Privacy Policy

1. Data controller

The data controller is AppMaker Studio, based in Lyon, France.

For any question about your personal data, contact us at: contact@leadloq.com.

2. Data we collect

We only collect data necessary to operate the service:

• Account data: email address, name, password (hashed with bcrypt, never stored in clear text)
• OAuth data (if you sign in with Google/GitHub): provider ID, avatar, public name
• Application data you enter: leads, contacts, notes, interaction history
• Billing data: processed by our provider Stripe (we never store your card numbers)
• Technical data: IP address, browser type, connection timestamps (security logs)
• Anonymized usage data: pages visited, only if you consented via the cookie banner

3. Purposes

Your data is used to:

• Provide the LeadLoq service (authentication, lead management, email reminders)
• Manage your subscription and billing (via Stripe)
• Send you transactional notifications required for the service (reminders, password reset)
• Ensure security and prevent abuse (rate limiting, fraud detection)
• Improve the service via anonymized usage statistics (only with your consent)

4. Legal basis

Each processing relies on a legal basis under Article 6 of the GDPR:

• Performance of a contract: service provision, account management, billing
• Consent: analytics cookies, marketing communications (explicit opt-in)
• Legal obligation: invoice retention for 10 years (French Commercial Code)
• Legitimate interest: service security, fraud prevention

5. Retention

• Account data: for the duration of the account, then 30 days after closure to allow reactivation
• Leads and app data: deleted with the account, or upon request
• Invoices: 10 years (legal obligation)
• Connection logs: 12 months maximum
• Analytics cookies: 13 months maximum (CNIL recommendation)

6. Your rights

Under the GDPR, you have the following rights over your personal data:

• Right to access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your data ("right to be forgotten")
• Right to portability: export your data in a readable format (built-in CSV export)
• Right to object and restrict: object to certain processing
• Right to withdraw consent at any time (cookies in particular)

7. How to exercise your rights

To exercise these rights, write to contact@leadloq.com. We respond within a maximum of one month.

If you disagree with our response, you may file a complaint with the CNIL (French data protection authority) — cnil.fr.

8. Subprocessors and transfers

We rely on the following subprocessors:

• Vercel Inc. (United States) — application hosting, governed by Standard Contractual Clauses
• Supabase / Railway — PostgreSQL database (European Union)
• Stripe Payments Europe Ltd (Ireland) — payment processing
• Resend Inc. (United States) — transactional email delivery, governed by Standard Contractual Clauses
• Upstash Inc. — cache and rate limiting

9. Security

We implement appropriate technical and organizational measures: TLS encryption for all exchanges, hashed passwords (bcrypt), enforced HTTPS, strict security headers (HSTS, CSP), token-based authentication (JWT), rate limiting on sensitive endpoints.

Despite these measures, no transmission over the Internet is completely secure. We encourage you to choose a strong password and not to share it.

10. Cookies

See our cookie banner at the bottom of the page. No non-essential cookie is placed without your explicit consent. You may change your choices at any time by clicking "Manage cookies".

11. Changes

This policy may be updated. The last update date is at the top of the page. Any substantial change will be notified by email.