How we handle your personal data
Who we are
The controller of your personal data is Leadgram SRL (CUI 54572982), Bucharest, Romania. We run a short-form content distribution service for businesses and creators, and this website.
For anything related to this policy or your data, write to [email protected]. We have not appointed a Data Protection Officer because the law does not require one for our activities; the same address reaches the person responsible for data protection.
What this policy covers
This policy covers personal data we process when you visit this website, send us a brief, book a call, email us, or become a client.
It does not cover the content you send us for a campaign (videos, audio, people who appear in them). We process that on your behalf under our Terms of Service and, where needed, a data processing agreement.
Data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Brief form | Name, company, work email, content types, links to your content, niche, budget range, region, optional message, your consent and the time you sent it | You |
| Campaign source | UTM parameters, the referring page and the page you sent the brief from | Your browser, sent with the brief |
| Security data | IP address and browser user agent, used for rate limiting and spam checks | Your browser |
| Analytics (only with consent) | Pages viewed, clicks on buttons, calculator use, form submission events, device type and approximate country | Your browser, via our analytics providers |
| Correspondence and calls | Emails, call bookings and notes from calls | You and our scheduling tool |
| Client data | Billing contact, company details, VAT number, invoices and payments | You, when you become a client |
We do not ask for special categories of data (such as health or political opinions) and ask you not to include them in the brief.
Why we use it and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your brief, preparing a plan, forecast and proposal | Steps taken at your request before entering into a contract — Art. 6(1)(b) |
| Running campaigns, reporting and billing for clients | Performance of a contract — Art. 6(1)(b) |
| Keeping accounting and tax records | Legal obligation — Art. 6(1)(c) |
| Protecting the site and the form from spam and abuse (honeypot field, rate limits, optional bot check) | Legitimate interest in keeping our systems secure — Art. 6(1)(f) |
| Measuring how the site is used and which pages bring briefs | Your consent — Art. 6(1)(a), which you can withdraw at any time |
| Occasional follow-ups about our service to business contacts who sent a brief | Legitimate interest — Art. 6(1)(f); you can object at any time and we stop |
| Establishing, exercising or defending legal claims | Legitimate interest — Art. 6(1)(f) |
We do not sell your personal data, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
Who we share it with
We use a small number of service providers (processors) that act on our instructions under written contracts. Depending on how the site is configured at launch, these are:
| Service | Provider | Location |
|---|---|---|
| Website hosting and content delivery | Our hosting provider (to be confirmed at launch) | EU / USA |
| Email delivery of briefs to our team | Resend (Plus Five Five, Inc.) | USA |
| Internal notifications about new briefs | Telegram, or a webhook to our CRM | UAE / EU |
| Privacy-friendly analytics (only with consent) | Plausible Insights OÜ | EU |
| Web analytics (only with consent) | Google Ireland Limited (Google Analytics 4) | EU / USA |
| Bot protection on the form, if enabled | Cloudflare, Inc. (Turnstile) | USA |
| Call scheduling | Cal.com, Inc. | USA |
We may also share data with our accountants and legal advisers, and with public authorities when the law requires it.
International transfers
Some providers above process data outside the European Economic Area, mainly in the United States. When they do, we rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework, for certified providers) or on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), together with additional safeguards where needed.
You can ask for a copy of the relevant safeguards at [email protected].
How long we keep it
| Data | Retention |
|---|---|
| Briefs and correspondence that do not lead to a contract | 24 months after our last contact, then deleted |
| Client contracts, invoices and accounting records | 10 years, as required by Romanian accounting law |
| Other client correspondence and campaign reports | For the contract and 3 years after it ends (general limitation period) |
| Rate-limit and security data | Minutes in memory for rate limiting; server logs up to 30 days |
| Analytics data (with consent) | Up to 14 months in Google Analytics; Plausible keeps only aggregated statistics |
| Your cookie choice | Stored in your browser until you change it or clear site data |
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased, where there is no longer a reason to keep it;
- restrict how we use it while a question is being resolved;
- receive data you gave us in a portable format;
- object to processing based on legitimate interest, including follow-up emails;
- withdraw consent at any time (for analytics, via “Cookie settings” in the footer), without affecting processing before the withdrawal.
Send requests to [email protected]. We reply within one month; for complex requests this can be extended by two more months, and we will tell you why. We may ask you to confirm your identity.
Complaints
If you think we have mishandled your data, please tell us first so we can fix it. You also have the right to complain to a supervisory authority. In Romania this is:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania · [email protected] · https://www.dataprotection.ro
You can also complain to the authority in the EU country where you live or work.
Security
Data is sent over encrypted connections (TLS), access is limited to the people who need it, and we keep only what the brief requires. No system is perfectly secure; if a breach affects you, we will notify you and the authority as the law requires.
Children
Our service is for businesses and professional creators. It is not directed at children under 16 and we do not knowingly collect their data.
Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version; for significant changes we will also tell clients by email.