Privacy Policy
Last updated: [date] · Draft for lawyer review
This policy explains how [Business name], [registered address, Serbia] ("Northlead", "we") handles personal data on this website and in the Northlead app. Contact: privacy@northlead.app.
This website
- No tracking cookies. The website sets no cookies and loads no third-party trackers, fonts or scripts.
- Server logs. Our host, Cloudflare, processes your IP address and browser details for a short time to deliver the site and protect it from attacks.
- Trial requests. When you request a workspace we receive your name, work email, company, workspace name, country and chosen plan. We use them to set up your workspace and contact you (legal basis: steps before a contract, GDPR Art. 6(1)(b)). The request is sent to us by email through Brevo.
- Emails to us. We keep emails as long as needed to answer them and for our business records.
The Northlead app
- Account data of users (name, email, role, login times) to run the service (Art. 6(1)(b)).
- Workspace content such as leads and notes is processed on the Customer's behalf under the Data Processing Agreement. For that data the Customer is the controller.
- Cookies in the app are only those needed to keep you signed in.
- Billing is done by Paddle.com as merchant of record; Paddle is its own controller for payment data.
Who receives data
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | App hosting and backups | EU (Germany or Finland) |
| Cloudflare, Inc. | Website hosting, DNS, email forwarding | Global network, EU-US Data Privacy Framework |
| Sendinblue SAS (Brevo) | Sending service emails | EU (France) |
| Paddle.com Market Ltd | Payments, invoices, VAT | UK / EU |
| AI and data providers you connect | Research you start, under your own account | Depends on the provider |
We are based in Serbia, outside the EU. Where data is transferred to us or our providers outside the EU, we use the EU Standard Contractual Clauses or another lawful transfer mechanism.
How long we keep data
Account and workspace data: for the subscription and 30 days after it ends. Invoices: as long as tax law requires. Trial requests that do not lead to a subscription: 6 months.
Your rights
You can ask for access, correction, deletion, restriction, portability or object to processing by emailing privacy@northlead.app. You can also complain to your data protection authority, or in Serbia to the Commissioner for Information of Public Importance and Personal Data Protection.