Privacy Policy

1Who we are

Unworked Leads is operated by UNWORKED LEADS LLC, a Florida single-member limited liability company based in Miami-Dade County, Florida (“Unworked Leads,” “we,” “us” or “our”). This Privacy Policy explains how we collect, use, share and protect personal information in connection with unworkedleads.com, the Unworked Leads app, the Morning shortlist and our related services (the “Service”).

It covers two groups of people:

• Users: our customers, trial users, people who sign up or contact us, and visitors to our website (Sections 2 to 5); and
• People in the public records: property owners, managing agents and other contacts who appear in our directory (Section 6).

For questions about this policy or privacy requests, email [email protected]. This policy is written in English, and the English version governs over any translation.

2Information we collect from you

Information you give us

• Sign-up and account details: your name, company, work email address, the division and borough you choose, how you heard about us (optional), your phone number (optional), your language preference, and a record that you accepted our Terms and when.
• Morning shortlist settings: your delivery schedule, any other delivery address you add (and whether you have confirmed it) and which seats have the shortlist switched on.
• What you add in the app: saved searches, call-sheet claims, outcomes and notes, and your settings, such as whether you want occasional product news by email.
• Messages: what you send to our support address, including problem reports, which include the address of the page you were on and, in the app, your account ID.

Information about your subscription

• Seats: each seat’s kind, division, borough and status, trial end date, founding-member price lock and whether it is paid, complimentary or beta.
• From Stripe: your Stripe customer and subscription IDs, subscription status, number of seats, price and billing dates. Your card details go directly to Stripe; we never receive or store your full card number.

Information collected automatically

• Sign-in and session records: a hashed copy (a one-way fingerprint) of each sign-in link and session ID, with when it was created and when it expires, and, for each session, your IP address and your browser’s user-agent string. If you add a password, we keep only a salted, slow hash of it, never the password itself. If you turn on two-factor sign-in, we keep the authenticator key encrypted and hashed copies of your recovery codes.
• Usage records: daily counts of your searches, building views, exports, export rows and call-sheet claims, and which leads we sent you in each Morning shortlist, and when.
• Security and rate-limit records: short-lived counters keyed to your IP address (for IPv6, its /64 network), account or email address, used to enforce limits and stop abuse, and the result of the Cloudflare Turnstile check on our sign-up and sign-in forms.
• Email records: our email provider records the emails we send you: recipient, subject, time and delivery status.
• Website analytics: Cloudflare Web Analytics counts page views, referring sites, browser and device types and approximate country, in aggregate and without cookies.
• Server logs: like any website, our hosting provider processes your IP address, browser details and the pages you request in order to deliver the site and protect it from attacks.
• Feedback you send in the app: what it is about (a problem, an idea or data you would like added), your message, and, if you choose, the app page you sent it from, with your account, plan level, language and browser.
• Account change records: when we grant, change or revoke seats on your account, or you delete your account, we keep an audit record of the change.

We do not buy information about our users from data brokers.

3How we use your information

• to create and run your account, sign you in, and provide your seats, the directory, the call sheet, exports and the Morning shortlist;
• to process payments, manage trials and subscriptions, and apply founding-member pricing, through Stripe;
• to send service emails: sign-in links, trial and account confirmations, the Morning shortlist, address confirmations, and notices about your account, billing and these policies;
• to send occasional product news, only if you opt in, with a way to opt out in every message;
• to personalize your rankings (outcomes you record raise similar leads in your own ranking) and to apply the 15-subscriber cap on the Morning shortlist;
• to enforce caps and rate limits, watermark exports with your email address and an export ID, prevent fraud, scraping and abuse, and keep the Service secure;
• to answer your questions, support requests and feedback, and to fix and improve the Service from it;
• to let our team know about new sign-ups so that we can help you get started;
• to understand how the Service is used and improve it, using aggregated or de-identified information where we can; and
• to comply with the law, enforce our Terms and protect our rights and the rights of others.

We do not use your information for targeted advertising, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4Legal bases

Where the law requires a legal basis for processing personal information (for example, for visitors from the United Kingdom or the European Economic Area), we rely on: contract, to provide the Service you signed up for; legitimate interests, to keep the Service secure, prevent abuse, improve the Service and operate our public-records directory, balanced against the rights of the people concerned; consent, for optional product emails, which you can withdraw at any time; and legal obligation, for tax, accounting and other legal requirements.

5How we share information

We share personal information only as described here.

• Service providers that process information for us under contract, only to provide their services to us:
  • Cloudflare, Inc.: website hosting and delivery, our database, scheduled jobs, Turnstile bot protection and cookieless Web Analytics;
  • Stripe, Inc.: payments, subscriptions, invoices and receipts;
  • Resend: delivery of our emails, including sign-in links and the Morning shortlist; and
  • Google (Google Workspace): our support email.
• Legal and safety: when we believe in good faith that the law or legal process requires it, or that it is needed to enforce our Terms (for example, to trace a leaked export), protect the security of the Service, or protect the rights, property or safety of anyone.
• Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business, in which case the information stays subject to this policy or one at least as protective.
• With your consent or at your direction.

