We, at lemonreach, are dedicated to serving our customers and contacts to the best of our abilities. Part of our commitment involves the responsible management of personal information collected through our website lemonreach.com, and any related interactions.

Our primary goals in processing personal information include:

• Enhancing the user experience on our platform by understanding customer needs and preferences
• Providing timely support and responding to inquiries or service requests
• Improving our products and services to meet the evolving demands of our users
• Conducting necessary business operations, such as billing and account management

We process personal information in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection law, and we protect the data we handle against unauthorised access, disclosure, alteration, and destruction.

lemonreach is operated by lemonreach AB, a Swedish limited company (aktiebolag) with company registration number 559583-3822, with its registered address at Industrigatan 4A, 212 14 Malmö, Sweden. We do not have a designated Data Protection Officer (DPO) but remain fully committed to addressing your privacy concerns. For questions, contact us at [email protected].

This privacy policy applies to everyone whose personal data lemonreach processes as a data controller, including website visitors, registered users, customers, and the business contacts we reach out to about our own products.

For the data you handle through the Service, lemonreach acts as a data processor on behalf of our customer. This covers all prospect, contact, and campaign data, the content of your outreach and the replies to it, and the data handled through a LinkedIn account or other integration you connect. In that capacity, our customer is the data controller and is responsible for ensuring that its use of such data complies with applicable law, and our Data Processing Agreement applies.

lemonreach acts as a data controller only for the limited personal data we need to run our own business: account registration and sign-in, billing, customer support, our own direct marketing and sales outreach, visitors to our website, and how our platform is used (Sections 3.1, 3.2, 3.4, and 3.6). This distinction is explained further in Section 3.

3.1 Account Information

When you create an account, we collect:

• First name and last name
• Email address
• Your role in your team
• Company information (where provided), including your company profile and email signature

If you sign in with Google, we receive your email address and a Google account identifier from Google to sign you in and secure your account.

For security, we also record when you sign in and when you were last active, and the browser and operating system of each session.

If your team requires review before launch, we keep a record each time a user confirms that a campaign has been reviewed: the user's name and email address at the time, the campaign, the confirmation text shown, and the date and time. These records are kept as evidence of the confirmation for as long as your team's account exists, also after the user is removed from the team.

3.2 Payment Information

When you subscribe or purchase credits, we collect payment-related data through our payment processor, including:

• Payment method details (e.g. credit card information, processed and stored by our payment provider)
• Billing details, such as company name, billing email address, billing address, country, and VAT number
• Payment method and billing history
• Purchase history (subscriptions, top-ups, plan changes)

3.3 Prospect & Contact Data (as Data Processor)

When you use lemonreach's prospecting or enrichment features, our platform retrieves and processes business contact information on your behalf. This may include:

• Names, business email addresses, business phone numbers, and job titles of individuals you search for, import, or enrich
• Company names and other professional information associated with those individuals
• Professional profile data, including LinkedIn and Sales Navigator profile data viewed or saved through your connected LinkedIn account (Section 3.5)
• The content of outreach emails, LinkedIn invitations, and LinkedIn messages sent in your campaigns, and the replies to them
• Signals for your monitors, such as the web technologies a company's website uses, which we detect by checking the website ourselves; company posts and job listings, which we collect through your connected LinkedIn account (Section 3.5); company news from Google News; and website visit data from a Snitcher account you connect, which can include the approximate location and device of a visit and contact details submitted in forms on your website (Section 6.4)
• Whether outreach emails are opened and links in them are clicked, together with the recipient's IP address, approximate country, browser, and referring page at that moment
• Leads your CRM sends to lemonreach, and people that prospects refer you to in their replies, which we identify with AI so you can enrich and contact them

This data is processed solely on your instructions and for the purpose of providing the Service. You are the data controller in respect of this data, and you are responsible for ensuring you have a lawful basis for processing it. We do not use this data for our own purposes or share it beyond what is necessary to provide the Service.

3.4 Technical and Usage Data

When you use our website and application, we automatically collect:

• IP address
• Browser information and language
• Device identifiers
• Interaction logs (e.g. clicks, pages visited, features used)

In the lemonreach app, we use PostHog for product analytics, session recordings, and error tracking, but only if you accept analytics cookies. Session recordings can show what is displayed on your screen, including prospect data, and are kept for 30 days. We also load a support chat and help center from Featurebase, which receives your name and email address so we can answer your questions.

