Privacy Policy

Last updated: 23 October 2026

LeadTrapper (“we”, “us”, “our”) makes the LeadTrapper desktop application for Windows (downloaded from this website or the Microsoft Store), the LeadTrapper browser extensions, the LeadTrapper store apps for Shopify and Wix and the LeadTrapper extension for Zoho CRM, and operates useleadtrapper.com. This policy sets out exactly what information reaches us, what never does, and why.

1. The Short Version

LeadTrapper does its work on your own computer. The searches you run, the leads you collect, the messages you write, and your WhatsApp and social media sessions stay on your device. They are never sent to us.

What does reach us is limited to what is needed to sell you a licence, keep that licence working, keep the software working, and understand how our website is used. All of it is listed below.

2. What the Desktop Application Sends Us

  • When it checks your licence: your licence key, your app version, and a device fingerprint. The fingerprint is made of one-way codes derived from your computer’s hardware and Windows installation: they identify the device, but cannot be turned back into the original serial numbers. Our server also records the approximate country the check came from and, for licensed copies, the IP address. If you registered when you started your free trial, the check also carries the email address (and name, if you gave one) you registered with, and for a trial copy we keep a one-way code of the network address it first connected from, not the address itself. We use this to confirm your licence, tie it to your device, find your trial or licence when you write to us, stop trial resets, and detect one key being shared across many computers.
  • About once an hour: the same device fingerprint, your app version, and the name and status of each lead source (for example, “Instagram: working”), with a short status message. This tells us when a lead source stops working, so we can fix it before you have to report it.
  • Only if an automatic update fails: your app version, the update step that failed, and the error message, so we can fix the problem.
  • When it checks for updates and announcements: only your app version, which is included with the request.
  • Only if you use the AI agent or AI auto-replies: your requests, and for auto-replies the incoming message being answered together with your knowledge-base text, go directly from your computer to the AI provider whose API key you enter (Anthropic, OpenAI or Google), under that provider’s terms. They do not pass through our servers, and your API key stays on your computer.
  • Only if you use Store Orders: your connection code, to collect your store’s order messages from our relay (see section 3a). The messages are then sent from your own WhatsApp account on your computer. Replies of STOP are detected on your computer and added to your do-not-message list there.

The desktop application never sends us the searches you run, the leads and contact details you collect, your message templates or message content, your WhatsApp session, or your social media logins. When you run a search, LeadTrapper connects to the platform concerned (such as Google Maps, Instagram, Facebook, TikTok or LinkedIn) directly from your computer. Those requests do not pass through our servers. If you click “Check emails” in the Website Contact Finder, the app asks Cloudflare’s public DNS service (1.1.1.1) whether each email’s domain (for example acme.com) has a mail server; only the domain names are sent, never the email addresses or anything else from your list.

3. Browser Extensions, WordPress Plugin, and Google Sheets Add-on

LeadTrapper browser extensions run entirely inside your browser. Information they extract from pages you choose to process is stored in your browser’s local storage, on your device, and leaves it only when you export it yourself. The extensions do not send extracted data, contacts, messages or browsing history to us or to anyone else, and they make no requests to our servers. Links to useleadtrapper.com inside an extension open only when you click them.

The Click-to-Chat Link & QR Generator extension builds wa.me links and QR codes from the phone number and message you type into its popup, on your own device. It keeps the last number and message, the message templates you save, your country code and your right-click message in your browser’s local extension storage, reads no web pages, and makes no requests to our servers or anyone else’s. Its right-click items (“Chat on WhatsApp” and “Make a chat QR code”) receive only the text you selected or the phone link you right-clicked, and only when you click them.

The Contact Finder extension reads a website when you click its icon, and only the website in the tab you are looking at. It finds the email addresses, phone numbers, WhatsApp numbers, postal addresses, social profile links and contact-form page published on that page, and opens a few pages of the same website that usually hold contact details (such as its Contact, Team or Branches pages) to read them the same way. On its full-page list you can also ask it to read a list of websites you type or paste, or the websites open in your tabs; Chrome asks for your permission the first time. Those requests go only to the websites you chose, never to our servers. It does not run on search engines, social networks, WhatsApp or review sites. If you click “Check emails”, it asks Cloudflare’s public DNS service (1.1.1.1) whether each email’s domain (for example acme.com) has a mail server; only the domain names are sent, never the email addresses or anything else from your list. The contacts you keep, their status and your optional WhatsApp message are stored in your browser’s local extension storage until you clear them, and the Excel, CSV or contacts file you download is built on your own computer. Links to useleadtrapper.com in the extension and in the “About” tab of the Excel file open only when you click them.