We do not share your account information with other subscribers. Your claims, outcomes and notes are private to your account. The only effect across accounts is that a lead stops going into Morning shortlists once 15 subscribers have received it, which never reveals who received it.

We do not sell your account information, and we do not share it for cross-context behavioral advertising.

6Public-records data about property owners and contacts

What it is

Our directory describes New York City buildings and the people and companies connected with them. Alongside building records, it can include the names of property owners (individuals or companies), managing agents, officers and other contacts listed in building registrations, permits and filings; their mailing addresses; and phone numbers, including owner phone numbers listed on historical permit filings, some of which are decades old.

Where it comes from

We compile it from public records published by New York City agencies. We refresh it daily. We do not buy contact data from data brokers, and we are not affiliated with the City of New York or any of its agencies.

Why we use it

We use this information to help contractors and building-service companies find buildings with open violations, permits, compliance deadlines and other conditions, and to contact the people responsible for those buildings about related work. Most of it concerns people in their role as property owners, landlords or business contacts, and all of it is already public. We rely on our legitimate interest, and our subscribers’ interest, in using public records for this purpose, and we limit how it is used:

• full contact details are shown only to paying subscribers whose seats cover the building; trial users and visitors see masked names and contact details;
• we label the age of phone numbers, and owner phone numbers from filings more than 10 years old are left out of exports, the call sheet and the Morning shortlist;
• subscribers may use the data only within their own business, may not resell or publish it, and must follow telemarketing and anti-spam laws and honor opt-outs; and
• the data may not be used for credit, employment, insurance, housing or tenant-screening decisions, or for any other purpose covered by the Fair Credit Reporting Act.

Correction and suppression requests

If you appear in our directory, you can ask us to correct your contact details or to suppress them (stop showing them in the Service). Email [email protected] with “Correction” or “Suppression” in the subject line and include:

• your name and how we can reach you;
• the building address or addresses (or the BBL or BIN, if you know them); and
• the details you want corrected or suppressed, such as a phone number, email address, mailing address or your name as a contact.

We may ask for reasonable information to confirm the request. We will act on it within a reasonable time, generally within 30 days, and keep a minimal record of it so that the details stay corrected or suppressed when our data refreshes. Please note:

• we cannot change the underlying public record; to correct it, contact the agency that published it;
• we may continue to show information needed to describe a building’s public records, such as the name of a company that owns it, while suppressing personal contact details; and
• we cannot retrieve copies that subscribers exported before your request. If a subscriber contacts you and you want them to stop, tell them directly: our Terms require subscribers to honor opt-outs.

7Cookies and similar technologies

We keep these to a minimum and use no advertising cookies or cross-site trackers.

• Session cookie (__Host-ul_session), set by us: keeps you signed in after you use a sign-in link. It is strictly necessary, sent only over HTTPS and cannot be read by scripts on the page. It lasts up to 30 days, or until you log out.
• Two-factor sign-in cookie (__Host-ul_2fa), set by us: only when two-factor sign-in is on, between your email link or password and your code. It is strictly necessary, sent only over HTTPS, cannot be read by scripts on the page, and lasts 10 minutes or until you enter the code.
• Local storage, set by us: your browser’s local storage may remember a few preferences on your device: your language, how many results to show per page, whether you have finished or skipped the product tour, and whether you sign in with a password (never the password itself). They stay until you clear your browser’s site data.
• Session storage, set by us: while you are signed in, your browser keeps a temporary copy of recently loaded app data (the dashboard, headline numbers and search results) so pages open faster. It is kept per account and data version, and it is cleared when you log out or close the tab.
• Cloudflare Turnstile: our sign-up and sign-in forms use Turnstile to check that you are not a bot. It runs from challenges.cloudflare.com, may set its own cookies or use storage on its own pages, and reads browser and device signals, under Cloudflare’s privacy policy.
• Stripe Checkout: checkout and billing pages are hosted by Stripe, not on unworkedleads.com. Stripe sets its own cookies there to run checkout and prevent fraud, under Stripe’s privacy policy.
• Cloudflare Web Analytics: cookieless. It sets no cookies, uses no local storage and does not fingerprint you; it measures visits only in aggregate.

You can block or delete cookies in your browser settings, but you cannot sign in without the session cookie. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of your personal information; we do neither, so no further change is needed.

8How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, unless the law requires or allows us to keep it longer.

