Leadalise

Privacy Policy

Privacy Policy

Last updated: 21 July 2026

This Privacy Policy explains how Yertay Kemelbekov, an individual trading as "Leadalise," based in Almaty, Republic of Kazakhstan ("Leadalise," "we," "us"), collects, uses, and protects personal data in connection with the Leadalise platform (the "Service"). It applies to (1) Customers who register for and use the Service, and (2) individuals whose business contact data is processed through the Service on behalf of our Customers.

We aim to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and applicable US state privacy laws, in addition to relevant data protection law in the UAE, for the markets we serve.

1. Two Roles We Play

As a data controller — for account, billing, and usage data of our Customers (the businesses who subscribe to Leadalise).

As a data processor — for business contact data (names, job titles, business email addresses, company affiliations, and inferred buying signals) that our Customers collect and process through the Service about third parties (e.g., prospects at target companies). In this capacity, we act on our Customers' instructions, as described in our Data Processing Agreement ("DPA"), available on request.

2. What We Collect

2.1 From Customers (account holders)

  • Account and profile data: name, business email, company, role.
  • Billing data: handled by Paddle.com Market Limited, our Merchant of Record. We receive limited billing metadata (e.g., plan tier, subscription status) but Paddle — not Leadalise — processes and stores full payment card and tax details. See Paddle's Privacy Policy.
  • Usage data: features used, searches performed, ICP criteria configured, log and device data, cookies (see Section 7).
  • Content you provide: CRM data you import, competitor lists, feedback you submit.

2.2 About third-party business contacts (processed on behalf of Customers)

  • Business-context data sourced from licensed third-party data providers and publicly available sources: company firmographics, publicly listed job changes, company news, technology usage signals, and similar business signals.
  • Business contact details (name, business email, job title, employer) where lawfully available through licensed sources, used to support Customers' B2B sales and prospecting.
  • We do not knowingly collect sensitive personal data (e.g., health, religion, sexual orientation) about individuals, and our signal set is limited to business/professional context.

3. Sources of Data

We obtain business and contact data from:

  • Licensed third-party data providers under contract (e.g., business data enrichment APIs);
  • Publicly available sources such as company job boards, press releases, and public regulatory filings;
  • Data our Customers directly upload or connect (e.g., their CRM).

We do not source personal data through scraping of platforms whose terms of service prohibit automated collection, and we do not collect data from professional social networks in a manner inconsistent with their terms or applicable law.

4. How We Use Data

  • To provide the Service: account scoring, signal monitoring, and report generation for our Customers.
  • To operate and secure the Service, including fraud prevention and abuse monitoring.
  • To communicate with Customers about their account, billing (via Paddle), and material changes to the Service.
  • To improve the Service, including calibrating scoring models, using aggregated or de-identified usage data where feasible.
  • To comply with legal obligations.

We do not sell personal data, and we do not use business contact data processed on behalf of Customers for our own independent marketing purposes.

5. Legal Bases (GDPR/UK GDPR)

  • Contract — to provide the Service to Customers.
  • Legitimate interests — for Customers' and our legitimate interest in B2B sales and marketing activity based on business-context data, balanced against individual rights (data subjects can object — see Section 8).
  • Legal obligation — for tax, accounting, and regulatory compliance.
  • Consent — where required by local law for specific processing (e.g., certain direct-marketing communications), obtained by the Customer as the sender of any communications.

Customers are responsible for ensuring they have an appropriate legal basis for contacting individuals under the laws applicable to those individuals.

6. Data Sharing

We share personal data with:

  • Paddle.com Market Limited — as Merchant of Record for billing, tax, and payment processing.
  • Sub-processors providing infrastructure under contractual data protection terms consistent with GDPR Article 28. These include a cloud hosting and database provider (Amazon Web Services), a workflow-automation service, a transactional email provider, and AI model providers used to generate reports. A current list of sub-processors, including their processing locations, is available on request.
  • Licensed data providers — as sources of business data, not as recipients of Customer data (data flows inbound from these providers).
  • Authorities, where required by law.

We do not share personal data with data brokers or use it for purposes unrelated to operating the Service.

7. Cookies

We use only essential cookies strictly necessary to operate the Service — for authentication and session management. We do not use advertising or third-party analytics cookies, and we do not track your activity across other websites. Because we use only essential cookies, no consent banner is required; you can still block or delete cookies via your browser settings, though this may affect core functionality.

8. Data Subject Rights

Individuals whose business contact data is processed through the Service (e.g., a prospect contacted by one of our Customers) have rights under GDPR/UK GDPR and similar laws, including the right to access, correct, delete, restrict, or object to processing of their personal data, and the right to lodge a complaint with a supervisory authority.

To exercise these rights, contact support@leadalise.com. Because Leadalise typically acts as a processor for contact data, we may direct your request to the relevant Customer (data controller) or assist them in responding, consistent with our DPA.

US residents in states with comprehensive privacy laws (e.g., California, Colorado, Virginia) have similar rights under applicable state law; contact us to exercise them.

9. Data Retention

  • Customer account data is retained for the duration of the subscription and a limited period afterward for legal, accounting, and dispute-resolution purposes.
  • Business signal and contact data is retained according to configurable retention settings and applicable age-cutoff rules built into the platform's scoring logic; stale signals are automatically deprioritized and periodically purged.
  • We delete or anonymize personal data when it is no longer necessary for the purposes described in this Policy, unless a longer retention period is required by law.

10. International Transfers

Leadalise is operated from the Republic of Kazakhstan, and personal data may be processed on cloud infrastructure located outside the European Economic Area (EEA) and the United Kingdom.

Where personal data of individuals in the EEA or UK is transferred outside those areas, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with the data-protection terms in our infrastructure providers' data processing agreements. Details of the safeguards applied are available on request.

11. Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and restricted access to production data. The Service is hosted on Amazon Web Services infrastructure, which maintains industry-recognized security certifications. No system is completely secure, and we cannot guarantee absolute security.

12. Children's Data

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal data from individuals under 16.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email or in-app notice. The "Last updated" date reflects the most recent revision.

14. Contact

Data protection inquiries: support@leadalise.com Operator: Yertay Kemelbekov, an individual trading as Leadalise Location: Almaty, Republic of Kazakhstan

The operator is established outside the EEA and the UK. Individuals in the EEA or UK with data protection concerns may contact us at the address above, and we will respond in accordance with applicable law.