On our marketing website, we also use Snitcher to identify the company (not the individual) associated with a visitor's IP address, for sales lead qualification. We attach that company name to the visitor's Mouseflow session recording, so we can review sessions in the context of which organization was visiting. This only runs if you accept the relevant cookie category in our cookie banner. See our Cookie Policy for details.

We use Cloudflare Turnstile to check demo requests for automated abuse. This verification runs when you submit the form and may process browser and connection information. Cloudflare's Turnstile Privacy Addendum explains how Cloudflare handles that information.

Demo requests

When you request a demo on our website, we collect your first and last name, work email address, job title, what you would like to discuss, and the page and plan you came from. We store this in our CRM (Attio) to follow up on your request, relying on our legitimate interest in responding to it (Article 6(1)(f) GDPR).

Website language selection

Our website delivery provider, Cloudflare, derives an approximate country from the IP address used to connect to our website. Our language-routing feature uses only the country code during the request to offer Swedish to visitors connecting from Sweden and English otherwise, including when the country is unknown. An explicit language choice takes priority, and links directly to Swedish pages remain accessible from any country.

The language-routing feature does not read, record, or store your IP address, retain the country code, or send it to a separate geolocation service. It does not use the country for advertising or analytics. Cloudflare and our hosting infrastructure still process connection data to deliver and protect the website; this is separate from language selection and does not mean that all infrastructure logs are immediately deleted.

We rely on our legitimate interest in presenting our website in a relevant language (Article 6(1)(f) GDPR) for this limited country-based selection. You can override it using the language selector or contact us to object to this processing. When you select a language, a first-party session cookie stores only your choice, en or sv, so we can honour it during your visit. See our Cookie Policy for details.

3.5 Browser Extension and LinkedIn Session (as Data Processor)

We offer an optional browser extension that lets you run enrichment and outreach tasks from within your own LinkedIn account, rather than through a shared or third-party account. The extension only connects your LinkedIn account to lemonreach after you agree to it on a consent screen in the extension that shows which LinkedIn account will be connected. Your LinkedIn session cookies stay in your browser and are not stored on our servers.

Everything described in this section is processed on behalf of our customer, as data processor under our Data Processing Agreement. Each action taken through your LinkedIn account is taken on your instruction, and you remain responsible for that activity.

When you agree, we collect and store:

• A connection record: when the account was connected, and a one-way hash of its LinkedIn session cookie, which lets us check that the extension is still signed in to the same LinkedIn account. The cookie cannot be recovered from the hash
• Your LinkedIn profile basics: the name, headline, profile picture, and LinkedIn member identifier of the connected account, and whether it has LinkedIn Premium
• Connection details: the extension version and when it last checked in with lemonreach
• A consent record: the version of the consent you agreed to, when you agreed, the LinkedIn account it covers, when we received it, and the extension version, kept as a record of the instruction you gave us

We use the connected LinkedIn account only to:

• View the LinkedIn profiles, recent posts, skills, and work history of prospects you research or enrich, and the pages, posts, and job listings of companies you research, enrich, or monitor
• Send the connection invitations and messages in your campaigns
• Read replies from your prospects. Only messages from prospects in your lemonreach account are copied to lemonreach. Your other LinkedIn conversations are not. Copied replies are classified with AI and, if you connect a CRM, synced to it
• Check whether people you invited through your campaigns have accepted. The extension reads your recent connections for this, but only reports the people your campaigns invited

When LinkedIn enrichment runs, the recent posts of the prospect and of their company are read to create a short summary of work-related signals. Only that summary and the professional profile details (such as headline, about, experience, and skills) are stored. The text of the posts read during enrichment is not stored on our servers. Company posts collected for your monitors are stored as monitor signals.

When you use the extension to save prospects from a LinkedIn or Sales Navigator page you are viewing, the profile details shown on that page are sent to lemonreach and handled as prospect data under Section 3.3.

Data passed between the extension and lemonreach is transmitted over encrypted connections, scoped strictly to your individual account, never shared with or accessible to other users, and never used on behalf of anyone but you.

Retention and deletion. We keep the connection record for as long as LinkedIn is connected to your lemonreach account. It is deleted from our servers, together with the name, headline, and profile picture of the connected account, when you:

• Click Disconnect for LinkedIn in lemonreach settings or in the extension,
• Sign out of the lemonreach extension, or
• Uninstall the extension. Chrome tells us when the extension is removed, and we delete the connection that installation made

They are also deleted automatically if the extension has not checked in with lemonreach for 14 days, for example because it was removed in a way Chrome did not report or the browser is no longer used. Signing out of LinkedIn ends the session on LinkedIn's side, and the extension can no longer act through the account until you sign in again. The LinkedIn member identifier, the connection details above, consent records, and copied replies are kept for the life of your account and deleted with it, as described in Section 5.3.