• Account details, settings, seats, saved searches, call-sheet entries, Morning shortlist delivery records and daily usage counts: for as long as your account exists. When you delete your account, they are deleted or anonymized as described in Section 10.
• Sign-in and confirmation links: sign-in links expire 15 minutes after we send them (a personal invitation link sent with a complimentary or beta seat, after 7 days), and address-confirmation links shortly after. We delete expired links periodically, and all of them when you delete your account.
• Session records, including IP address and browser details: a session lasts up to 30 days, or until you log out. We keep session records for up to 12 months after they end, for security, and then delete them.
• Rate-limit counters: deleted automatically when their time window ends, between one minute and one day later.
• Billing and subscription records: for as long as your account exists and then for up to 7 years after your last payment, for tax, accounting and legal purposes. Stripe keeps its own payment records under its policies.
• Feedback you send in the app: until you delete your account, or sooner if we no longer need it. We also email each message to ourselves to read it, and those emails are kept like support emails.
• Support emails: for as long as we need them to handle your request, and then for up to 3 years.
• Email delivery records: kept by our email provider for a limited period under its policies.
• Audit records of account changes: up to 7 years, for security and accountability.
• Backups: our database provider keeps a restorable history for up to 30 days, so deleted information can remain in backups for up to 30 days.
• Personal sample pages we email, and their records: a sample page we send to a business expires 30 days after we send it. We delete the page's record (the leads picked for it and the company name shown on it) and the record of what happened with it (when it was viewed, and whether a trial was started or the recipient unsubscribed from it) 90 days after the page expires.
• Marketing email opt-outs: kept indefinitely, so that we keep honoring them. We store only a one-way hash of the email address (SHA-256) and the date, never the address itself.
• Public-records directory data: for as long as the record is current in its public source and relevant to the directory. Correction and suppression records are kept for as long as we need them to keep honoring the request.

We may keep information longer when the law requires it, or to resolve disputes, prevent fraud or enforce our agreements.

9Security

We use reasonable administrative, technical and physical safeguards suited to the information we hold, including: HTTPS for all traffic; secure, HttpOnly session cookies; storing only hashed copies of session IDs, sign-in links, passwords and recovery codes; encrypted two-factor keys; optional two-factor sign-in; protection against cross-site request forgery; bot protection and rate limits; masking of contact details for trial users; watermarked exports; and restricted, least-privilege access to our systems and keys.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you, and the authorities where required, as the law requires. Please keep your email account secure: anyone who can read your email can sign in to your Unworked Leads account.

10Your rights and choices

• Access and export: download a copy of your account data from your account settings, or ask us by email.
• Correction: update your name, company, phone number and Morning shortlist address in your account settings, or ask us to correct other details.
• Deletion: delete your account from your account settings, or ask us by email. If you have an active paid subscription, cancel it first. When you delete your account, we sign you out everywhere; delete your sessions, sign-in links, password, two-factor key and recovery codes, feedback, saved searches, call-sheet claims, outcomes and notes, Morning shortlist delivery records, pending confirmations and usage counts; end any complimentary or beta seats; and anonymize your account record by replacing your email address and clearing your name, company, phone number and preferences. We keep the anonymized record, billing references (such as Stripe IDs) and audit entries where we need them for accounting, tax, fraud prevention or legal reasons.
• Email choices: product news is opt-in, and every such email lets you opt out. You can switch the Morning shortlist off in the app. We will still send essential service emails, such as sign-in links and notices about your account or these policies.

State privacy rights

Depending on where you live, including in states with consumer privacy laws such as California, Colorado, Connecticut, Oregon, Texas and Virginia, you may have the right to know about, access, correct and delete your personal information and to receive a portable copy of it, and to opt out of the sale of personal information, targeted advertising and profiling that produces legal or similarly significant effects. We do not sell the personal information in your account, use it for targeted advertising or use it for that kind of profiling. Residents of those states can exercise the rights that apply to them, and we honor access, correction, deletion and export requests from all our users, wherever they live.

How to make a request

Use the tools in your account settings, or email [email protected] from the email address on your account with “Privacy request” in the subject line. We may need to verify your identity before we act, and we will respond within 45 days, or any shorter period the law requires. You may use an authorized agent where the law allows, and we may ask for proof of the agent’s authority. If we decline your request, you may appeal by replying with “Appeal” in the subject line, and we will respond to the appeal within the time the law requires. We will not discriminate against you for exercising your rights.

11Children

The Service is for businesses and is not directed to children. It is not for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email us and we will delete it.

12International users

Unworked Leads is based in the United States, and the Service is intended for users in the United States. Your information is stored and processed in the United States and in other countries where our service providers operate; Cloudflare, for example, runs a global network. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

13Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page with a new “Last updated” date and, if the changes are material, tell you by email or in the Service before they take effect.

14Contact us

UNWORKED LEADS LLC, a Florida limited liability company
Privacy requests, data deletion and directory corrections: [email protected]
Everything else: [email protected]

For privacy requests, put “Privacy request” in the subject line; for directory corrections or suppression, “Correction” or “Suppression.”