The Group Contacts Extractor & Exporter for WhatsApp Web extension runs only on web.whatsapp.com. When you click Export, it reads the group list and the member names and phone numbers that WhatsApp Web has already loaded in your browser (or, if you choose the Chats or Saved contacts tab, the names and numbers of the people you have one-to-one chats with or have saved as contacts), and builds the file you asked for on your own computer. It makes no requests to our servers or anyone else’s, and it sends no names, numbers or messages anywhere. It keeps one small counter in your browser’s local extension storage: the date and how many of the 50 free daily exports you have used. When you reach the daily limit, a button offers our free trial, and that link opens only when you click it.

The WhatsApp & Call Button WordPress plugin runs entirely on your own WordPress site. It builds tel: and wa.me links from the phone number(s) you enter in its settings, stores those settings in your own WordPress database, and makes no requests to our servers or anyone else’s.

The WhatsApp Toolkit Google Sheets add-on only reads and writes the single spreadsheet you are actively using, through Google’s restricted spreadsheets.currentonly permission — it cannot see or access any other file in your Google Drive. It builds wa.me links and validates phone numbers using logic that runs inside Google’s own servers on your behalf; we never receive your spreadsheet data, and the add-on makes no requests to our servers.

3b. AI Assistant Connectors (MCP)

Our two connectors for AI assistants such as Claude and ChatGPT run on our website’s servers (Cloudflare), at https://useleadtrapper.com/mcp and https://useleadtrapper.com/mcp/contacts. Your assistant sends them only what it asks the tool to process. How to add them and what each tool does.

  • WhatsApp Tools (/mcp) turns the phone numbers and message it receives into wa.me links or a cleaned number list and sends the result back. The numbers and messages are not stored or logged.
  • Contact Finder (/mcp/contacts) receives one website address, reads that website’s home page and up to three of its own contact, branch, team or about pages, and returns the contact details the website publishes. It follows the website’s robots.txt, does not read search engines, maps, social networks, WhatsApp or review sites, and identifies itself to the website as “LeadTrapperContactFinder”. The website address and the contacts found are not stored. To apply the free limit of 10 websites a day, we keep a counter keyed to your IP address for up to two days.

For both connectors we count how many times each tool is used per day (totals only, kept up to 400 days). Results name LeadTrapper as their source.

3a. Store Apps for Shopify and Wix

The buttons. The WhatsApp chat button, call button and “Order via WhatsApp” button run on the store’s own pages. A click only opens WhatsApp or the phone dialler with a prepared message. On Shopify, the buttons set no cookies, track no visitors and make no requests to our servers; their settings are stored in the merchant’s own Shopify theme. On Wix, the settings are stored in the merchant’s own Wix site data, and the app counts button clicks there by type of button, page and product name only, with nothing that identifies the visitor. The Wix app also keeps a list of the store’s orders (customer name, phone number, email and order number) in the merchant’s own Wix site data, where only the merchant can see, download or delete it.

Automatic order messages (optional, off until the merchant turns it on). When a merchant turns on automatic order messages, for each order the app sends the customer’s name, phone number, order number, order total, country and, for shipped orders, the carrier and tracking link, to our relay on Cloudflare. The relay holds them only until the merchant’s own LeadTrapper desktop app collects them, and for 7 days at most; a shipped message without tracking may wait up to 15 minutes for the tracking number before it is released. The messages are then sent from the merchant’s own WhatsApp account. We do not use this data for anything else, and we never sell or share it. Customers can reply STOP to any message to stop receiving them.

Deletion. Everything held for a store is deleted when the merchant turns automatic order messages off, when the app is uninstalled, and when Shopify sends us a privacy request to delete a customer’s or a shop’s data. Email addresses and street addresses are never stored by the relay.

Connecting WhatsApp from the store dashboard. If the merchant links their WhatsApp account by scanning a QR code in the store app, the QR image is passed from their LeadTrapper desktop app through our relay to their dashboard. It is shown for at most 60 seconds and removed once the connection finishes, or within a day at the latest.

