Smart Leads

Privacy Policy

How Smart Leads handles personal data about the people who use it.

This page is a placeholder, not legal text. It lists what the reviewed Privacy Policy must cover. The reviewed text replaces it before Smart Leads goes live.

Who is responsible

The reviewed text must cover:

  • The controller for account data (legal name, address, contact for privacy questions) and a representative or data protection officer if required.
  • For lead data inside workspaces, the workspace is the controller and Smart Leads the processor (02-design “Compliance”); that processing is described in the Data Processing Agreement.

Data about users

The reviewed text must cover:

  • Account data: name, email, password (stored as a hash), two-factor settings and sessions.
  • Security and audit records: sign-ins, IP addresses, and workspace actions such as member changes and exports (REQ-AUD-1).
  • Billing data handled by Paddle; Google sign-in data when a user signs in with Google.

Purposes and legal bases

The reviewed text must cover:

  • For each use (running the service, security, billing, emails about the account), its purpose and legal basis.

Recipients and processors

The reviewed text must cover:

  • The hosting provider of the server (P10-05), the email provider for platform emails, Paddle, Google (sign-in), and Sentry when error tracking is on (P10-06: error reports exclude request bodies, cookies, headers and user data).
  • Where they process data, and the safeguards for transfers outside the EEA if any.

Cookies

The reviewed text must cover:

  • Only what the service needs: a secure, HttpOnly session cookie, and the light/dark preference and table settings kept in the browser. No advertising or analytics cookies.

Retention

The reviewed text must cover:

  • How long account, audit and security records are kept.
  • Daily database backups are kept 14 days (NFR-9); a deleted workspace is purged within 30 days (REQ-WS-6).

Rights

The reviewed text must cover:

  • Access, correction, deletion, export, objection and complaint to a supervisory authority, and how to exercise them.