You remain responsible for ensuring that your use of the extension is consistent with LinkedIn's terms and any applicable law.

3.6 Business Contacts We Reach Out To (as Data Controller)

We contact businesses that may be interested in lemonreach. For this purpose, we process the name, job title, employer, business email address, business phone number, and professional profile information of contacts at those businesses, together with a record of our communications with them. We obtain this data from public professional sources such as company websites and professional networks, from business contact data providers, and from company-level website visit data (Section 3.4).

We rely on our legitimate interest in promoting our products to businesses (Article 6(1)(f) GDPR). We contact only business addresses, include a way to opt out in every message, and stop contacting you, and keep only the minimum needed to respect your choice on a suppression list, if you object. We delete contact data that has not led to a business relationship within 12 months of our last interaction with you.

We use the personal information we collect as data controller for the following purposes, on the following legal bases under Article 6(1) GDPR:

• Providing your account and the Service: account registration and sign-in, delivering the features you use, and transactional emails (e.g. password resets, billing confirmations). Legal basis: performance of our contract with you (Article 6(1)(b)), or, where you use the Service on behalf of an organisation, our legitimate interest in performing our contract with that organisation (Article 6(1)(f))
• Payments and bookkeeping: managing subscriptions, processing payments, and keeping accounting records. Legal basis: performance of contract (Article 6(1)(b)) and compliance with Swedish accounting and tax law (Article 6(1)(c))
• Authentication and security: verifying your identity, securing your account and our website, and preventing fraud and abuse. Legal basis: our legitimate interest in keeping the Service secure (Article 6(1)(f))
• Customer support: responding to your enquiries and resolving issues. Legal basis: performance of contract (Article 6(1)(b)), or our legitimate interest in answering enquiries (Article 6(1)(f))
• Analytics and product improvement: understanding how our platform is used so we can improve it. Legal basis: our legitimate interest in developing our products (Article 6(1)(f)). On our marketing website and in the lemonreach app, analytics, session recording, and visitor identification tools that use cookies or similar technologies run only with your consent (Article 6(1)(a)), as described in our Cookie Policy
• Advertising measurement: measuring whether a click on one of our ads on Google or in ChatGPT led to a demo request or sign-up on our marketing website. Legal basis: your consent through our cookie banner (Article 6(1)(a)), which you can withdraw at any time, as described in our Cookie Policy
• Direct marketing and sales outreach: telling customers and business contacts about our products (Sections 3.6 and 11). Legal basis: our legitimate interest in promoting our products to businesses (Article 6(1)(f)), or your consent where the law requires it (Article 6(1)(a))
• Legal compliance and claims: meeting our legal obligations and establishing, exercising, or defending legal claims. Legal basis: legal obligation (Article 6(1)(c)) and our legitimate interest in protecting our rights (Article 6(1)(f))

Where we rely on legitimate interest, we have weighed our interest against your rights and freedoms, and you can object at any time (Section 8). Providing account and billing information is necessary to enter into and perform our contract; without it, we cannot provide the Service. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Prospect, contact, and campaign data, including data handled through your connected LinkedIn account, is used solely to deliver the Service to you on your instructions. We do not use this data for our own marketing, analytics, or any other internal purpose.

5.1 Data Storage Locations

Your personal information is stored on secure servers, primarily within the European Union:

• European Union: our primary infrastructure, including storage of account, usage, and prospect data, is hosted on secure cloud servers within the EU (AWS Frankfurt region), and AI processing runs in AWS regions within the EU
• Outside the EU: a limited number of service providers are located in the United Kingdom, Switzerland, Canada, and the United States, or operate a global network, as listed in Section 6.1. These transfers are protected by the safeguards described in Section 7

5.2 Data Protection Measures

We implement the following security measures to protect your data:

• Encryption: all data is encrypted in transit (TLS/HTTPS) and at rest
• Access control: access to personal information is strictly limited to authorised personnel with a legitimate business need. We enforce strict access controls and regularly review permissions
• Secure authentication: user authentication is managed with industry-standard security practices

5.3 Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy:

