Privacy Policy – GDPR

Last updated: February 13, 2026

1. Data Controller

• The data controller is: SAS LEAD ME
• Registered office: 87 Avenue Char Verdun, 83160 LA VALETTE DU VAR, France
• GDPR contact: hello@leadmia.com

2. Data Collected

2.1 Identification Data

• First name, last name
• Email address
• Profile picture (Google, if provided)
• Google ID

2.2 Billing Data

• Company name
• Billing address
• VAT number
• Phone number

2.3 Connection and Usage Data

• IP address
• User agent (browser/device)
• Connection and activity logs
• Date/time of last login
• Origin of the visit, registration or referral, where this information is available

2.4 Google Business Profile Data

• Business names, addresses, phone numbers, websites, opening hours
• Customer reviews, photos
• Performance statistics

Some of this information is provided directly by the user or accessed through Google APIs that the user has authorised Leadmia to access. Other information relating to the business may come from publicly available sources, including the business’s Google Business Profile, its website or other publicly available professional sources.

2.5 Data Generated by the Service

• Posts created
• Review responses
• Automation settings
• Activity history / reports
• Audit and analysis results generated by Leadmia

2.6 Data Used for User Support and Commercial Prospecting

As part of its activities exclusively aimed at professionals, Leadmia may use certain data in order to present its services, assist users in discovering or using the platform and manage the commercial relationship.

This data may include:

• the email address provided during registration;
• the user’s first and last name;
• the name and contact details of their business;
• the professional phone number displayed on the business’s Google Business Profile;
• the professional phone number or email address displayed on the business’s website or another publicly available professional source;
• information relating to the use of Leadmia, registration and subscription;
• the history of communications with Leadmia.

When a user creates a Leadmia account, Leadmia may contact them by email or telephone in order to provide further information about its features, offers or subscriptions, answer their questions, assist them in getting started with the Service or offer support tailored to their business.

Where professional contact details are obtained from publicly available sources, their use is limited to purposes related to the professional activity of the person or business concerned.

Users may object at any time to the use of their data for commercial prospecting purposes, free of charge and without having to provide a reason.

2.7 Data Collected via the Partner Widget

Leadmia allows certain partners to integrate a module or widget into their own website or another digital platform, enabling users to access certain Leadmia features, carry out an audit, obtain information relating to a business or access registration for Leadmia (hereinafter the “Partner Widget”).

The Partner Widget may be used without the user having previously created a Leadmia account.

When a user accesses Leadmia or uses a Partner Widget from a partner’s website, Leadmia may collect:

• the identifier of the partner responsible for the visit;
• the origin of the visit or referral;
• the URL or technical information relating to the page from which the Partner Widget is used, where technically necessary;
• technical data required for the operation of the widget;
• information relating to the business selected, searched for or analysed;
• information voluntarily entered by the user into the widget;
• the results of audits or analyses generated;
• where applicable, information used to determine that a subsequent registration or subscription originated from that partner.

This data is used in particular to ensure the proper operation of the Partner Widget, provide the requested service, measure the use of the system and correctly attribute a registration or subscription to the partner that facilitated the referral.

Use of the Partner Widget is subject to the same data protection principles as direct use of Leadmia. Where provided for within the widget interface, the user is also subject to the Terms and Conditions of Use or other terms applicable to the service offered.

Use of a Partner Widget does not automatically result in the creation of a Leadmia account.

2.8 Attribution of a Registration to a Partner and Sharing of Contact Details

Where a user registers with Leadmia following a referral made by a partner, Leadmia may identify the specific partner responsible for that registration.

In order to attribute the user, monitor the partnership and, where applicable, calculate any benefits, commissions or remuneration agreed between Leadmia and the partner, certain information may be shared with the partner that referred the user.

This information may include:

• the user’s first and last name;
• their email address;
• the name of their business;
• the business’s professional contact details where necessary;
• the date of registration;
• the status required to determine whether the user registered or subscribed to an offer;
• information strictly necessary for attribution and management of the partner relationship.

Such sharing is limited to the partner directly responsible for the referral and to information required for attribution and partnership management purposes.

In particular, the partner does not receive the user’s login credentials, payment information, Google access tokens or private Google Business Profile data that is not required for attribution.

For processing operations carried out by the partner for its own purposes using the data communicated to it, the partner may act as a separate data controller and must therefore comply with its own obligations regarding the protection of personal data.

3. Purposes and Legal Bases

Purpose	Legal Basis
Account management	Performance of a contract
Provision of the Service (GBP synchronisation)	Performance of a contract
Billing/payment	Performance of a contract
Automations (posts/review responses)	Performance of a contract
Transactional emails and communications required for the operation of the Service	Performance of a contract
Reports, summaries and emails relating to the use of Leadmia	Performance of a contract and/or legitimate interest
Customer support and user assistance	Performance of a contract and/or legitimate interest
Contacting a registered user by telephone or email to present Leadmia, its features or offers and provide assistance	Legitimate interest in the context of a B2B professional relationship, or consent where required
Commercial prospecting aimed at professionals using professional contact details provided or publicly available	Legitimate interest where the communication relates to the professional activity of the person concerned, or consent where required
Marketing emails, commercial offers, new features and promotional communications relating to Leadmia	Legitimate interest where B2B prospecting is permitted by applicable regulations, or consent where required
Operation of the Partner Widget and performance of an audit or service requested through a partner website	Steps taken prior to entering into a contract, performance of the requested service and/or legitimate interest
Identification of the partner responsible for a visit or registration	Legitimate interest
Attribution of a registration or subscription to a partner and management of related commissions or benefits	Legitimate interest and performance of contractual relationships with the partner
Sharing with the referring partner of data strictly necessary for attribution	Legitimate interest
Improvement of the Service	Legitimate interest
Aggregated/anonymised statistics	Legitimate interest

3.1 Emails, Reports and Marketing Communications

When a user creates a Leadmia account, they may receive different types of communications:

• emails required for the operation of the account or Service;
• notifications relating to their business or use of Leadmia;
• reports, including periodic or weekly reports relating to their business, performance or use of Leadmia;
• usage tips and recommendations;
• commercial or marketing communications relating to Leadmia features, services, offers, promotions and new developments.

For professional users, where applicable regulations allow commercial prospecting on the basis of legitimate interest, marketing communications may be enabled by default when the account is created.

Users remain in control of their communication preferences at all times. They may enable or disable the relevant categories of communications at any time from the settings or preferences section of their Leadmia account and/or use the unsubscribe link provided in commercial communications.

Disabling marketing communications has no impact on the user’s ability to use Leadmia.

Certain emails strictly necessary for account operation, security, billing, performance of the Service or subscription management may nevertheless continue to be sent where their delivery is necessary.

Where applicable regulations require prior consent for a particular communication, the fact that marketing communications are enabled by default does not constitute consent and no such communication will be sent unless the applicable legal requirements have been met.

4. Recipients – Processors and Partners

Data may be processed by the following processors and service providers, depending on use:

• Stripe (payment processing)
• Axonaut (billing)
• OpenAI (AI generation)
• Google (Google Business Profile API)
• Hosting provider: o2switch (France)

As part of the Leadmia partner system, certain data may also be disclosed to the partner identified as having referred the user’s registration or subscription, solely to the extent necessary to attribute the referral and manage the partnership, in accordance with Section 2.8 of this Privacy Policy.

Data provided to the partner is limited to information necessary for this purpose.

Leadmia does not sell personal data to third parties.

The disclosure of data to a partner solely for the purpose of attributing a registration or managing the partnership does not constitute a sale of data.

5. Transfers Outside the EU

Certain service providers may process data outside the European Union, particularly in the United States.

Where this occurs, appropriate safeguards are implemented, including Standard Contractual Clauses (SCCs) and/or recognised transfer mechanisms such as the Data Privacy Framework where a service provider is certified under that framework (e.g. Google/Stripe according to their published information).

6. Data Retention Periods

Data	Retention Period
Active user account	For the entire lifetime of the account
Account data and Service-related data following account deletion	90 days from the date of account deletion, in particular to allow recovery, security measures or processing of any pending operations, after which the data is deleted or anonymised, unless a legal obligation or specific retention requirement applies
Partner attribution data	For the period necessary for attribution and management of the partnership, followed by archiving or deletion in accordance with applicable contractual, accounting or legal obligations
Data used for commercial prospecting	For the duration of the commercial relationship or use of the Service and, where applicable and necessary, within the retention periods permitted by applicable regulations
Data required to manage objections to commercial prospecting	Retained on a suppression list for as long as necessary to comply with the objection and, in accordance with CNIL recommendations, for at least 3 years
Data required for evidence/dispute management	Until expiry of the applicable limitation periods
Invoices and accounting records required to be retained	10 years (legal obligation)
Logs / standard logging data	Up to 1 year unless specifically required otherwise (CNIL)

Deleting an account therefore does not necessarily result in the immediate deletion of all data. Operational data associated with the account is retained for a maximum period of 90 days following deletion, after which it is deleted or anonymised.

Certain data may be retained beyond this period where required by law, where necessary for the establishment, exercise or defence of legal claims, for the retention of accounting records or in order to permanently respect an objection to commercial prospecting.

7. Data Subject Rights

In accordance with the GDPR, you have the following rights: access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent where processing is based on consent.

In particular, you have the right to object at any time and free of charge to the use of your personal data for commercial prospecting purposes.

• To exercise your rights: support@leadmia.com
• Response time: 1 month (which may be extended depending on the complexity of the request).

You may also manage certain communication preferences directly from your Leadmia account.

You may also lodge a complaint with the CNIL, the French data protection authority.

8. Cookies and Tracking Technologies

Leadmia uses cookies/tracking technologies:

• necessary for the operation of the Service (exempt from consent);
• and, where applicable, audience measurement and marketing cookies subject to consent.

Examples (depending on configuration):

Cookie/Tool	Purpose	Duration	Consent
Leadmia Session	Authentication, security and maintenance of the user’s session	Session	Exempt
CookieHub (cookiehub)	Storage of cookie consent preferences	1 year	Exempt
Leadmia – Attribution (lm_attr)	Storage of the origin of the visit or registration, identification of the partner responsible for the referral and attribution measurement	90 days	CMP (CookieHub)
Polylang (pll_language)	Storage of the user’s selected language	1 year	Exempt
Stripe	Secure payment processing and fraud prevention	Session	Exempt where strictly necessary for payment processing
Google Tag Manager	Management and triggering of tags used on the website	No proprietary cookie	Tags triggered through Google Tag Manager are subject to the preferences stored in CookieHub
Google Analytics (_ga, _ga_*)	Audience measurement, traffic statistics and analysis of website usage	400 days	CMP (CookieHub)
Microsoft Clarity and Bing Analytics (_clck, _clsk, _cltk, MUID, MR, SM)	User experience analysis, session recording, browsing statistics and audience measurement	_clck: 1 year _clsk: 1 day _cltk: session MUID: 390 days MR: 7 days SM: session	CMP (CookieHub)
Microsoft Advertising / Bing (SRM_B, ANONCHK)	Advertising performance measurement, campaign attribution and advertising personalisation	SRM_B: 390 days ANONCHK: 1 hour	CMP (CookieHub)
Meta Pixel (_fbp, lastExternalReferrer, lastExternalReferrerTime)	Conversion measurement, campaign attribution, storage of visitor source and advertising personalisation	_fbp: 90 days lastExternalReferrer: persistent lastExternalReferrerTime: persistent	CMP (CookieHub)
Google Ads	Conversion measurement and advertising campaign performance	90 days	CMP (CookieHub)

The consent management platform (CMP CookieHub) allows users to accept or refuse cookies and modify their preferences.

Where a Partner Widget is integrated into a third-party website, the partner website may also use its own cookies and tracking technologies. These fall under the responsibility of the partner website and are subject to its own privacy policy and consent management procedures.

Where the Partner Widget uses Leadmia technologies to identify the partner responsible for a visit or registration, these technologies are used in accordance with the rules described in this Privacy Policy and the applicable consent preferences.

9. Security

Measures implemented, depending on the architecture, include:

• HTTPS/TLS
• Access controls and the principle of least privilege
• Regular backups
• Encryption/secure storage of OAuth tokens, where applicable
• Limiting partner access to data strictly necessary for attribution and partnership management

10. Personal Data Breaches

In the event of a personal data breach likely to present a risk, Leadmia will notify the CNIL within the applicable statutory time limits and, where required, notify the affected individuals.

11. Minors

Leadmia is intended for professionals and is not designed to be used by persons under the age of 18.

12. Changes to this Policy

In the event of a substantial change to this Privacy Policy, a notification may be sent by email and/or displayed within the application. The date of the latest update is displayed above.

13. Contact

For any questions: hello@leadmia.com