Privacy Policy
Version 2026-10-29-draft · Effective [EFFECTIVE DATE]
Draft, not in force. This page has not been reviewed by an advocate yet and is not legal advice. Items in [BRACKETS] are details still to be filled in.
Not built yet
- The sole-trader exclusion and the removal suppression list are not built yet.
This policy explains how getLeads handles personal data. It follows Kenya's Data Protection Act 2019 and, for people in the EU and UK, the GDPR / UK GDPR.
1. Who we are
The data controller is getLeads ([REGISTRATION NUMBER]), Nairobi, Kenya. ODPC registration: [ODPC REGISTRATION NUMBER]. Privacy contact: [PRIVACY EMAIL] ([DATA PROTECTION OFFICER NAME, if appointed]). EU/UK representative: [EU/UK REPRESENTATIVE, if required].
2. Two groups of people
- Our users — people who visit getLeads or create an account (sections 3–4).
- People connected to the companies in our leads — we sell company-level information, not profiles of people, but a company record can sometimes include something that relates to a person (section 5).
3. Data we collect from users
| What | Why | Lawful basis |
|---|---|---|
| Name, email, password (held by Firebase Authentication), sign-in method | Create and secure your account | Contract |
| Sign-in codes and a hashed (scrambled) network/IP identifier for trusted networks | Two-step sign-in security | Legitimate interest (security) |
| Website domain you scan, target country, buyer profile, saved leads and notes | Run the service | Contract |
| Wallet balance, top-ups, unlocks, refunds, credit history | Billing and our records | Contract; legal obligation (accounting) |
| Payment details: Paystack reference, amount, channel, card brand/last 4 and card fingerprint, mobile-money number (stored hashed where used for checks) | Take payment, refunds, fraud prevention | Contract; legitimate interest (fraud) |
| A random device ID kept in your browser, and hashed IP | Limit free unlocks and stop abuse | Legitimate interest (fraud prevention) |
| Referral link used, and hashed device, IP, email domain, card fingerprint and mobile-money identifiers | Stop self-referrals (see Referral Terms) | Legitimate interest (fraud prevention) |
| How you found us: UTM tags, the referring website's host name and landing page — not collected if your browser sends Do Not Track or Global Privacy Control | Measure which channels work | Legitimate interest (marketing measurement) |
| Support messages and removal requests | Answer you and keep a record | Contract; legal obligation |
| Policy versions you accepted, and when | Prove what you agreed to | Legal obligation; legitimate interest |
We don't sell users' personal data. We don't use it for automated decisions with legal effects.
4. Analytics and cookies
See our Cookie Policy. Today getLeads sets no advertising cookies. If we turn on analytics, we use a privacy-friendly setup and respect Do Not Track / Global Privacy Control.
5. Lead data (the companies we show)
- What we hold: company name, website, category, location of the business, an optional company page link (such as LinkedIn) where one is found, the results of our website checks, and the date of each check.
- What we don't sell: named employees, directors, officers, personal emails or mobile numbers. Sole traders are excluded, because their business details are personal data.
- Sources: company suggestions written by an AI model (Google Gemini), checked against each company's own website and public web search results. Open, licensed datasets are planned and will be listed before they are used. Full list: Data sources.
- Lawful basis: legitimate interest — helping businesses find other businesses to sell to. We have assessed that this does not override the rights of the people concerned because the data is company-level, published by the company or an official register, and easy to remove.
- If a record still relates to a person (for example, a one-person company), you have the rights in section 8, including to object, and we will remove it. Where GDPR applies and a named person is included, we give the notice required by Article 14 (see Remove my data).
- Removal and suppression: anyone can ask us to remove a company. We keep a minimal suppression list (domain, registry number) so it is not added back.
6. Who we share data with
Service providers who process data for us, under contract:
| Provider | Purpose | Location |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Gemini API) | Accounts, database, AI text | USA and other Google regions |
| Vercel | Hosting | USA and global edge network |
| Paystack | Payments and refunds | Nigeria / Kenya, with card networks worldwide |
| Resend | Sign-in and service emails | USA |
| [ANALYTICS PROVIDER, if turned on: Plausible (EU) or Google Analytics (USA)] | Site statistics | [LOCATION] |
We share lead data with buyers who unlock it. We may disclose data if the law requires it, or to protect our rights. We never sell user data.
7. International transfers
Some providers above are outside Kenya and the EU/UK. We transfer data only with safeguards the law accepts — for example, the provider's standard contractual clauses or data-processing terms, and the conditions in sections 48–50 of Kenya's Data Protection Act. Ask us for details at [PRIVACY EMAIL].
8. Your rights
You can ask to: be informed; access your data; correct it; delete it; object to processing (including any direct marketing, which we always stop); restrict processing; get your data in a portable format; and withdraw consent where we rely on it. Email [PRIVACY EMAIL] or use Remove my data. We reply within [RESPONSE TARGET, e.g. 14 days] and no later than the law requires. We may ask you to prove who you are.
9. Retention
| Data | Kept for |
|---|---|
| Account data | While your account is open, then deleted within 90 days of closing it (unless needed for a dispute) |
| Payment and wallet records | 7 years (tax and accounting) |
| Lead records | Re-checked or deleted after 12 months |
| Fraud-check hashes and device IDs | Up to 24 months |
| Attribution (UTM) data | Kept in your browser for up to 30 days, then on your account record until it is closed |
| Suppression list | As long as needed to keep honouring the removal |
| Policy acceptance logs | While the account is open plus 7 years |
10. Security
Access controls, encryption in transit, hashed identifiers for fraud checks, two-step sign-in and least-privilege access. No system is perfectly secure; if a breach affects you, we will tell you and the ODPC as the law requires.
11. Complaints
Please contact us first at [PRIVACY EMAIL]. You can also complain to Kenya's Office of the Data Protection Commissioner (ODPC) — www.odpc.go.ke — or, in the EU/UK, your local data-protection authority (in the UK, the ICO).
12. Children
getLeads is for businesses and is not meant for anyone under 18.
13. Changes
We will post updates here with a new version and date, and email account holders about important changes.