AutoLeadsPrivacy
In short
- Your contacts, conversations and analyses are kept on your computer. If you turn on sync between your computers, we also keep an end-to-end encrypted copy that we cannot read: only your computers have the key.
- Our servers keep your account, your plan, your invoices and your connected computers. The text the app sends to the artificial intelligence passes through them without being kept.
- We never keep the email or phone number LinkedIn shows on a person's contact card.
- We do not sell data or use it for advertising.
This policy separates two situations, because our role is different in each:
- Data of our customers (whoever subscribes to AutoLeads): we are the controllers.
- Data of the people our customers search for and contact on LinkedIn: the controller is the customer; when we take part, we are processors.
1. Controller
[COMPANY NAME], tax ID [TAX ID], [REGISTERED ADDRESS]. Privacy contact: [PRIVACY EMAIL].
2. Data of our customers
| What data | What for | Legal basis | Retention |
|---|---|---|---|
| Name, company, email, password (irreversibly hashed), billing details | Creating and managing your account and the subscription, charging, invoicing, support | Performance of the contract (art. 6.1.b GDPR) and legal obligation (6.1.c) | While you have an account; invoices and tax data, as long as tax and commercial obligations require (up to 6 years) |
| Sessions (date, IP address and browser) and a log of sensitive account actions | Account security and fraud prevention | Legitimate interest in protecting accounts (6.1.f) | Sessions: 30 days after the last activity. Log: 12 months |
| License key, installation identifier and computer details (system, app version, the name you give it, approximate country, last connection, number of connected LinkedIn accounts) | Activating the license, applying the plan's limits, showing you your computers and preventing fraudulent use | Performance of the contract | While the computer is connected and 12 months after disconnecting it |
| End-to-end encrypted copy of the app's data (accounts, contacts, conversations and settings, without the LinkedIn session or your keys), only if you turn on sync. We do not have the key: we cannot read it. We also keep which computer works each account | Having the same data on all your computers and recovering it when reinstalling | Performance of the contract | While sync is on: the last three versions of each account. It is deleted when you turn it off («Delete the server copy») or delete your account |
| Use of artificial intelligence: number of calls and tokens per task and day (never the text) | Applying the amount included in your plan and detecting abuse | Performance of the contract | 24 months |
| App usage statistics: daily counts (invitations, messages, replies), without names or texts. Only if you allow it in Settings | Improving the product and detecting LinkedIn changes | Legitimate interest (6.1.f); you can turn it off whenever you want | 24 months |
| Technical error reports, cleaned of emails, phone numbers, profile links, keys and paths on your computer. Only if you allow it in Settings | Detecting and fixing failures | Legitimate interest (6.1.f); you can turn it off whenever you want | Each occurrence, 90 days; the grouped error, 12 months since it last happened |
| Feedback and requests you send us, with the app's diagnostics if you choose to attach them (versions, state and recent errors, never contacts) | Helping you and improving the product | Performance of the contract or consent | 24 months |
| Website visits, without cookies: page, referring site, campaign, device type and country, with an irreversible daily fingerprint (see Cookies) | Knowing which pages and campaigns work | Legitimate interest (6.1.f) | 13 months |
| Identifier of the ad you came from (if you came from one) and your decision about sharing it | Measuring which campaigns bring customers. Only if you authorise it when signing up, we tell that platform (Google or Microsoft) that the click ended in a sign-up or a purchase, with its amount; never your name or your email | Consent (6.1.a) to report it; legitimate interest (6.1.f) for our own measurement | 13 months |
| Email for product news, only if you accept | Sending you news, at most once a month | Consent (6.1.a), which you can withdraw in your account or in each email | Until you withdraw it |
We do not take automated decisions with legal effects on our customers.
3. Data of the people contacted
AutoLeads reads professional information that people publish on LinkedIn (name, role, company, experience, location, language, posts) and the conversations they have with the customer. About that data:
- It is kept on the customer's computer, in a local database we do not control. If the customer turns on sync between their computers, the AutoLeads servers also keep an end-to-end encrypted copy, whose key only the customer's computers have: we cannot read it.
- The customer is the controller: they decide whom they search for and why, and must have a legal basis (usually the legitimate interest in B2B prospecting), inform the people and honour their rights.
- To analyse profiles, write messages and read replies, the program sends the necessary text to an artificial intelligence provider (see section 5). There we act as the customer's processors.
- When a person asks not to be contacted, their profile address is added to an exclusion list that is always respected and is not deleted with the rest of the data, so that they are not written to again.
- The email and phone number LinkedIn shows on the contact card are never kept. Only the contact details the person gives in the conversation are kept, and they are deleted if they ask not to be contacted.
If you received a message sent with AutoLeads and want to exercise your rights, contact whoever wrote to you (the controller). You can also write to us at [PRIVACY EMAIL] and we will pass it on and add your profile to the exclusion list.
4. Recipients
We do not sell or hand over personal data. We only share it with providers that help us provide the service, under a processing agreement, and with authorities when the law requires it.
5. Providers and international transfers
| Provider | Service | Location | Safeguard |
|---|---|---|---|
| [HOSTING PROVIDER] | Servers for accounts, licenses, updates and the exclusion list | [EU] | — |
| Stripe Payments Europe, Ltd. | Charges, invoices and tax calculation | Ireland (EU), with transfers to Stripe, Inc. (USA) | EU-US Data Privacy Framework and standard contractual clauses |
| [EMAIL PROVIDER] | Sending account emails (confirmations, invoices, notices) | [LOCATION] | [SAFEGUARD] |
| [AI PROVIDER] | Profile analysis, message writing and reply reading (the text passes through our servers without being kept) | [LOCATION] | [European Commission standard contractual clauses / adequacy decision] |
If a provider is outside the European Economic Area, the transfer relies on an adequacy decision or on the standard contractual clauses approved by the European Commission, with the necessary additional measures. You can ask us for a copy of those safeguards.
6. Your rights
From your account you can download your data and delete your account at any time (Security). You can also exercise the rights of access, rectification, erasure, objection, restriction and portability by writing to [PRIVACY EMAIL]. When you delete your account we keep only the invoices and tax data the law requires us to keep. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority of the country where you live.
7. Security
We apply appropriate technical and organisational measures: encryption in transit, passwords stored with an irreversible algorithm, optional two-step verification, sessions protected against request forgery, signed per-device tokens that expire, encrypted license keys, restricted and logged access to the servers, and encrypted backups. Since prospecting data is kept on your computer, its security also depends on you protecting your device.
8. Changes
If we change this policy in a relevant way, we will let you know by email or from the app before it applies.