This notice explains how data is handled when you connect an artificial
intelligence tool (such as Claude, ChatGPT or Cursor) to your LeadLovers account
through the MCP server at mcp.leadlovers.com.
It supplements the LeadLovers Privacy Policy and does not replace it. Anything not described here follows that document.
LEADLOVERS TECNOLOGIA LTDA., CNPJ 22.799.684/0001-76. Data Protection Officer: abuse@leadlovers.com.br.
You authorise the AI tool to act on your LeadLovers account on your behalf. From then on, when you ask it for something, it reads or changes your account data: leads, machines, sequences, emails and custom fields.
Your account data is processed by the provider of whichever AI tool you choose. When you ask for your list of leads, for example, that data is sent to that tool's service so it can answer. This processing happens under that provider's terms and privacy policy, not LeadLovers'. LeadLovers does not control what those providers do with the data they receive, nor how long they keep it.
Connect only tools you trust, and consider the nature of your contacts' data before connecting.
The connection uses your account's Web API Token. It is not shown during authorisation, is not written to your computer, and is not sent to the AI tool. It stays on this server, tied to the authorisation you granted.
Only what is needed to keep the connection working. The data is held in a restricted Redis instance on LeadLovers infrastructure and expires automatically:
| Data | Purpose | Kept for |
|---|---|---|
| AI tool registration (name and return addresses) | Identify the connected tool | 365 days |
| Authorisation request in progress | Tie the consent screen to the request | 10 minutes |
| Authorisation code | Single use, exchanged for the access token | 1 minute |
| Access token | Authenticate each request from the tool | 1 hour |
| Refresh token | Keep the connection without asking again | 30 days |
| Email template draft | Allow edits across several steps | 1 hour |
Your leads, emails, machines, sequences and custom fields are not copied or kept here. They are read from your account at the moment of the request, handed to the AI tool, and discarded. The same applies to the content of your conversations with the tool, which LeadLovers neither receives nor records.
Technical server logs record that an operation happened and its outcome, without the data itself and without access keys.
The data listed above expires on its own within the stated periods. To request immediate deletion, contact the DPO.
You may request access, correction, deletion, portability and withdrawal of consent under the LGPD (Brazil's General Data Protection Law) by writing to abuse@leadlovers.com.br. The procedure and deadlines are those set out in the LeadLovers Privacy Policy.
Changes to this notice are published on this page, with the updated date at the top.