• Account data: for the duration of your account and for up to 90 days after closure, after which it is deleted
• LinkedIn connection record: for as long as LinkedIn is connected, and deleted when you disconnect LinkedIn, sign out of the extension or uninstall it, or after 14 days without the extension checking in (see Section 3.5)
• Billing and transaction records: for as long as required by Swedish accounting law (currently seven years)
• Prospect and contact data processed on your behalf: only for as long as needed to provide the Service, and deleted or returned on termination in accordance with our Data Processing Agreement
• Campaigns: campaigns are deleted automatically once they are older than the campaign storage period of your plan, counted from the date the campaign was created. The storage period is currently 6 months on the Starter plan and the free plan, and 12 months on the Growth and Scale plans, as shown on our pricing page. A campaign is deleted together with its prospects, the outreach content generated for it, and its activity, including replies. Campaigns that continuously receive new prospects from a monitor are not deleted on this basis, and contacts saved in your contact list are not affected
• Usage and analytics data: for up to 12 months, after which it is deleted or aggregated. Session recordings are deleted after 30 days
• Email open and click data: for 180 days
• LinkedIn member identifier, connection details, consent records, and copied replies: for the life of your account (see Section 3.5)
• Review confirmation records: for as long as your team's account exists, also after the user who confirmed is removed (see Section 3.1)
• Customer support data: for the duration of your account and for up to 90 days after closure, unless needed longer to handle a claim
• Business contacts we reach out to: as described in Section 3.6, and opt-out records for as long as needed to respect your choice

We may share your information with third-party service providers who perform services on our behalf. These parties have access to personal information on a need-to-know basis and are contractually obliged to keep your information confidential.

6.1 Third-Party Service Providers

6.2 Data Processing Agreements

When we share your data with third-party service providers, we do so under the protection of Data Processing Agreements (DPAs) that ensure your information is managed in accordance with GDPR and other relevant data protection laws.

Where we process prospect or contact data on your behalf, our own Data Processing Agreement governs that relationship. If we add or replace a sub-processor that handles data we process on your behalf, we will give you prior notice and an opportunity to object on reasonable data protection grounds, as set out in that agreement.

6.3 Transparency and Control

You will always be informed about significant changes to our data sharing practices. Your trust is important to us, and we ensure that your personal information is disclosed only in accordance with this policy and when there is a justified reason to do so.

6.4 Integrations You Connect

The Service lets you connect third-party tools that you control and authorise. When you connect one, you direct us to share the relevant data with that tool, and to receive data back from it, so we can provide the feature you enabled. These providers act on your behalf under your own agreement with them, and you remain responsible for your use of them, including any transfer of data outside the EEA they carry out:

• Email (Google, Microsoft): when you connect your mailbox, outreach is sent from your own email account and replies are read back into the Service. We store your mailbox access credentials in encrypted form.
• LinkedIn (browser extension): when you connect your LinkedIn account, invitations and messages in your campaigns are sent from your own account and replies from those prospects are read back into the Service, as described in Section 3.5. Your use of your LinkedIn account is governed by your own agreement with LinkedIn.
• CRM (HubSpot, Attio, Salesforce): when you connect your CRM, prospect and activity data, including reply content, syncs between lemonreach and your CRM according to the settings you choose. If you set up a webhook, your CRM can also send new leads to lemonreach.
• Contact data (Cognism): where enabled for your team, you can use your own Cognism account for prospect search and enrichment. We send the search criteria and the details of the prospects you enrich, such as name, job title, company, and LinkedIn URL, to Cognism using your account.
• Calling (Aircall): when you connect Aircall, prospect phone numbers are passed to Aircall to place calls, and call details, which may include recordings where your Aircall account records calls, are handled by Aircall.
• Website visitors (Snitcher): when you connect your Snitcher account, the companies it identifies on your website, together with the pages they visited and when, the approximate location and device of the visit, and contact details submitted in forms on your website, are passed to lemonreach and stored with your monitor so you can run campaigns on them.
• AI agents (MCP): when you connect an AI agent or tool through MCP, the data it requests from your lemonreach account is passed to that agent or tool.

Because these tools are configured and controlled by you, they are not lemonreach sub-processors. We recommend reviewing each provider's own privacy terms before connecting it.

6.5 Other Disclosures

We may also disclose personal data where required by law, a court order, or a public authority; where necessary to establish, exercise, or defend legal claims; and to a buyer or successor in connection with a merger, acquisition, or sale of all or part of our business, subject to the same protections as described in this policy. We do not sell personal data.

