Privacy Policy

Who is responsible for what

Two situations must be told apart, and they do not carry the same obligations.

Your user data — identity, business contact details, account, subscription, billing, technical logs: LeadExtreme is the controller. We decide why and how it is processed.

Prospect data — the people you search for, import, enrich or contact: they are not our users, and we process their data only for you. You, or the organisation you belong to, are the controller; LeadExtreme acts as a processor, on your instructions, and does not use that data for its own purposes.

UbiMap, which runs the processing and hosts the connected accounts' sessions, is LeadExtreme's technical platform, published by the same company: it is our own tool, not a separate processor. The providers it relies on are therefore ours, and we list them below.

Data about the people you prospect

On your behalf, the Service processes the following about those people:

• professional identity and background: surname, first name, job title, company, industry, location, LinkedIn profile address and the public information it shows;
• business contact details obtained through enrichment: business email address and phone number;
• history of exchanges: invitations, messages sent and received, dates, sequence status, replies;
• data you import yourself (prospect files) or synchronise with your CRM.

Where the data comes from, and on what basis

It comes from sources available online, from the contact-data providers queried at your request, from your own files and from your exchanges with the people concerned.

The legal basis for this processing is the one you rely on, as controller: in business-to-business prospecting it is usually legitimate interest. It is for you to establish it, document it and check that it holds for your targets and for the channels you use.

What you must do on your side

Because you are the controller for your prospects' data, it is for you to:

• inform the people you prospect, at the latest on first contact, of your organisation's identity, the purpose pursued, the source of the data and their rights;
• contact only people you are entitled to approach, and comply with the rules that govern email and telephone prospecting;
• deal promptly with the access, rectification, erasure and objection requests you receive — deleting a prospect from the Service takes effect immediately;
• keep your record of processing activities and, where required, your impact assessment;
• not import or process special-category data (health, opinions, beliefs, orientation) in the Service: it is not designed for it.

The tools we put at your disposal

The Service lets you export, correct or delete a prospect and permanently exclude a person from your campaigns. Those actions are yours to take: we cannot exercise these rights on your behalf, and we do not act without your instruction.

The providers involved

The Service relies on the following providers, each for a specific task. This list serves as the list of processors under the General Data Protection Regulation. Some are called by the LeadExtreme application, others by UbiMap, our technical platform: all of them act on our behalf, and we answer for them.

• UbiMap (LeadExtreme — France) is not a provider: it is our technical platform, published by the same company. It runs the processing, hosts connected accounts' sessions and handles job queues, prospect search, contact-data enrichment, assisted writing and the connection to CRMs and mailboxes, relying on the providers below.
• IKOULA NET (France) — hosting of the servers and databases of LeadExtreme and its UbiMap platform.
• Stripe (Stripe Payments Europe, Limited — Ireland, Dublin) — subscription payment and invoicing, called directly by LeadExtreme; transfers to Stripe, Inc. in the United States are possible.
• Google (Gmail) — relay for the transactional emails LeadExtreme sends you: address verification, password reset, alerts.
• Bright Data (Luminati) (Bright Data Ltd — Israel, Netanya) — dedicated data-centre IP addresses through which the platform routes connected accounts' sessions, in the country you have chosen. Israel is covered by an adequacy decision of the European Commission.
• Anthropic (Anthropic, PBC — United States, San Francisco) — the Service's artificial intelligence, called by the platform: assisted writing of messages and sequence templates, the prospecting agent in beta, and the features described in the section What the artificial intelligence reads for you, some of which rely on Anthropic's web search.
• Dropcontact, Enrow, Hunter, Lusha, Kaspr — business contact-data lookup, queried at your request. You may bring your own key with these providers.
• HubSpot, Salesforce, Pipedrive, Sellsy, AgileCRM, Google and Microsoft — only if you connect the corresponding CRM or mailbox yourself.
• LinkedIn is not our processor: it is a third party, whose account you use, and it processes data for its own purposes under its own rules.
• Transfers to Israel rest on the adequacy decision adopted by the European Commission for that country. For transfers to a country not covered by such a decision, chiefly the United States, the framework provided for is the European Commission's standard contractual clauses. Details of the safeguards applying to a given provider may be requested at hello@leadextreme.ai.

