Privacy Policy

1. Who this covers and our role

This Privacy Policy describes how Lynbrook Solutions LLC, doing business as Lakewave.ai ("Lakewave," "we," "us," or "our"), collects, uses, and shares personal information in connection with the website at lakewave.ai, the application at app.lakewave.ai, and related services (the "Service"). It applies to three groups of people:

• Customers and their users: people who create an account or use the Service on behalf of a business.
• Prospects: people at other businesses whose professional contact information is found, stored, or contacted through the Service. Prospects usually have no direct relationship with Lakewave.
• Visitors: people who browse lakewave.ai.

Our role depends on the data. For information a customer uploads or enters (their own contact lists, profiles, and message content), the customer decides why and how it is used and we process it on the customer's instructions, so the customer is the controller and Lakewave is a processor or service provider. For Prospect information that Lakewave assembles from public and third-party sources and makes available in the Service, and for customer account information, Lakewave decides how it is used and is the controller or business. Our Data Processing Addendum governs the processor relationship with customers.

2. Information we collect from customers

• Account information: name, business email address, password (stored hashed), company, and role.
• Sender profile: name, company, title, phone number, website, physical mailing address for email footers, email signature, product descriptions, value propositions, and target-customer details you enter to personalize outreach.
• Customer content: contact lists you upload, campaigns, sequences, notes, and the content of emails you draft, approve, and send.
• Connected account credentials: OAuth tokens for connected Gmail accounts and credentials for other sending accounts you configure, stored encrypted. We never see or store your Google password.
• Usage and device data: features used, jobs run, credits consumed, emails generated and sent, delivery and reply events, log data such as IP address, browser type, and timestamps, and error reports.
• Payment information: billing name, address, and subscription details. Card numbers are collected and stored by our payment processor, not by us.
• Communications: messages you send to support or to any Lakewave address.

3. Information about Prospects

This section applies to you if a Lakewave customer found your information through the Service or contacted you using it.

What we collect

Professional information only: name, job title, employer, work email address, work location or region, employer website and domain, the employer's industry and approximate size, and public professional profile links. For some records we also store whether an email address was confirmed as deliverable, when a record was last verified, and, for public-sector records, procurement-related information published by the agency. We do not knowingly collect personal email addresses, home addresses, personal phone numbers, or any sensitive categories of information about Prospects.

Where it comes from

• Publicly available sources, including company websites, press releases, public professional profiles, news articles, government and procurement portals, and search engine results.
• Third-party data and verification providers that supply or confirm business contact information.
• Inference: for example, applying an employer's known email format to a name to propose an address, which is then verified before it is treated as confirmed.
• Customers, when they upload their own lists or add contacts manually. That information stays within the uploading customer's account.

Why we process it and our legal basis

We process Prospect information to provide business-to-business sales intelligence to our customers, to verify that contact records are accurate and current, and to operate and improve the Service. Where the GDPR or UK GDPR applies, we rely on legitimate interests: ours and our customers' interest in reaching relevant business decision-makers, balanced against the limited impact of processing professional contact details for professional communication. We limit the data to professional information, we do not use it for profiling beyond business relevance, and we provide an easy way to object. Where a law requires consent for the outreach itself, our customers are responsible for obtaining it.

How to be removed

You can ask us to stop processing your information and to place your address on a suppression list that prevents customers from contacting you through the Service. Email [email protected] or reply to any message you received with a request to be removed. See Section 13.

4. How we use information

• To provide the Service: finding and verifying contacts, generating drafts, scheduling and sending email from customers' connected accounts, routing replies, and tracking campaigns.
• To operate accounts: authentication, billing, credit metering, trial limits, support, and service notifications.
• To protect the Service and its users: detecting abuse, enforcing our Acceptable Use Policy, protecting sender reputation, and securing our systems.
• To improve the Service: analyzing usage patterns and verification outcomes, fixing errors, and developing features. We do not use customer content, Prospect information, or Gmail data to train AI models, and we do not permit our AI provider to do so.
• To communicate with customers about the Service, including product updates. You can opt out of marketing messages at any time; we will still send service and billing notices.
• To comply with law and enforce our agreements.

