IQLeadIQ

Privacy & sub-processors

Version 2026-06-07 · EU-Frankfurt residency · questions? privacy@leadiq.center

The short version

No lead PII stored. Deal and contact data is fetched live from your monday.com via OAuth and is never persisted.
EU data residency. Database in Supabase Frankfurt, hosting on Vercel EU.
No scraping. The leads engine works on lists you upload yourself — in your browser session only, never in our database.
You keep ownership. One click to export everything or delete it permanently via Settings.

What data do we process?

Category	Examples	Retention
Account metadata	workspace name, primary contact email, trial and plan status	Until a deletion request, with 30-day backup retention
Sales rep records	name, email, gross salary, employer burden, earn-back multiple — visible to the manager only	Until deactivation or account deletion
Column mapping & ICP rules	which monday.com column maps to which LeadIQ field, ICP criteria	Until a deletion request
Activity and audit logs	who performed which write action and when — metadata only, no lead PII	180 days, then deleted automatically
Uploaded lead lists (Leads engine)	CSV rows stay in your browser session	NOT stored — they only exist during the wizard session
CRM data from monday.com	deals, contacts, etc.	NOT stored — fetched live via OAuth on every request

Sub-processors

These are all external processors that touch data living in LeadIQ. We never add one without updating this page — subscribe to the change history if you want notifications.

Sub-processor	Purpose	Region	Transfer	DPA
Supabase Inc.	Database, authentication, file storage	EU (Frankfurt — eu-central-1)	None — EU residency	link →
Vercel Inc.	Hosting, edge & functions	EU (Frankfurt — primary)	Standard Contractual Clauses (modules 2 & 3)	link →
monday.com Ltd.	CRM data is fetched live via OAuth — LeadIQ never stores lead data	Customer choice (Monday hosting)	The OAuth token stays yours; processing is governed by your own monday.com agreement	link →
Stripe Payments Europe Ltd.	Subscriptions & invoicing (only active on a paid plan)	Ireland (EU)	None — processing within the EU	link →
Resend (Userify Inc.)	Transactional email (magic links + invites) — only active when SMTP is configured	EU (Frankfurt)	Standard Contractual Clauses	link →

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, data portability and objection. For most of these you can act directly in the app:

Access / data portability: Settings → Privacy & data → Download my data produces a JSON export.
Rectification: all account, rep and mapping data can be edited directly in the UI.
Erasure: Settings → Privacy & data → Delete account wipes everything permanently (with 30-day backup retention).
Questions or complaints: privacy@leadiq.center — we respond within 30 days.

Data Processing Agreement (DPA)

We act as a processor for you as the controller whenever LeadIQ processes monday.com data on your behalf. For customers who want a signed DPA: the standard template (based on the EU SCCs, module 2) is available at /dpa. A signed copy is required before a trial account is migrated to a paid subscription.