Our primary infrastructure is hosted within the European Union. Some of our service providers are located outside the EEA, as shown in the table in Section 6.1. Any transfer of personal data outside the EEA is made under an appropriate safeguard:

• Adequacy decisions: for providers in the United Kingdom, Switzerland, and Canada (for recipients subject to PIPEDA), and for providers in the United States that are certified under the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decisions, which recognise that those countries or frameworks provide an essentially equivalent level of data protection
• Standard Contractual Clauses: for other transfers to the United States or other countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs), together with supplementary measures where needed, and, where UK or Swiss data protection law applies, the UK International Data Transfer Addendum or the adaptations required under Swiss law

Prospect and contact data that we process on your behalf is hosted in the EU and, where enrichment requires a specialist provider, is only sent to countries covered by an adequacy decision (currently Canada). lemonreach does not itself transfer it to jurisdictions without that recognition. Data you send to a tool or account you connect yourself, such as your CRM or LinkedIn account, is transferred on your instruction and governed by your agreement with that provider (Section 6.4).

Under GDPR and other applicable data protection laws, you have the following rights regarding your personal information:

• Right of access (Art. 15 GDPR): request access to the personal information we hold about you
• Right to rectification (Art. 16 GDPR): request correction of inaccurate or incomplete personal information
• Right to erasure (Art. 17 GDPR): request deletion of your personal information when it is no longer necessary
• Right to restriction of processing (Art. 18 GDPR): request that we restrict processing under certain conditions
• Right to data portability (Art. 20 GDPR): receive your personal information in a structured, machine-readable format
• Right to object (Art. 21 GDPR): object to processing, including for direct marketing purposes
• Right to withdraw consent (Art. 7(3) GDPR): withdraw consent at any time where processing is based on consent
• Right to lodge a complaint (Art. 77 GDPR): lodge a complaint with a supervisory authority if you believe our processing violates data protection laws

To exercise any of these rights, please contact us at [email protected]. We will respond within one month, which may be extended by two further months for complex requests, as allowed by the GDPR. In some cases, we may need to verify your identity before processing your request.

The supervisory authority in Sweden is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se. You can also complain to the supervisory authority in the EU country where you live or work.

If you were contacted by one of our customers: when a lemonreach customer contacts you through the Service, that customer is the data controller of your data and lemonreach acts only as its processor (Section 2). Please send your request to that customer. If you contact us instead, we will pass your request on to the customer concerned and assist it in responding, as set out in our Data Processing Agreement.

We use cookies and similar tracking technologies on our website to ensure functionality and improve your experience. For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

Upon your first visit, our website will present you with a cookie consent banner where you can accept all cookies, reject non-essential cookies, or customise your preferences.

Our services are not intended for children under the age of 18. We do not knowingly collect personal information from children. If you are under the age of 18, please do not use our services or provide any personal information to us.

If we become aware that we have inadvertently collected personal information from a child under the age of 18, we will take prompt steps to delete such information. If you believe we may have collected information from a child, please contact us immediately at [email protected].

We may use your personal information to send you direct marketing communications about our products, services, and promotions. We are committed to transparent and lawful marketing practices in compliance with GDPR and the ePrivacy Directive.

• Opt-in consent: we will obtain your consent before sending marketing communications, where required by law
• Unsubscribe option: every marketing communication will include clear instructions on how to opt out. You can exercise your right to unsubscribe at any time

In the event of a personal data breach that poses a risk to privacy rights and freedoms, we have established procedures for promptly identifying, assessing, and mitigating the impact.

• Internal monitoring: we employ security measures and monitoring systems to detect and respond to potential breaches promptly
• Data we control: where we act as data controller (for example account and billing data), we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to your rights and freedoms. We will notify affected individuals without undue delay where the risk is high
• Data we process on your behalf: where we act as data processor (for example prospect and contact data, or data handled through a connected LinkedIn account), we will notify you, as the data controller, without undue delay and within 48 hours after becoming aware of a breach, so that you can meet your own notification obligations. This is set out in our Data Processing Agreement

If you have any concerns about a potential data breach, please contact us immediately at [email protected].

We may update this privacy policy from time to time to reflect changes in legal requirements, industry standards, or our business operations. When we make significant changes that may affect your rights, we will notify you by email or through a prominent notice on our website.

We encourage you to review this policy periodically. The date at the top of this page shows when it was last updated.

If you have any questions or concerns about this privacy policy, please contact us: