Privacy Policy and Data Processing
This policy explains how ProleadSync collects, uses, stores, shares and protects personal data in connection with the website, the application, the affiliate area and related features. Processing is carried out in accordance with Regulation (EU) 2016/679, applicable Portuguese law and the principles of lawfulness, transparency, minimisation and security.
1. Data controller
The data controller is Rodrigo dos Santos Silvano, Portuguese tax number 275096688, with address at Rua Quinta do Pincho Lote B8 R/C Direito, 6300-420 Guarda, Portugal.
For privacy requests, rights requests, objections to the processing of public profiles or questions about this policy, you should contact ajuda@proleadsync.com with the subject line Privacy, or use +351 935 655 950.
2. What data we process and why
| Category | Examples | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account and identity | name, email, language, hashed password, session identifiers, accepted legal versions | create and manage the account, authenticate access, record consents and provide support | performance of the contract and legal obligation | while the account is active and up to 12 months after closure, unless a longer legal duty applies |
| Billing and payments | tax number, billing name, billing address, plan history, charges, invoices, Stripe identifiers | charging, invoicing, contractual proof, fraud prevention and accounting and tax compliance | performance of the contract and legal obligation | up to 10 years where required by tax and accounting law |
| Service usage | searches, analyses, reports, generated files, history, tickets, preferences and automations | provide the contracted features, maintain history, enable exports and manage the account | performance of the contract | while the account is active and until deletion or expiry of internal routines |
| Security and technical logs | IP address, user agent, session logs, anti-fraud metrics, error and audit events | security, abuse prevention, platform integrity and technical diagnostics | legitimate interest | typically up to 12 months, unless longer retention is required to defend legal claims |
| Optional integrations | OAuth tokens, minimum Google Calendar data, Telegram chat ID and, for the Instagram connection, encrypted access tokens, account identifiers and the messages received and sent | scheduling, notifications, operational communication, preference management, and the Instagram message Inbox and automations | performance of the contract or consent, depending on the integration | until you remove the integration or there is no longer a legitimate retention purpose; when you disconnect Instagram, we remove the conversations and data of that connection |
| Marketing and optional cookies | consent state, analytics and attribution cookies, campaign and affiliate events | campaign measurement, affiliate management and commercial improvement of the website | consent | until you withdraw consent or the relevant technology expires |
3. Third-party public profiles and data source
ProleadSync also processes data from public profiles and content made public by their owners on social networks, mainly Instagram and Threads, when a platform user researches or analyses those profiles.
- Source of data: publicly accessible information on the originating platforms.
- Types of data: username, public name, profile picture, biography, category, public links, visible metrics, public posts, public comments and contextual signals extracted from those sources.
- Purpose: enabling the user to research, qualify and organise potential commercial contacts.
- Legal basis: legitimate interest in providing the service to the customer and processing data manifestly made public by the relevant data subject, without prejudice to the right to object.
In this context, ProleadSync generally acts as processor for the user who decides to research, enrich and use those data in their commercial workflow. If you are the owner of a public profile and wish to object to indexing or request removal, you may contact us through the channels above.
If you connect your professional Instagram account, ProleadSync also processes the messages you receive and send on that account, including images and files, and the data of the people who message or comment on it, such as username, identifier, text and attachments. We use them to show the conversations in the Inbox, run the automations you configure and send the replies you write or approve, on your instructions and as processor. You are responsible for informing those people and for having a legal basis and, where needed, consent to contact them.