3c. Zoho CRM Extension

The LeadTrapper for Zoho CRM extension runs inside your Zoho CRM account, on the Lead or Contact record you open.

  • Find contacts: when you click it, the extension sends us only the website address shown in the box. Our server (Cloudflare) reads that website in the same way as the Contact Finder connector in section 3b and sends back the contact details the website publishes, with a simple lead score. The website address and the contacts found are not stored. To apply the free limit of 50 websites a day, we keep a counter keyed to your IP address for up to two days.
  • Saving to Zoho: the extension fills only empty fields on that record (email, phone, mobile, website) and adds a note with what was found. This uses your own Zoho permissions, and the data stays in your Zoho account. We never receive your Zoho records, your login or your access token.
  • WhatsApp: the WhatsApp button opens a wa.me link with your message on your own device, and adds a note and an optional follow-up task to the record in Zoho. Your message template is saved in your browser only. Nothing about the chat is sent to us.

4. What Our Website Collects

  • Download sign-up. If you enter your email address (and optionally your name) to download LeadTrapper, we store it with the date, how many times you have downloaded, your approximate country, and a short record of how you reached the download: the website or search engine that first sent you to us (for example Google or an AI assistant), the first page you saw, and the pages you visited before signing up with the time spent on each. That record is kept in your own browser’s local storage until you sign up, is sent only together with your sign-up, and is never sent if you do not sign up. We use all of this only to contact you about LeadTrapper and to understand which pages help people, and we never share it. You can ask us to delete it at any time.

  • Trial registration. When you start the free trial, the app asks for your email address and, optionally, your name. We add it to the same list as the download sign-ups and link it to your device fingerprint (see section 2). We use it to contact you about LeadTrapper, to find your trial or licence when you write to us, and to notice when one person starts several trials. We never share it, and you can ask us to delete it at any time.

  • Contact form. When you send us a message, we store your name, email address, topic and message, together with your approximate location (country and city), your browser’s user-agent string and the page you came from, and we email a copy to our inbox. We use this to reply to you and to filter abuse.

  • Purchases. When you buy a licence, our payment provider collects your payment details and sends us your name, email address and order details. We never see or store your card number.

  • Download counts. Each download of the installer is counted by day, approximate country, the download button used and the website that referred you. Visits that arrive from a link inside one of our browser extensions are counted the same way. These are totals only; nothing that identifies you is stored with them.

  • Website analytics. We measure how our website is used with three services, all run through Cloudflare’s Zaraz tool manager:

    • Cloudflare Web Analytics records page views, the website that referred you, and your approximate country and device type. It sets no cookies.
    • Google Analytics 4. Each time you load a page, Cloudflare passes Google the page address and title, the website that referred you, your browser and screen details, and your IP address, which Google uses to work out your approximate location. Google Analytics gives us reports about this, such as which pages are read and from which countries. We use it to improve the website; the reports do not tell us who you are.
    • Microsoft Clarity records how pages are used: your mouse movements, clicks, taps and scrolling, the size of your screen, and your IP address, which Microsoft uses to work out your approximate location. We use it to see replays of visits and heatmaps of where people click, so we can find confusing parts of the website. Text you type into forms is hidden from these recordings. Microsoft processes this under the Microsoft Privacy Statement.

  • Google advertising audiences. In our Google Analytics setup we have switched on Google’s audience collection. It makes your browser contact Google’s advertising servers (doubleclick.net and google.com) directly, so Google receives your IP address and browser details straight from your device and can use the visit to build audiences for advertising on Google’s services. This applies only to visitors to our website. The desktop application and the browser extensions never do this.

  • Cookies. Our website sets five cookies on useleadtrapper.com, all random identifiers: cf_zaraz_client (lasts up to one year), which Cloudflare’s tool manager uses to recognise a returning browser; cfz_google-analytics_v4 (up to one year), the Google Analytics visitor identifier; and cfzs_google-analytics_v4, the Google Analytics session identifier, which ends when you close your browser; _clck (up to one year), the Microsoft Clarity visitor identifier; and _clsk (one day), which links the pages you view in one Clarity session. Microsoft Clarity may also set its own cookies on clarity.ms. None of them holds your name, email address or anything you type into a form. We do not currently show a cookie banner. You can block or delete these cookies in your browser settings, or ask us to help by writing to hello@useleadtrapper.com.

