Privacy Policy

This policy explains what 8Leads collects, why, and what you can do about it. It covers the 8Leads website and the outbound automation platform (the Service). We keep it plain on purpose.

1. Who we are

8Leads provides software for running Instagram outbound campaigns. For the account and marketing data described here, 8Leads is the data controller. For the lead data you upload and process through the Service, you are the controller and 8Leads is your processor. Those terms are set out in our Data Processing Addendum.

2. Information we collect

• Account information. Your name, email, workspace details, and role, so you can sign in and we can support you.
• Connected-account data. The credentials and session needed to send from your Instagram accounts. Sessions and proxy credentials are encrypted at rest and never stored in plain text.
• Lead data. The prospect lists you import, including any fields your CSV contains. You choose what to upload, and you are responsible for having a lawful basis to process it.
• Message and reply data. The messages you send and the replies you receive through the Service, so we can show your inbox and analytics.
• Usage and device data. Log data, IP address, and basic analytics about how the Service is used, so we can keep it reliable and secure.
• Billing information. Handled by our payment processor. We do not store full card numbers.

3. How we use it

• To provide, maintain, and secure the Service.
• To send transactional email such as sign-in, receipts, and account notices.
• To support you and respond to your requests.
• To detect abuse and protect account safety.
• To meet legal and accounting obligations.

We do not sell your personal information, and we do not add your contacts to our own marketing lists.

4. Legal bases

Where the GDPR or UK GDPR applies, we rely on contract (to provide the Service you signed up for), legitimate interests (to secure and improve it), consent (where required, for example optional communications), and legal obligation (for accounting and compliance).

5. Sharing and subprocessors

We share data with the vendors that run the Service, under contract and only as needed. These include our cloud database and hosting providers, our queue and worker infrastructure, our payment processor, and our email provider. The current list lives in the Data Processing Addendum. We also disclose data where the law requires it.

6. Retention

We keep account and workspace data while your account is active. When you delete data or close your account, we remove it within a reasonable period, except where we must keep records for legal or accounting reasons. You can export or delete your lead data at any time.

7. Security

We encrypt data in transit and at rest, isolate connected-account sessions with AES-256-GCM, and apply least-privilege access controls with audit logging. Read more on our Security page.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise a right, email privacy@8leads.io. You also have the right to complain to your local data protection authority.

9. International transfers

Our infrastructure is primarily in the United States. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Cookies

We use essential cookies to keep you signed in and privacy-respecting analytics to understand usage. We do not use third-party advertising cookies.

11. Children

The Service is for business use and is not directed to anyone under 16.

12. Changes

We update this policy as the Service changes. When we make a material change, we will update the date above and, where appropriate, notify you.

13. Contact

Questions about privacy go to privacy@8leads.io.