Privacy policy

Locenti is operated by Burhan Javed (founder). Email: hello@locenti.com. We are the controller of the personal information described here. For anything about privacy, write to hello@locenti.com.

Locenti helps agencies and consultants find local businesses, research their public websites and send personal emails from their own Gmail account after reviewing and approving each message.

We collect only what the Service needs to work. We do not sell personal information, we do not use it for advertising, and we do not use Google user data to train AI models.

Account information: your name, email address and Google account identifier when you sign in with Google, or your email address and a securely hashed password if you sign up with email. We also keep the date of your last sign-in and records of active sessions so you can be signed out remotely.

Workspace content: the offer profile you write (service, value proposition, sender name, business address, booking link), leads you save, notes, research results, email drafts, campaigns, approval records, your do-not-contact list, and access tokens you create for AI agents (stored only as a hash).

Business information: when you search, we receive business listings from the Google Places API (Google Maps) or OpenStreetMap. Google Maps results are shown to you live and are not stored, except the Google place ID of businesses you save. When you research a lead, we read up to a few public pages of that business's own website (respecting its robots.txt) and keep short excerpts as sources, plus any business email address the website publicly shows.

Mailbox information: if you connect a Gmail account, see section 4.

Technical information: IP address and browser information in server logs, used for security, abuse prevention and rate limits; and the cookies described in section 7.

How you found us: if you sign up, we save which site or campaign link first brought you to Locenti (for example a Google search, LinkedIn, or a link with utm tags) and the page you landed on, so we can tell which channels work. Separately, we count first visits per source as anonymous daily totals, with no cookie, IP address or other identifier attached.

Locenti uses Google APIs only for the features you choose. Here is exactly what we request and why:

Sign in with Google (openid, email, profile): your Google account identifier, email address, name and profile picture URL, used only to create your account and sign you in.

Gmail sending (gmail.send), when you click Connect Gmail: lets the Service send emails from your Gmail address. It is used only to send emails you reviewed and approved in a campaign, or a test email to yourself. This permission cannot read your mailbox.

Reply tracking (gmail.readonly), only if you turn it on for a mailbox: used only to read the email conversations that the Service started, so it can show you replies, label them (for example interested or out of office), and stop emailing people who decline, unsubscribe or whose address bounces. We do not read, store or use any other email in your mailbox. Reply text is stored as plain text in your workspace so you can see it in the Inbox.

Storage and security: the long-lived Google access grant (refresh token) for a connected mailbox is encrypted (AES-256-GCM) before it is stored, and short-lived access tokens are kept only in server memory. Only you and members of your workspace can see your workspace's emails and replies.

Use: Google user data is used only to provide the features above that you can see in the Service. It is not used for advertising, not sold, not used to build user profiles for other purposes, not used to train or improve any AI or machine-learning model, and not sent to any AI service, including the optional built-in AI writer.

Sharing: we do not transfer Google user data to anyone except our hosting and database providers (section 6) as needed to run the Service, when you direct us to, for security purposes, or to comply with the law.

Human access: no person at Locenti reads your email content unless you ask us to for support, it is necessary for security or to investigate abuse, or it is required by law.

Limited Use: Locenti's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Your control: disconnect a mailbox at any time on the Mailboxes page. Disconnecting revokes the grant at Google and deletes the stored token. You can also remove access at https://myaccount.google.com/permissions.

To provide the Service: sign-in, searches, website research, finding public business emails, drafting emails, sending approved campaigns within your limits and sending hours, and showing replies.

To keep the Service safe: preventing abuse, enforcing usage limits, honouring opt-outs, and investigating security issues.

To communicate with you: account emails such as sign-up confirmation and password resets. We do not send marketing email without your consent.

Optional AI writing: if you use the built-in AI writer, the lead's research summary (facts found on the business's public website) and your offer profile are sent to Google's Gemini API to draft an email. No Gmail data is included. If you connect your own AI agent, the data your agent requests is shared with your agent's provider under your own agreement with them.

Service providers that process data for us to run the Service: Vercel (hosting), Neon (database), Google (sign-in, Gmail API, Google Maps Places API and, if enabled, the Gemini API), OpenStreetMap services (the search area and business type you enter), and our email delivery provider for account emails.

Business websites you research receive a normal web request from our server, identified as a bot.

We may disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition, in which case this policy continues to apply to it.

We do not sell or rent personal information.

We use only essential cookies: a signed session cookie to keep you signed in, a short-lived cookie that protects the Google sign-in and Gmail connection steps (and, when you sign up with Google, carries how you found us for that one step), and a cookie that remembers your active workspace. Your light or dark appearance choice is kept in your browser's local storage.

When you first open the site, your browser's session storage notes which site or campaign link brought you. It is cleared when you close the tab, is never shared, and is only sent to us if you sign up (see section 3).

We do not use advertising cookies or third-party tracking, and campaign emails contain no tracking pixels.

Email addresses of businesses come only from public sources: the business's own website or its public listing. We never guess addresses.

Every campaign email includes the sender's business address and an unsubscribe link. Anyone who unsubscribes, asks to stop, or whose address bounces is added to the sender's do-not-contact list and is not emailed again from that workspace. Recipients can also contact us at hello@locenti.com to object to processing.

Account and workspace data: while your account is active. When you ask us to delete your account, we delete it, including workspace content and stored tokens, within 30 days, except where we must keep limited records by law.

Mailbox access: deleted immediately when you disconnect a mailbox.

Google Maps content: not stored, except place IDs of saved businesses, which Google allows.

Do-not-contact entries: kept so opt-outs keep being honoured, even after the related lead is deleted.

Server logs: kept by our hosting provider for a limited period for security and troubleshooting.

We use encrypted connections (HTTPS), encryption of stored mailbox tokens, hashed passwords and access tokens, row-level access controls so each workspace only sees its own data, and least-privilege access permissions. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you as required by law.

You can access, correct, export or delete your information, and object to or restrict certain processing. Many changes can be made in the app; for anything else write to hello@locenti.com. We respond within 30 days.

If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of our contract with you (providing the Service), legitimate interests (security, preventing abuse, and enabling business-to-business outreach with opt-outs), consent (where we ask for it, such as connecting Gmail), and legal obligations. You may complain to your local data protection authority.

If you are a California resident, you have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

Locenti is a business tool and is not intended for anyone under 16. We do not knowingly collect information from children.

Our providers may process information in countries other than yours. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

We will update this page when our practices change and change the date at the top. If changes are significant, we will tell you in the app or by email before they take effect.

Questions or requests about privacy: Burhan Javed (founder). Email: hello@locenti.com.