What the artificial intelligence reads for you

Some features of the Service hand the reading or writing of a text to an artificial intelligence model from Anthropic, called by our UbiMap platform. Here is what it receives, feature by feature. Features marked as beta are open only to organisations taking part in the beta.

• Your target, in the getting-started guide (beta): the text of your website's public pages — the home page and a few others — to identify your offer, your targets and the references you cite; then the job titles of your LinkedIn connections and how many hold each, to suggest the roles to target. Neither the names nor the profiles of your connections are sent to it.
• Your market (beta): your company's name, website and country, and the summary of your offer — or the sentence you write to describe it — to search the web for your likely competitors. The platform also reads your company's public LinkedIn page and the pages LinkedIn shows as similar: company pages, never personal profiles.
• The market study (beta, on subscribing or on request): your message to tailor the study, together with what LeadExtreme knows about your footprint (your offer, your targets, your competitors); then, for each competitor, the public pages of its website, which the platform reads in line with its access rules (robots.txt) and its opt-out from text and data mining, web search results and its public LinkedIn company page, whose description may be used as a fallback when the website cannot be read. The study describes companies and their offers; a short quotation from a public page may nonetheless name a person, such as an executive or the author of a testimonial. For such quotations, LeadExtreme is the controller, on the basis of its legitimate interest in providing a sourced study: they serve only to prove what the study says, never for prospecting, and the person named may ask for their removal at hello@leadextreme.ai. A company's profile, made up of public pages, is kept for up to ninety days by the UbiMap platform, with no link to your account, and may be used for another customer's study; your message, your choices and your report serve only you.
• Posts and comments (beta): your editorial line, your ideas and your instructions; for a comment, the text of the post being commented on. Nothing is published without your approval.
• Messages, sequence templates and the prospecting agent (the agent in beta): your instructions and the useful information about the prospect concerned (professional identity, company, exchanges), to write or suggest a message.

How long data is kept

• account and prospecting data: for the lifetime of the account;
• after an account deletion request: access is cut off immediately, then the data is erased at the end of a seven-day grace period, during which the request can be cancelled;
• prospects, lists, footprints and campaigns belonging to an organisation: transferred to the organisation when one of its members leaves; erased once no active member remains;
• billing identifiers and the usage log: kept, stripped of anything identifying a person, for the statutory retention period for accounting records;
• market study: for as long as your organisation exists, erased with it; a company's shared profile, ninety days at most;
• credit and payment journal, which lets our support team know who consumed what: forty-eight months; it keeps the address of the person who consumed, even after they leave, and is erased with the organisation;
• answers already obtained from our providers (searches, contact details, company data), kept so they need not be requested again: from seven to one hundred and eighty days depending on their nature;
• activity records of each account and each customer, which let our support team answer your questions about what happened: twelve months at most, with no backup copy; they are erased with the account;
• technical and security logs: no IP address is kept for a simple visit to the website or the application; the address of a login to your account stays with your session, for thirty days at most; other application logs are erased at each update of the service, and at the latest when they reach their size limit; the address of a connection refused by the server's firewall is kept for five weeks at most, and a normal visit leaves none.

Your connected LinkedIn account

To act on your behalf, the platform keeps what is needed to hold the connected account's session: session tokens, cookies, browser fingerprint and the proxy assigned to the account. Those items stay on the platform and are not copied into the LeadExtreme application, which holds only a reference to the account.

You choose the proxy country when the connected account is created, and the number of changes is limited. You can disconnect an account at any time: the session then ends.

Your rights, and those of the people you prospect

You have the right to access, rectify, erase, restrict, object to and port your own data. Write to us at hello@leadextreme.ai; we reply within one month.

A prospect who writes to us directly is not our customer: we pass the request on to the user who is the controller, and tell the person we have done so. It is with that user that the request takes effect.

You may at any time lodge a complaint with the French data protection authority (CNIL) or with your own supervisory authority.

No data protection officer has been appointed. The contact point handling these requests is hello@leadextreme.ai.

Security

Exchanges with the Service are encrypted in transit. Access is authenticated and logged, the provider keys you bring are stored encrypted, and the data is hosted in France. No measure makes a system impregnable: should a breach affect you, we will inform you without delay.