Privacy Policy
The short version. Lead Finder collects publicly listed business contact details from Google Maps and keeps them on your own computer. Nothing leaves your browser until you press Send to CRM. We do not track your browsing, we do not run analytics or ads inside the extension, and we never sell or rent any data it handles.
1. What this policy covers
This policy describes how the Lead Finder browser extension handles data, and covers the All The Apps services the extension communicates with at v3api.alltheapps.io. It is the privacy policy referenced by Lead Finder's Chrome Web Store listing.
It does not cover your CRM, your GoHighLevel account, or any third-party website you visit — each of those is governed by its own policy.
Lead Finder is licensed to you by an agency. That agency issued your license key and receives the leads you send. Where this policy says “your agency”, that is who it means.
2. Who we are
Lead Finder is published by All The Apps (“All The Apps”, “we”, “us”).
Contact: [email protected].
3. What Lead Finder does
You enter keywords and locations. Lead Finder opens Google Maps in a browser window, works through every keyword-and-location combination, and records the businesses Maps returns. Optionally it opens each business listing to collect further details, and — if you switch that on — visits each business's own website looking for a contact email address.
The result is a table of businesses you can export as a CSV file or send to the CRM your license is attached to. That is the extension's entire purpose.
4. What Lead Finder stores on your computer
The following is written to browser storage on your own machine (chrome.storage.local). It is not readable by websites, and the extension does not upload it anywhere:
Your search inputs — the keywords, locations and ignore-patterns you type in.
Collected business records — business name, category, address, city, state, postcode, phone number, website, star rating, review count, latitude and longitude, and Google's own identifiers for the listing (CID, Place ID, Feature ID). Where email extraction is enabled, up to three email addresses found on the business website.
Your settings — timing and limit values, visible columns, page size, and your light/dark theme choice.
License state — your license key, a device identifier (see §6), and the quota and status figures last returned by the licensing service, cached so the extension keeps working through a brief loss of connection.
This stays on your computer until you remove it. Pressing Clear deletes the collected records; uninstalling the extension deletes everything above, including the license state.
5. The nature of the data collected
Lead Finder collects business contact information that is already published — the details a business chose to display on its own Google Maps listing and its own website. It is not taken from private accounts, and the extension does not sign in to Google or read anything that requires being signed in.
Some of that information can still identify a person: a sole trader's listing may carry a personal name, a mobile number or a personal email address. Treat what you collect accordingly. Under GDPR, UK GDPR, CCPA/CPRA and comparable laws, you and your agency are the data controller for the leads you collect and send; All The Apps processes them on your behalf. Using those results — in particular contacting the businesses in them — is your responsibility. You must have a lawful basis for doing so and must honour opt-out and deletion requests you receive.
6. What is sent to All The Apps
6.1 Licensing
When you activate a key, and periodically while the extension is in use, it sends to v3api.alltheapps.io:
your license key;
a device identifier — a random UUID generated on your machine the first time you activate. It is not derived from your hardware, your browser profile, your IP address or anything else about you. It exists only so a key can be limited to one installation;
a device label on first activation — a short string such as “Chrome on Windows”, derived from the browser's user-agent, so your agency can tell which installation a key is bound to. No version numbers, no fingerprint.
As with any internet request, our servers see the IP address a request came from and record it in standard access logs for security and abuse prevention.
6.2 Leads you choose to send
When — and only when — you press Send to CRM, the rows you selected are uploaded to All The Apps and staged for delivery into the CRM location your license key is attached to. Nothing is uploaded automatically, on a schedule, or in the background. If you never press that button, no collected record ever leaves your computer.
Export CSV writes a file to your own download folder. It does not involve our servers at all.
7. What Lead Finder never collects
Your browsing history, open tabs or bookmarks.
Anything you type on any website other than Lead Finder's own inputs.
Passwords, cookies, session tokens or authentication data of any kind — the extension never signs in to Google or to any site it visits.
Payment or financial information. The extension takes no payments.
Health, biometric, precise-location or other sensitive personal data about you.
Usage analytics, telemetry, heatmaps, session recordings or advertising identifiers. There is no analytics SDK and no third-party script in this extension — every asset it loads ships inside the package.
8. Chrome Web Store Limited Use disclosure
Lead Finder's use of information received from Google APIs, and all data it obtains through the browser, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:
Data is used only to provide or improve the single purpose of the extension: collecting business leads and delivering them to the user's own CRM.
Data is not transferred to third parties except to deliver leads to the CRM location the user's own license designates, or where required by law.
Data is not sold, and is not transferred or used for advertising, ad targeting, retargeting, personalisation, or to build advertising profiles.
Data is not used to determine creditworthiness or for any lending purpose.
No human reads the collected data, except where the user gives explicit consent for a specific support issue, where required by law, or on aggregated and anonymised data for security and operational purposes.
9. Third parties
We do not sell, rent or trade any data. We do not share it with advertisers, data brokers, or any party for their own purposes. The only onward transfer is the one you initiate: leads you send go to the CRM location your agency configured, because that is the point of sending them.
We use infrastructure providers (hosting, database and email) to run the service. They process data only on our instructions and only to keep the service running. We may also disclose data where we are legally required to.
Two third-party sites are involved in normal use, and your interaction with them is governed by their policies rather than ours:
Google Maps — the extension navigates a browser window to Maps and reads the results as they render, exactly as a person scrolling the page would. It does not use a paid Maps API key, and sends Google no data about you beyond the ordinary request your browser makes.
Business websites — only when email extraction is switched on, and only for the businesses in your results. See §10.
10. Email extraction, and why it asks for permission
Reaching arbitrary websites is the one thing Lead Finder cannot do with a narrow permission, so <all_urls> is declared as an optional permission and requested at the moment you tick Extract emails — not at install time. Leave the feature off and the extension never holds that access.
With it on, the extension fetches the public pages of the business websites in your results, scans the HTML for email addresses, keeps up to three per business, and discards the page. It does not submit forms, does not log in, and does not visit sites that are not in your results.
11. Permissions, and what each is for
storage, unlimitedStorage
Hold your inputs, settings and collected results on your own machine. A long run can reach tens of thousands of rows, which is past the default quota.
tabs
Open the Google Maps window, drive it through your search list, and close it when the run ends. Used to control the extension's own window — not to read the tabs you have open.
alarms
Schedule the periodic license re-check.
notifications
Tell you when a long run finishes or stops early.
https://*.google.com/*
Read the Maps results pages the extension itself navigated to.
https://v3api.alltheapps.io/*
Validate your license key and deliver the leads you choose to send.
<all_urls> — optional
Email extraction only, granted by you at the moment you enable it, and revocable at any time from Chrome's extension settings.
12. Retention
Data on your computer is kept until you clear it or uninstall the extension — we have no way to reach it and hold no copy of it.
Leads you send to the CRM are retained under your agency's own retention policy, since they become records in your agency's CRM. Licensing records — the key, the bound device identifier and label, and quota counters — are kept for as long as the key exists, and are removed when your agency deletes it.
13. Your choices and rights
Stop collecting. Press Stop; the run ends immediately.
Delete what you collected. Press Clear, or uninstall the extension.
Withdraw website access. Untick Extract emails, or remove the permission in Chrome's extension settings.
Unbind this browser. Use “Remove from this browser” in the license panel. The key stays bound to the device until your agency resets it.
Access, correction, deletion and portability. If you are in a jurisdiction that grants these rights over data we hold about you, contact us at [email protected] and we will respond within the period the applicable law requires. Requests about leads already delivered to a CRM should go to the agency that operates it — they, not we, control those records.