5. AI processing

The Service uses large language models provided by Anthropic to draft emails, summarize signals, rank opportunities, and similar tasks. To do this we send the AI provider the information needed for the task: your sender profile and value propositions, the Prospect's professional details and employer information, and public information about the Prospect's company. We do not send Gmail data or any Google user data to the AI provider (see Section 7). The AI provider processes this data under its commercial terms, does not use it to train models, and does not retain it beyond what is needed to provide the service and enforce its policies. AI-generated drafts are stored in your account as your content.

6. How we share information

We do not sell customer account information, and we do not share personal information with third parties for their own marketing. We share information only as follows.

With our customers

Prospect information is made available to customers so they can conduct outreach, subject to the Terms of Service and Acceptable Use Policy, which restrict customers to internal B2B use and prohibit resale. Under California law, providing Prospect information to customers may be treated as a "sale" of personal information; Section 14 explains your right to opt out.

With service providers (sub-processors)

These providers process data on our behalf, under contracts that restrict them to providing their service to us. We will update this list before adding a provider that processes customer or Prospect personal data.

Other disclosures

• Your organization: if your account is managed by an administrator at your company, that administrator may access your account activity.
• Legal: to comply with law, subpoenas, or court orders; to enforce our agreements; or to protect the rights, safety, or property of Lakewave, our customers, Prospects, or the public. Where permitted, we will notify affected customers of legal requests for their data.
• Business transfers: in a merger, acquisition, financing, or sale of assets, information may be transferred to the successor, who will be bound by this policy.
• With consent: for any other purpose you agree to.

7. Gmail data and Google API policy

Lakewave's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request the gmail.send scope, solely to send emails you have written or generated, reviewed, and approved within Lakewave.
• We do not read, index, access, or store the contents of your Gmail inbox or any other Gmail data.
• Gmail OAuth tokens are encrypted at rest and never shared with any third party, including our AI provider.
• Gmail user data is used exclusively to send outreach emails on your behalf. It is not used for any other purpose, including analytics, advertising, or AI training, and is not transferred to any other party except as necessary to provide or improve this feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.
• Humans at Lakewave do not read Gmail data except with your explicit permission for support or security purposes, where required by law, or for internal operations where the data has been aggregated and anonymized.
• You can revoke Gmail access at any time from your Google Account permissions page or from the Connections page in your Lakewave account. Revocation takes effect immediately, and we delete the stored token.

Gmail data and AI

Gmail data and Google user data are never passed to any AI service. Our AI provider receives only sender profile information you entered into Lakewave and Prospect information from Lakewave's own sources. The flow of data is one-directional with respect to Gmail: Lakewave sends emails outbound through your Gmail account. No Gmail data flows inward to our AI systems or to any third party other than as required for the email delivery itself.

8. Reply routing

To detect replies without reading your inbox, messages sent through the Service may carry a Reply-To address on a domain operated by Lakewave. When a recipient replies, the reply is received by our email delivery provider, matched to the original message, delivered to you, and used to update the campaign record (for example, marking a contact as replied and stopping follow-ups). Replies are visible only to the customer who sent the original message and to Lakewave personnel for support and abuse handling. Reply content is retained as described in Section 10. Recipients who reply can request removal of their information as described in Section 13.

9. Shared verification data

The Service learns from use. When a company's email format is confirmed, or an address is verified as deliverable or undeliverable, that result is stored and may be used to improve results for other customers. These shared results concern the accuracy of a business contact record; they do not include which customers searched for or contacted a Prospect, customers' uploaded lists, seller profiles, message content, or campaign data, none of which is shared between customers.

10. Data retention

• Customer accounts: retained while the account is active. After closure or termination, account data and customer content are deleted within 30 days, except as noted below.
• Trial accounts: may be deleted after a trial ends without conversion.
• Prospect records: retained while they remain relevant and are periodically re-verified; records that fail verification or that we have not been able to confirm as current are removed or marked inactive. Suppression-list entries are retained indefinitely so that removal requests continue to be honored.
• Sent messages and replies: retained in the sending customer's account while the account is active and deleted with it.
• Billing records: retained for seven years as required by tax and accounting law.
• Logs and security data: retained for up to 12 months.
• Backups: encrypted backups are rotated on a fixed schedule and deleted data leaves backups within 90 days.