  • YouTube videos. Some pages show a LeadTrapper video. Until you press play, the page shows only a picture stored on our own website, and nothing is loaded from YouTube. When you press play, the video loads from YouTube’s privacy-enhanced mode (youtube-nocookie.com). From then on Google, which runs YouTube, receives your IP address and browser details and may store information in your browser to play the video and count the view, under Google’s privacy policy. If you prefer, use the “Watch on YouTube” link instead.

Like any website, our hosting provider processes your IP address to deliver pages and to protect the site from attacks.

5. How We Use Information

  • To provide, license and update LeadTrapper.
  • To prevent licence abuse, such as trial resets and shared keys, and fraud.
  • To find and fix broken lead sources and failed updates.
  • To reply to your messages and support requests.
  • To process purchases and send receipts.
  • To send important product and security notices.

6. What We Never Do

  • We do not sell your personal data.
  • We do not use anything you collect or write in the desktop application for advertising. Website visit data is shared with Google as described in section 4.
  • We do not collect the searches, leads, contacts or messages you work with in LeadTrapper.

7. Service Providers

We use a small number of providers to operate LeadTrapper, and each receives only what it needs:

  • Cloudflare hosts our website and licence server, stores the information described above, runs Cloudflare Web Analytics and the Zaraz tool manager, and forwards email sent to hello@useleadtrapper.com, and contact form messages, to our inbox.
  • Microsoft provides Microsoft Clarity and receives the website visit data described in section 4.
  • Google provides Google Analytics and, through the audience setting described in section 4, receives website visit data. Our mailbox is a Google (Gmail) account, so messages you email or send through the contact form are stored there. Google’s own privacy policy applies to what it receives.
  • Resend delivers the emails we send from useleadtrapper.com, such as the welcome email after you sign up to download. It receives your email address, your first name if you gave one, and the email itself. If you install the app and then stop using it during your trial, we may send one email with tips for getting started, and one email a few days before your trial ends. Our emails contain a tiny image that tells us the first time the email is opened, so we can see whether the install help reached you; if your email app blocks images, nothing is recorded. Links in these emails carry a short code, so when you click one we can see which email it came from and which pages of useleadtrapper.com you then visit and for how long, in that browser, for up to 90 days. This helps us see whether our emails are useful. Visitors who did not arrive from one of our emails are not tracked this way.
  • GitHub hosts the installer and update files. When you download or update LeadTrapper, your computer connects to GitHub directly.
  • Our payment provider processes purchases.
  • Porkbun is the registrar of our domain name.

8. How Long We Keep It

  • Licence and installation records, including device fingerprints, the email address and name you registered with, app versions, approximate countries and, for licences, the IP addresses they have been used from: for as long as the licence or installation exists, and afterwards only as long as needed for renewals, refunds, fraud prevention and legal obligations.
  • Lead source status reports: deleted automatically after 14 days.
  • Store order messages in our relay: deleted as soon as the merchant’s LeadTrapper collects them, and after 7 days at most. Records that a shipped message was already queued are deleted after 30 days.
  • Short-lived security and counting records (such as rate limits kept against an IP address): deleted automatically within 48 hours.
  • Contact form messages that our spam filter set aside: deleted automatically after 14 days.
  • Website analytics: Google Analytics keeps individual visit data for at most 14 months, the longest period its standard properties allow. Microsoft Clarity keeps visit recordings for 30 days and its summary reports and heatmaps for up to 13 months. The analytics cookies last up to one year.
  • Contact messages and download sign-ups: until you ask us to delete them, or once we no longer need them.
  • Download counts: kept as totals, which contain no personal information.

9. Your Rights

Depending on where you live, you may have the right to access, correct or delete your personal data, including your licence and device records. To exercise these rights, email us at hello@useleadtrapper.com. We will respond within 30 days.

10. Data Security

Every connection to our servers is encrypted with HTTPS, access to stored data is restricted, and our licence server digitally signs its replies; current versions of the app reject any reply that is not correctly signed. No internet transmission is 100% secure, and we cannot guarantee absolute security.

11. Children’s Privacy

LeadTrapper is a B2B platform intended for business use. We do not knowingly collect personal data from individuals under 18 years of age.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by a notice on the website. Your continued use of LeadTrapper after any update constitutes acceptance of the revised policy.

13. Contact Us

For privacy-related questions, contact us at hello@useleadtrapper.com or through our contact page.