Romanian accounting law requires. Cancellation, withdrawal and refunds: terms.
• If you call anonymously: a daily call count for each IP address, so the daily allowance (5 lookups) can be enforced, and a request log line (time, endpoint, query, IP) kept for abuse investigation and usage statistics.
• Data read from websites (extract_contacts, enrich_company): we cache what the site publishes, keyed by domain, for up to 30 days. If you turn on watchlist alerts: the alert address and whether you confirmed it; every email we send is logged (recipient, time, outcome), and an address that unsubscribes is kept on a suppression list so we never write to it again.
• If we wrote to your company about the beta: we used the company's registry record (name, CUI, county, activity) and the address it publishes on its own website, and we keep a log of what we sent and when, plus a suppression list. Reply “stop” or use the unsubscribe link and the address is never written to again; ask and the log entry is deleted too.
• When you visit our sites (this site, the app, the checkout and the MCP server's page): the proxy in front of them writes one log line per request, with the time, the page or file requested, the response status, your IP address, your browser's name (User-Agent), the site that linked to the page and the country Cloudflare reports. Links that carry a one-time secret (sign-in, confirmation, payment and withdrawal links) are logged with the secret blanked out. We use the log for security and to count visits per site: page views, visitors per day, which search engine or site sent them (its name only, never the page or the search words) and how many reached the free key, sign-in and payment pages. The counts hold no IP address, no browser name and no identifier: a visitor is recognised only within one day, in memory while the counts are made, and is never stored. No cookie, script or browser storage is used for this, so there is nothing to consent to; the basis is our legitimate interest in running and improving the sites (GDPR art. 6(1)(f)). The proxy deletes its log lines after 30 days at most.
• If you tick the news box on /start or at the app's email sign-in, on the news page or in the app's account menu (it is optional and never needed for a key): on /start, the news page and in the app's menu we first email you a link to confirm it; we keep that you said yes, when, the wording you saw and where, and send you occasional news about Leadgen. Every such email has a one-click unsubscribe link; unsubscribing, or deleting your data, withdraws the consent at once. The basis is your consent (GDPR art. 6(1)(a); Law 506/2004 art. 12).

Your address is used to contact you about your key (limits, abuse, changes to the service) and, only if you ticked the news box, for occasional news about Leadgen; for nothing else. It is never sold or shared. You can delete it and your key yourself, below.

If you send feedback (the feedback page, POST /feedback or the MCP tool report_issue): the message, the page it came from, the reply address if you left one, and a salted hash of the network address for abuse handling. It is read by the founder and never emailed to you unless you asked for a reply.

Deleting your data

Do it yourself: Delete my data on /start emails a confirmation link to your address, and one click deletes, at once (a paid subscription that still renews has to be cancelled first):

• your API key (it stops working at once), its daily counters, its plan, note and rotation history, and your choice to receive Leadgen news
• your watches, alert subscription and digest lists
• the log of emails we sent you, and the feedback you sent with this address (on other feedback, the link to your key and any mention of the address)
• your lead-list app data: sign-up, search history, app feedback, beta request and export history

What we keep, and why:

• payment records (Stripe's, our orders and subscriptions, the invoices, refunds and withdrawal statements) for 10 years, as Romanian accounting law requires (Law 82/1991); the API key in them is replaced by a one-way hash
• the request logs, which hold only an 11-character key prefix and the network address, until they rotate out after 12 weeks
• a one-way hash of the address on our do-not-email list, so nothing is ever sent to it again
• a record that a deletion was done, holding only a one-way hash of the address

Or write to contact@adrianhomelab.com; we answer within a month at the latest (the legal deadline), usually within 2 working days.

Cookies

Our sites set only these cookies:

• theme: light or dark look. Set only when you click the switch in the header, on .adrianhomelab.com so the choice follows you across our sites; kept 1 year.
• lang: the language, Romanian or English. Set only when you click the RO/EN pill in a page's header (or open a link with ?lang=), on .adrianhomelab.com so the choice follows you across our sites; kept 1 year. Until you choose, a first visit follows your browser's language setting.
• lb_tester: the app's sign-in session (leadgen-app), strictly necessary to stay signed in. Set only when you sign in; signed, encrypted and not readable by scripts; 30 days after a sign-in with a key, 90 days after a beta invitation, deleted when you sign out.
• lb_row: technical, 60 seconds, only on the app's company pages: marks the firm you opened from your list so the page can skip a registry check.
• lg_internal: operator only: marks the browsers of the operator and the people testing the service for him, so their own visits and calls are left out of our visitor and usage statistics. Set only through a secret link the operator holds, on .adrianhomelab.com, not readable by scripts; kept 1 year. Visitors never receive it.

No analytics, advertising or tracking cookies, and no tracking pixels. Each cookie above is either strictly necessary for a service you asked for (signing in) or remembers a choice you made yourself (theme, language), so under Law 506/2004 art. 4(5) it needs no consent, and there is no cookie banner. The one exception, lg_internal, is set only in the operator's own browsers, never in a visitor's.