We may retain information longer where required by law or to resolve disputes and enforce our agreements.

11. Security and incident notification

We protect information with TLS encryption in transit, encryption at rest for credentials, tokens, and backups, hashed passwords, multi-factor authentication, role-based access, a web application firewall, monitoring, and regular security reviews. No method of transmission or storage is completely secure, and you are responsible for keeping your credentials and connected accounts safe. If we confirm a security incident affecting personal information, we will notify affected customers without undue delay, and in any case within the time required by applicable law, with the information they need to meet their own obligations.

12. International transfers

Lakewave is based in the United States, and our servers and service providers are located in the United States and the European Union. If you are outside those regions, your information will be transferred to and processed there. For transfers of personal data from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, incorporated in our Data Processing Addendum, together with supplementary measures such as encryption.

13. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, restrict or object to its processing, withdraw consent, and opt out of certain uses. You also have the right to lodge a complaint with a supervisory authority.

Prospects

You can ask us to delete your record and add your address to our suppression list, which prevents any customer from contacting you through the Service. Email [email protected] from the address in question, or from any address with enough detail to identify the record. We act on removal requests within 10 business days and confirm by email. If a customer holds your information in their own uploaded list, we will forward your request to them where we can, and you may also contact them directly.

Customers

You can update most account and profile information in the app. To export your data, close your account, or exercise other rights, email [email protected] from your account address. If Lakewave processes your data as a processor for your employer, we may direct your request to your employer.

Verification and appeals

We verify requests by confirming control of the relevant email address or through other reasonable means. You may use an authorized agent where the law allows, and we may ask for proof of authorization. We respond within the time required by applicable law (45 days for most U.S. state laws, 30 days under the GDPR), and we will tell you if we need more time. If we decline a request, you may appeal by replying to our decision.

14. California and other U.S. state disclosures

This section supplements the rest of the policy for residents of California and of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as they take effect).

Categories collected

In the past 12 months we have collected these categories of personal information: identifiers (name, email address, IP address); professional and employment information (employer, title, work location); commercial information (subscription and billing history); internet activity (usage of the Service and of lakewave.ai); and inferences limited to business relevance (for example, whether a role is likely a decision-maker). Sources and purposes are described in Sections 2 through 4.

Sale, sharing, and targeted advertising

We do not sell or share customer account information, and we do not share any personal information for cross-context behavioral advertising or targeted advertising. Providing Prospect professional contact information to customers in exchange for subscription fees may qualify as a "sale" under the California Consumer Privacy Act and similar laws. If you are a Prospect and want to opt out, email [email protected] with the subject "Do Not Sell My Personal Information." We honor these requests by suppressing your record as described in Section 13. We do not knowingly sell the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit.

Non-discrimination

We will not discriminate against you for exercising your privacy rights.

15. Cookies and analytics

The application at app.lakewave.ai uses only essential cookies and local storage for authentication and session state. We do not use advertising cookies anywhere. The marketing site at lakewave.ai uses Google Analytics 4 to understand visitor traffic; it collects pages visited, time on site, approximate location, and device information with IP anonymization enabled. You can opt out with Google's browser add-on or by blocking analytics scripts. We honor Global Privacy Control signals as an opt-out of analytics where the law requires it. Google Analytics is not used inside the authenticated application.

16. Children's privacy

The Service is for business professionals. We do not knowingly collect information from anyone under 18, and we do not permit accounts for them. If you believe we have collected information from a minor, contact us and we will delete it.

17. Changes to this policy

We may update this policy as the Service, our providers, or the law change. The current version is always at lakewave.ai/privacy with its effective date, and previous versions are linked below. We will notify registered customers of material changes by email or in the Service at least 14 days before they take effect. Continued use after a change takes effect means you accept it.

18. Contact

Legal notices: [email protected]
Security reports: [email protected]
Unwanted email reports: [email protected]