Privacy Policy

1. Data Controller

The Data Controller for personal data processed in connection with your use of the MyLeadTeam platform as an account holder is:

2. Data Controller vs. Data Processor Roles

MyLeadTeam operates in two distinct capacities depending on the category of data:

3. Categories of Personal Data Processed

3.1 Account and User Data (Controller capacity)

• Name and email address provided during registration.
• Organisation name, team members invited and their roles.
• Authentication credentials (passwords stored as bcrypt hashes - never in plain text).
• Account preferences and settings.
• Timestamps of login events and session activity for security purposes.

3.2 Lead and Contact Data (Processor capacity)

• Business contact details of third-party leads discovered or uploaded by the Customer (name, job title, company, business email address, LinkedIn profile, phone number where provided).
• AI-enriched profile data generated from publicly available information (company description, domain, industry category).
• Email sequences drafted by AI agents for the Customer's review and approval.

3.3 Email Engagement Data

• Email open events, link click events, and reply tracking data, collected via tracking pixels and signed redirect URLs embedded in sent emails.
• Bounce and delivery status received from the Customer's SMTP infrastructure.

3.4 Technical and Log Data

• IP addresses, browser type, and device information for security monitoring.
• API call logs and error logs for debugging and platform reliability.

3.5 Billing and Trial Eligibility Data

• Stripe customer, Checkout, subscription, plan, payment status, and billing-period identifiers.
• A pseudonymous HMAC-derived marker of the normalized billing email used to enforce one trial per Customer without retaining the email in the trial claim.
• Trial reservation, activation, and expiry timestamps used for fraud and abuse prevention.

4. Legal Bases for Processing

5. Sub-processors and Third-Party Recipients

To deliver the Service, we share personal data with the following categories of sub-processors under appropriate data processing agreements:

SCCs = Standard Contractual Clauses (EU Commission Decision 2021/914), one lawful transfer mechanism for international transfers where an adequacy decision or another valid GDPR transfer mechanism does not apply.

We do not sell personal data to third parties.

6. Data Retention

• Product account data: retained while the account is active. The self-service deletion flow removes the login and associated sole-member organization data from the active product database immediately. Separate invoices, payment records, and other records required by tax, accounting, fraud-prevention, or legal obligations may be retained for the period required by applicable law.
• Lead and contact data: retained while the owning organization remains active and removed when that organization is permanently deleted, including through the self-service account deletion flow for a sole-member organization.
• Email engagement data: retained for up to 24 months from the date of collection for campaign analytics, then aggregated or deleted.
• Security and audit logs: retained for up to 12 months.
• Trial eligibility marker: retained after account deletion for as long as the introductory trial programme operates or as otherwise necessary to establish, exercise, or defend claims and prevent repeated trial abuse, subject to applicable law.

7. Your Rights as a Data Subject

Where BuildFlow acts as Data Controller, you have the following rights under GDPR:

• Right of access (Art. 15): Request a copy of personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data where no legal retention obligation applies.
• Right to restriction (Art. 18): Request that we restrict processing in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests, including for direct marketing.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without detriment.

To exercise any of these rights, please contact us at support@myleadteam.com. We will respond within 30 days. Identity verification may be required before we can process your request.

If you are a lead or contact whose data has been uploaded by one of our Customers and you wish to exercise your data subject rights, please contact the Customer organisation that collected your data, as they act as the Data Controller for that data.

8. International Data Transfers

Some personal data may be transferred outside the European Economic Area. Depending on the recipient, we rely on an applicable adequacy decision, including the EU-US Data Privacy Framework where the recipient is validly certified, Standard Contractual Clauses approved by the European Commission (Decision 2021/914), or another lawful safeguard under Chapter V GDPR. You may obtain information about the relevant safeguards by contacting us at support@myleadteam.com.

9. Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Passwords hashed with bcrypt (cost factor 12+).
• SMTP credentials encrypted with AES-256-GCM at rest.
• All data in transit protected by TLS/HTTPS.
• Application-level tenant scoping and role-based authorization for organisation data.
• Audit logging of significant platform events.

No transmission over the internet is 100% secure. In the event of a personal data breach likely to result in high risk to your rights, we will notify you and the relevant supervisory authority as required by GDPR Art. 33-34.

10. Supervisory Authority and Right to Lodge a Complaint

You have the right to lodge a complaint with the Polish supervisory authority for data protection:

You may also lodge a complaint with the supervisory authority of your EU member state of habitual residence.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered account holders at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

For privacy-related questions, data subject requests, or concerns: