Privacy Policy

Last updated: February 5, 2026

GlobalLeadSuite ("we", "us", "our") operates the GlobalLeadSuite platform (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use our Service, and the choices you have associated with that data.

1. Information we collect

Account data

When you sign in with Google via Emergent Auth, we receive: your email address, display name, and profile picture. We store these under your user record for authentication and personalisation.

Product data

Everything you create inside the platform (leads, campaigns, templates, custom modules, worlds, blog posts if admin) is stored under your user id. This data belongs to you and is exportable/deletable at any time from Settings → Data.

Payment data

Payments are processed by Stripe. We store only a Stripe customer id and subscription reference — never card numbers, CVV or expiry dates. Please refer to Stripe's privacy policy for details on how they handle payment data.

Usage data

We record aggregate usage events (which module you ran, when a campaign was launched, credit consumption per hour) to enforce plan limits, prevent abuse and improve the product. IPs and User-Agents are hashed on write for GDPR minimisation.

2. How we use your data

To authenticate you and let you access the Service.
To process your subscription and credit-pack purchases.
To enforce hourly credit caps, brute-force protection, and abuse limits.
To generate personalized in-app AI responses (via OpenAI, EU-hosted or region-compliant endpoints where available).
To send transactional emails (login, receipts, subscription renewal, GDPR export ready notification). Marketing emails are opt-in and off by default.

3. Legal basis (GDPR Art. 6)

We rely on the following legal bases:

Contract (Art. 6.1.b): to provide the Service you subscribed to.
Legitimate interest (Art. 6.1.f): security, anti-abuse, service integrity.
Consent (Art. 6.1.a): analytics/marketing cookies, marketing emails — always opt-in.
Legal obligation (Art. 6.1.c): tax and accounting records.

4. Data sharing

We share data only with these categories of processors, each bound by DPAs:

Stripe (payment processing)
OpenAI / Emergent LLM proxy (AI text generation for chat, blog drafts, module runs)
Resend (transactional email, when configured)
Emergent hosting infrastructure (Cloudflare, Kubernetes)

We never sell your data. We never share it with third parties for their own marketing purposes.

5. Retention

Active user data: retained for the lifetime of your account.
Session tokens: 7 days from creation, refreshed on activity.
Reputation events / audit trails: 90 days rolling.
Deleted account audit record: retained indefinitely with SHA-256 hashed email only (no reversible PII).

6. Your rights

Under GDPR you have the right to: access, rectification, erasure, portability, restriction of processing, objection, and withdrawal of consent. Exercise all of these from Settings → Data in one click:

Export: request a ZIP of every record we hold under your user id.
Delete: hard-delete your account and cascade-remove all associated records. This action is instantaneous and irreversible.

For any other request, contact us at the email below.

7. International transfers

If you are based in the EEA or UK, your data may be processed by our subprocessors on infrastructure located outside the EEA. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

8. Security

We enforce: HTTPS everywhere, HttpOnly SameSite=None cookies for sessions, rate limits on auth endpoints, hashed IP storage, and defence-in-depth suspension on low-reputation accounts. In case of a breach affecting your data, we will notify you within 72 hours per Art. 33 GDPR.

9. Contact

Support: support@globalleadsuite.example (placeholder — replace before commercial launch) DPO / Privacy inquiries: privacy@globalleadsuite.example

10. Changes

We may update this policy from time to time. Material changes will be communicated via in-app notification and email at least 30 days before taking effect.