The app also keeps your current list and its filters in your browser's storage (sessionStorage for this tab, localStorage before your first sign-in), and the plans pages hand your key from /manage to /withdraw through this tab's sessionStorage; these stay in your browser. Whether you closed the app's short tour is kept in your browser's localStorage and, so it does not come back on another browser or device, with your app account (the time you first closed it), deleted with the account. Signing out of the app, or deleting your data, clears what the app kept in the browser.

Fonts are self-hosted: Sora and Manrope come from our own servers, so opening a page sends nothing to Google or any other font service. Our pages load no third-party scripts, images or trackers; the one exception is the API reference at /docs, which loads the Swagger UI viewer from cdn.jsdelivr.net (jsDelivr sees your IP address when you open it).

Not ours: Cloudflare, which carries all traffic to our sites, may set its own security cookies (such as __cf_bm) to tell people from bots; when you pay you are on checkout.stripe.com, where Stripe sets its own cookies under its privacy policy. The operator's admin panel has its own sign-in cookies; public pages never set them.

Who else sees your data

• Cloudflare (network provider): every request to our sites passes through Cloudflare (tunnel, DNS), so it sees your IP address and the request.
• Migadu (Migadu-Mail GmbH, Switzerland; mailbox hosting): hosts the operator's mailboxes, so every message you send to our contact address is stored there, with its sender, recipients, time and content. Migadu states its data centres are in France; the company is in Switzerland, which the EU recognises as giving adequate protection (Decision 2000/518/EC). The contact address forwards them to a Gmail account, where the operator reads them: Gmail is provided by Google Ireland Limited (Ireland), and Google may process mail on its servers worldwide, including in the US, under the EU-US Data Privacy Framework (Decision (EU) 2023/1795) and standard contractual clauses.
• Stripe (payments): only if you subscribe; see above.
• Resend (email delivery): sends the emails we write to you (your key, sign-in links, alerts, confirmations), so it sees your address and the message.
• Hosting: the service runs on servers the operator runs himself; the database, the logs and the keys are not held by a hosting company.
• Our accounting and invoicing provider (Romania): only if you subscribe. Your name, billing address, email and, for a company, its tax ID go to it so it can issue the fiscal invoice; an invoice to a Romanian buyer is also sent to ANAF's e-Factura system, as the law requires.

Where the company data comes from

From the public datasets the Romanian Trade Register Office (ONRC) and the Ministry of Finance publish on data.gov.ro, loaded as published, with the snapshot date shown on /health, and from ANAF's public taxpayer web service: the phone a firm declared to ANAF, its VAT registration, e-Factura and fiscal inactivity. Directors' names, company addresses and phones in the results are the public record of those authorities; if you believe an entry is wrong, the correction has to happen at the source (ONRC or ANAF), and we will reload it with the next update. If the data is about you, read Are you in the registry?

Are you in the trade register? What we do with your data

Leadgen takes company data from official public sources:

• the trade register published by ONRC on data.gov.ro;
• the financial statements published by the Ministry of Finance;
• what ANAF makes public through its web service (the declared phone, VAT registration, e-Factura, fiscal inactivity).

If you represent a company or hold a PFA, II or IF, this includes data about you:

• your name and your role in the firm;
• the registered address (for a PFA this may be your home);
• the phone number declared to ANAF.

For firms that have a website, we may also hold the contact addresses published on that site.

• Controller: OAIDA A. IOAN-ADRIAN PERSOANĂ FIZICĂ AUTORIZATĂ (full details above). Contact: contact@adrianhomelab.com.
• Purpose: finding and checking businesses (due diligence) and finding B2B partners and customers.
• Basis: legitimate interest (GDPR art. 6(1)(f)), our users' and ours, in knowing who they do business with. The data is already public by law, and we use it only in your business capacity. To protect your interests we publish this notice, honour an objection through any channel, show a PFA, II or IF in lists and exports with its locality only, not the street, compute no score about people beyond the register's own status, and our terms bind our users to the same rules. Our legitimate-interest assessment is available on request.
• Who sees it: users of the Leadgen API, MCP server and app. Each is a separate controller for how they use it. Our terms forbid them to send unsolicited commercial messages without consent (Law 506/2004).
• How long: for as long as the official sources show the data. Each update (usually monthly) replaces the previous one. Data read from websites is kept for at most 30 days.
• Your rights:
  • access, rectification and erasure, and the right to object (GDPR art. 21). Write to contact@adrianhomelab.com with the firm's CUI; we answer within a month at the latest (the legal deadline), usually within 2 working days;
  • if you object: a PFA/II/IF no longer appears in Leadgen at all (searches, lists, exports, the firm's record); as a representative you no longer appear in searches by person;
  • an objection to direct marketing is always honoured;
  • an error in the register is corrected at the source (ONRC or ANAF), and we pick it up at the next update;
  • you can complain to ANSPDCP (dataprotection.ro).

We take nothing from private directories or social networks, and no personal ID numbers (CNP).

Terms of the free tier and of the paid plans

The rules of the free tier and of the paid plans (the licence, prohibited uses, limits, warranty, liability, suspension, cancellation, withdrawal and refunds) are in one place, the Terms of use. This page informs you about your data and is not part of the contract.