4. Who we share data with
We only share data when necessary to operate ProleadSync, comply with legal duties or answer your requests. The main recipient categories are:
- hosting, infrastructure and storage providers;
- Stripe, for payments, subscriptions and billing events;
- Resend (Plus Five Five, Inc.), ProleadSync's processor for email delivery: transactional, security and support emails and communications to those who agreed to receive them. It processes the email address, the name where it appears in the message, the content of the email and delivery metadata such as status and bounces. Preference management and unsubscribing from promotional emails remain available in your account and through the unsubscribe link in each of those emails;
- Meta (Instagram), when you connect your professional account: we receive the messages and comments of that account and send the messages and replies you write, approve or automate;
- Google, when you connect calendar integrations;
- Telegram, when you enable notifications on that channel;
- OpenAI, Anthropic and OpenRouter, when you request analyses or AI-assisted features that require the necessary processing context, which may include messages from a conversation when you ask Sync or the AI to help you reply. Each request is processed by the AI provider ProleadSync has active at that moment, which may be either one;
- administrative, judicial, tax or regulatory authorities where required by law.
ProleadSync does not sell personal data sets to third parties.
5. International transfers
Some suppliers used by ProleadSync may process data outside the European Economic Area, including in the United States. In those cases, we seek to use appropriate legal mechanisms such as Standard Contractual Clauses approved by the European Commission, adequacy decisions or supplementary measures compatible with the GDPR.
This is the case for Resend. Emails are routed and sent from the European Union (Ireland), but Resend is a US company: it keeps delivery logs and metadata in the United States and may access and process in the United States the data we entrust to it. Resend's sub-processors are also in the United States. There is therefore an international transfer to the United States, which relies on Resend's certification under the EU-US Data Privacy Framework, recognised by the European Commission through an adequacy decision, and, as an additional safeguard, on the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) included in Resend's data processing agreement. That agreement takes effect when ProleadSync accepts the provider's terms. You may request more information about these safeguards at ajuda@proleadsync.com.
The same applies to Anthropic when it is the active AI provider. The contracting entity is Anthropic Ireland, Limited, which acts as ProleadSync's processor and only processes this data to provide the service and in accordance with our instructions. The context we send it to answer your request, such as the text and data needed for the requested analysis or feature, and the responses generated are stored in the United States. To ensure the availability of the service, each request may be processed in data centres in the United States, Europe, Asia or Australia, by sub-processors, including entities of the Anthropic group and cloud infrastructure providers. By default, Anthropic automatically deletes those requests and responses from its systems within 30 days of receiving or generating them, unless the law requires longer retention or it is needed to enforce its usage policies. Anthropic's commercial terms do not allow it to train models on the data ProleadSync sends it through the service. These transfers outside the European Economic Area rely on the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) included in Anthropic's data processing addendum, which forms part of its commercial terms. For its API, Anthropic maintains independent security certifications, such as ISO/IEC 27001 and SOC 2 Type 2. You can request more information about these safeguards at privacy@proleadsync.com.
6. Retention and deletion
Account and functional history data are kept while the account is active and for the period needed for support, security, contractual proof and defence of rights. When you request deletion of the account, ProleadSync removes or anonymises operational data that are no longer required, including account history, integrations and associated content, without prejudice to data that must be retained by law, in particular invoices and accounting records.
7. Data subject rights
You have the right of access, rectification, erasure, restriction, objection, portability and withdrawal of consent where processing depends on consent. You also have the right to lodge a complaint with the Portuguese supervisory authority CNPD.
Requests may be sent to ajuda@proleadsync.com. ProleadSync may ask for reasonable additional information to confirm identity before fulfilling the request.
8. Cookies and communications
The public website uses strictly necessary cookies and, where authorised by you, optional analytics, marketing and attribution technologies, including integrations with Google Tag Manager and Meta. You may manage those preferences at any time through the cookie manager. Additional information is available in the Cookie Policy.
9. Suspension and erasure without an active plan
Accounts covered by the move to paid plans are suspended after the communicated deadline and kept for a 7-day recovery period. Without activation, operational account data, content, contacts, automations, integrations, files and personal profile are erased. ProleadSync retains only tax documents and records strictly required to meet legal duties, normally for 10 calendar years, isolated and with restricted access. The irreversible identifier used to prevent abusive trial reuse may be retained under the legitimate interest of fraud prevention.