Privacy Policy
Last updated: September 26, 2026 · Version 2026-09-26
This policy explains what personal data Keyleads handles, why, for how long, and the choices and rights you have. We keep it as short and specific as we can.
1. Who is responsible
Keyleads is the controller of the personal data described here, except where we process data inside your workspace on your behalf (see our Data Processing Agreement).
Punnawich Vanadilok, trading as Keyleads
43/196 Soi Mu Ban Pho Kaew Soi 1, Thailand
Email: hello@keyleads.app
We have not appointed a representative in the EU or UK or a data protection officer. Contact us at hello@keyleads.app for any privacy question or request.
2. Whose data this covers
- Users: people who sign up for Keyleads or are invited to a workspace.
- Waitlist members: people who join the waitlist before launch.
- Visitors: people who browse keyleads.app.
- People whose public posts we index: authors of public posts on supported platforms that match a customer's tracked terms. Our notice for post authors explains this in detail, including how to have your posts removed.
3. What we collect
| Group | What we collect | Where it comes from |
|---|---|---|
| Users | Name, email address, Google account ID if you use Google sign-in, workspace name and website (during setup we read your website's homepage text and send it to our AI provider, Anthropic, to suggest a description and search terms), product description, tracked terms, lead statuses, notes and replies you write, team roles, notification settings (Telegram chat ID, push endpoint, quiet hours), sign-in and security logs, consent records, and how you heard about us. | You, your teammates, Google (if you choose Google sign-in) |
| Paying customers | Billing name, email, address, tax ID, plan, invoices and the last four digits and type of your card. Stripe holds the full card details; we never see them. | You, Stripe |
| Waitlist members | Email address, how you heard about us, the link that brought you (utm tags, referrer), whether you asked for product updates, and when you unsubscribed. | You, your browser |
| Visitors | IP address and request logs (hosting). With your consent: the link that first brought you (utm tags, referrer, landing page) and product analytics events. | Your browser |
| Post authors | Platform, community (such as the subreddit), public handle, public headline where the platform shows one (such as LinkedIn), post URL, title, body and date, plus the AI buying-intent score and a one-line reason for it. | The public platform where you posted |
We do not collect private messages, follower lists, or any special category data on purpose.
4. Why we use it (legal bases)
- To provide Keyleads under our contract with you (contract): accounts, workspaces, collection, scoring, alerts, support and service emails.
- Legitimate interests: indexing public posts that match customers' tracked terms so businesses can find people publicly asking for a product like theirs (business-to-business prospecting); keeping Keyleads secure and preventing abuse; improving the product from aggregate usage, including cookie-less product events our servers send to PostHog (a pseudonymous account and workspace ID, your email domain, plan and the action taken, never post or lead content); and handling disputes. We have written a legitimate interests assessment for indexing public posts and keep it on file. You can object at any time (see section 9).
- Consent: analytics cookies in your browser (PostHog) and the attribution cookie, and waitlist update emails. You can withdraw consent at any time with Cookie settings in the footer or the unsubscribe link in any email.
- Legal obligation: billing, tax and accounting records, and responding to lawful requests.
We do not make decisions that have legal or similarly significant effects on anyone based solely on automated processing. An AI score only decides which posts a customer sees first.
7. International transfers
Keyleads is established in Thailand. Our service providers process data in the locations listed on the Subprocessors page, which include the United States and the European Union. When we transfer personal data from the EU or UK to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, with additional safeguards where needed. Ask us at hello@keyleads.app for a copy.
8. How long we keep it
| Data | How long |
|---|---|
| Leads on the Free plan | 7 days from when the lead was found, then deleted |
| Leads on the Starter plan | 90 days from when the lead was found, then deleted |
| Leads on the Pro plan | 365 days from when the lead was found, then deleted |
| Indexed posts that did not become a lead | 7 days, then deleted |
| Account and workspace data | Until you delete your account or the workspace |
| Team invites | 30 days after they are sent, then they expire and are deleted; an accepted invite is deleted 30 days after it is accepted |
| Waitlist entries | Until you unsubscribe, plus 90 days, then deleted |
| Post-author opt-out requests | The platform and handle (and the email and reason, if you gave them). The opt-out record itself is kept so we can keep honouring it |
| Billing records and invoices | Up to 7 years after the transaction, where tax and accounting law requires |
| Payment event logs and AI usage logs | 180 days, then deleted |
| Deletion records | A minimal record that an account or workspace was deleted (ID, date, who asked) so we can prove it, kept while needed for legal claims |
Leads follow the workspace's current plan: if a workspace moves to a plan with shorter retention, leads older than the new period are deleted. Deleting a lead also deletes its notes, events and suggested replies.
9. Your rights
Everyone
You can see and download your personal data, and delete your account, in Settings → Account. For anything else, email hello@keyleads.app. We respond within 30 days; if the law allows us more time for a complex request, we will tell you why. We may ask you to confirm your identity. You can use an authorised agent; we will ask for proof that they may act for you.
EU and UK (GDPR and UK GDPR)
You have the right to access, correct and delete your data, to restrict or object to processing (including processing based on legitimate interests, such as indexing public posts), to data portability, and to withdraw consent at any time without affecting earlier processing.
California (CCPA/CPRA)
You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but we honour Global Privacy Control signals anyway. We will not discriminate against you for using these rights.
Notice at collection
We collect the categories of personal information in section 3: identifiers (name, email, handle, IP address), commercial information (plan and billing records), internet activity (product analytics: in your browser with consent, and cookie-less server events for accounts), and professional information that authors make public (headline, public posts). We use them for the purposes in section 4 and keep them for the periods in section 8. We do not sell or share personal information, and we do not use or disclose sensitive personal information.
Thailand (PDPA)
You have the right to access and obtain a copy of your data, to data portability, to object, to erasure, to restriction, to correction, and to withdraw consent, and to complain to the Personal Data Protection Committee.
10. Security
Data is encrypted in transit. Workspace data is isolated by database row-level security, so members only see their own workspaces. Access to production systems is limited to the people who run Keyleads. Card details are handled by Stripe. No system is perfectly secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.
11. Age
Keyleads is for people aged 18 or over using it for business. We do not knowingly collect data from anyone under 18. If you believe we have, email hello@keyleads.app and we will delete it.
12. Changes
When we change this policy we update the date at the top. For material changes we email account holders at least 14 days in advance and ask signed-in users to review the new version.
13. Complaints
Please contact us first at hello@keyleads.app and we will try to help. You can also complain to a data protection authority: in the EU, the supervisory authority where you live or work; in the UK, the Information Commissioner's Office; in Thailand, the Personal Data Protection Committee (PDPC).