Privacy Policy

This policy explains what 8Leads collects, why, and what you can do about it. It covers the 8Leads website and the outbound automation platform (the Service). We keep it plain on purpose.

1. Who we are

The Service is operated by Burhani Tech Pte. Ltd. (UEN 202339391K), a company incorporated in Singapore with its registered office at 20A Tanjong Pagar Road, Singapore 088443. For the account and marketing data described here, 8Leads is the data controller. For the lead data you upload and process through the Service, you are the controller and 8Leads is your processor; those terms are set out in our Data Processing Addendum.

2. Information we collect

• Account information. Your name, email, workspace details, and role, so you can sign in and we can support you.
• Connected-account data. The credentials and session needed to send from your Instagram accounts. Sessions and proxy credentials are encrypted at rest and never stored in plain text.
• Lead data. The prospect lists you import, including any fields your CSV contains. You choose what to upload, and you are responsible for having a lawful basis to process it.
• Message and reply data. The messages you send and the replies you receive through the Service, so we can show your inbox and analytics.
• Usage and device data. Log data, IP address, and basic analytics about how the Service is used, so we can keep it reliable and secure.
• Billing information. Your subscription, invoices, and the country and tax details needed to bill you. Payments are handled by our Merchant of Record, Paddle (see section 5). We never receive or store full card numbers.

3. How we use it

• To provide, maintain, and secure the Service.
• To send transactional email such as sign-in, receipts, and account notices.
• To support you and respond to your requests.
• To detect abuse and protect account safety.
• To meet legal, tax, and accounting obligations.

We do not sell your personal information, and we do not add your contacts to our own marketing lists.

4. Legal bases

Where the GDPR or UK GDPR applies, we rely on contract (to provide the Service you signed up for), legitimate interests (to secure and improve it), consent (where required, for example optional communications), and legal obligation (for tax, accounting, and compliance). Where Singapore’s Personal Data Protection Act (PDPA) applies, we collect, use, and disclose personal data with consent or as otherwise permitted by law.

5. Sharing and subprocessors

We share data with the vendors that run the Service, under contract and only as needed. These include our cloud database and hosting providers, our queue and worker infrastructure, our payment provider and Merchant of Record, Paddle.com Market Limited (which processes payments, issues invoices, and handles sales tax on our behalf), and our email provider. The categories of these providers are listed in the Data Processing Addendum. We also disclose data where the law requires it.

6. Retention

We keep account and workspace data while your account is active. When you delete data or close your account, we remove it within a reasonable period, except where we must keep records for legal, tax, or accounting reasons. You can export or delete your lead data at any time.

7. Security

We encrypt data in transit and at rest, isolate connected-account sessions with AES-256-GCM, and apply least-privilege access controls with audit logging. Read more on our Security page.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise a right, email nurudin [at] dataleads [dot] io. You also have the right to complain to your local data protection authority (in Singapore, the Personal Data Protection Commission).

9. International transfers

We operate from Singapore and our infrastructure is primarily in the United States. Where we transfer personal data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses and comparable protections for transfers out of the EEA, the UK, or Singapore.

10. Cookies

We use essential cookies to keep you signed in and privacy-respecting analytics to understand usage. We do not use third-party advertising cookies. Our checkout provider, Paddle, may set cookies necessary to process your payment.

11. Children

The Service is for business use and is not directed to anyone under 16.

12. Changes

We update this policy as the Service changes. When we make a material change, we will update the date above and, where appropriate, notify you.

13. Contact

Questions about privacy go to nurudin [at] dataleads [dot] io.

Burhani Tech Pte. Ltd. · UEN 202339391K · 20A Tanjong Pagar Road, Singapore 088443.