Updated on 20 October 2026: the people you find come from a provider of professional profiles and only those you add to a list are kept (sections 3 and 7), the recipients of your data are described by category (6.1), and two sections are added (6.5 and 6.7).
1. Introduction
At FindMyLead, we attach the utmost importance to protecting your personal data. This privacy policy describes how we collect, use, store and protect your information when you use our B2B prospecting platform.
By using our services, you accept the practices described in this policy. If you do not accept these practices, please do not use our services.
Data controller
- Identity: Thibaud Cathala
- Address: 53 RUE YVES LE COZ, 78000 Versailles, France
- Personal data contact: dpo@findmylead.fr
2. Definitions
Personal data
Any information relating to an identified or identifiable natural person (name, email, IP address, etc.).
Processing
Any operation performed on personal data (collection, storage, use, transmission, deletion).
User
Any person who creates an account and uses FindMyLead services.
Saved people
People a user adds to a list, with their professional data (job title, LinkedIn profile, company).
Sub-processor
External provider that processes personal data on our behalf.
3. Data collected
3.1 Data you provide us
| Category | Data | Purpose |
|---|---|---|
| User account | Data: First name, last name, email, password (hashed) | Purpose: Creation and management of your account |
| Profile | Data: Team name, preferences | Purpose: Experience personalization |
| Payment | Data: Credit card information (entered with our payment provider) | Purpose: Subscription processing |
| Communications | Data: Content of emails sent through the platform | Purpose: Email campaigns |
| Support | Data: Messages and attachments | Purpose: Technical assistance |
| Welcome | Data: How you heard of us, your role, your company's size and site | Purpose: To know who uses FindMyLead and how they find us |
| Business introducer request | Data: Identity, contact details and professional information you give us in your request | Purpose: To review your request and answer you |
3.2 Automatically collected data
| Category | Data | Purpose |
|---|---|---|
| Connection | Data: IP address, date/time, browser, device | Purpose: Security and connection logs (French law on digital trust, LCEN) |
| Navigation | Data: Pages visited, actions performed | Purpose: Service improvement |
| Performance | Data: Load times, errors | Purpose: Technical diagnostics |
| Replies received | Data: The text of the reply of a recipient of your campaigns | Purpose: Showing you each reply in FindMyLead |
3.3 People search
When you search for people, FindMyLead queries a provider of professional profiles: it receives your search criteria and returns the matching profiles. We display them without keeping them: only the people you add to a list are saved (section 3.4).
3.4 Saved people
When you add a person to a list, we save the following professional data for your team:
Data collected:
- The person: their identity and professional information
- Their company: public information about the company
- Work email address , looked up on your request for a person in your lists
This data is considered personal data within the meaning of GDPR.
Data source:
Profiles come from a provider of professional profiles, queried when you search. The email address is looked up with the same provider, on your request, for a person in your lists. FindMyLead does not buy or resell contact files. The addresses of campaigns sent before people search arrived came from a public company database and an enrichment provider; they are kept for the durations in section 7 (replies received, 3 years).
Legal basis: Legitimate interest (article 6, paragraph 1, point f of GDPR). Our legitimate interest consists in enabling business connections between companies in a B2B prospecting context, in accordance with the recommendations of the French data protection authority (CNIL) on commercial prospecting. This processing is limited to the professional contact details of people, used exclusively in communications related to their professional activity.
Retention period: A saved person is kept as long as the team that added them exists, even when removed from a list. They are erased when their objection is validated, within 30 days of their request, or when the team is deleted. We then keep only what recognises them (section 7).
4. Legal bases for processing
In accordance with GDPR (article 6), we process your data on the following legal bases:
| Purpose | Legal basis | GDPR reference |
|---|---|---|
| Service execution (account, search, campaigns) | Legal basis: Contract performance | GDPR reference: Art. 6.1.b |
| Payment processing | Legal basis: Contract performance | GDPR reference: Art. 6.1.b |
| Retention of invoices and connection logs | Legal basis: Legal obligation | GDPR reference: Art. 6.1.c |
| Service improvement, audience measurement | Legal basis: Legitimate interest | GDPR reference: Art. 6.1.f |
| Marketing communications (newsletter) | Legal basis: Consent | GDPR reference: Art. 6.1.a |
| Non-essential cookies | Legal basis: Consent | GDPR reference: Art. 6.1.a |
| Identification of professional contacts (B2B prospecting) | Legal basis: Legitimate interest | GDPR reference: Art. 6.1.f |
| Review of a business introducer request | Legal basis: Pre-contractual measures | GDPR reference: Art. 6.1.b |
5. Use of your data
We use your personal data to:
- Provide our services: create and manage your account, perform searches and create campaigns
- Process your payments: manage your subscription with our payment provider
- Communicate with you: transactional emails, customer support
- Improve our services: analyze usage to optimize the experience
- Ensure security: detect fraud, protect our systems
- Identify contacts: search for people and their work email addresses to enable targeted and personalized B2B prospecting
What we do NOT do
- We never sell your personal data
- We do not use your data for automated profiling
- We do not share your lead lists with other users
6. Data sharing
6.1 Recipients
Your data goes to technical providers, bound by contract to protect it. The named list is given to you on simple request at dpo@findmylead.fr.
| Category | Function | Location | Safeguards |
|---|---|---|---|
| Host | Function: Servers and databases | Location: France | Safeguards: Hosted in France, ISO 27001 certified |
| Payment provider | Function: Payment processing | Location: United States | Safeguards: Data Privacy Framework |
| Email sending service | Function: Service emails, sending your campaigns and receiving replies | Location: United States | Safeguards: Data Privacy Framework and Standard Contractual Clauses |
| Provider of professional profiles | Function: Searching for profiles and verifying email addresses | Location: France | Safeguards: Company established in France, hosted in France |
| Artificial intelligence provider | Function: Writing texts and reading received emails | Location: United States | Safeguards: Standard Contractual Clauses, data not used for training |
| Sign in with Google | Function: Authentication, if you choose it | Location: United States | Safeguards: Data Privacy Framework |
| Support chat | Function: Conversations you open with us | Location: European Union | Safeguards: Company established in France, hosted in the European Union |
| FindMyLead's email service | Function: Emails you send us | Location: United States | Safeguards: Data Privacy Framework |
| FindMyLead's internal messaging | Function: Service messages sent to the FindMyLead team | Location: United States | Safeguards: Data Privacy Framework and Standard Contractual Clauses |
| FindMyLead's artificial intelligence assistant | Function: Internal analyses of the service | Location: United States | Safeguards: Standard Contractual Clauses |
| Sales follow-up tool | Function: Following our business exchanges | Location: United States | Safeguards: Data Privacy Framework |
| Logo display | Function: Logos of the companies shown in the application | Location: Switzerland and United States | Safeguards: Adequacy decision (Switzerland), Data Privacy Framework (United States) |
6.2 Transfers outside the European Union
A copy of the safeguards that govern these transfers is given to you on request at dpo@findmylead.fr.
6.3 If your account is linked to a business referrer
We share with that business referrer your identity, your company's and information about your subscription. They process it on our behalf, confidentially.
6.4 Transfer to your HubSpot account
If you connect your HubSpot account, FindMyLead sends to it the professional data of the lists you choose to sync and the emails sent to them. You are an independent controller of the data so transferred, governed by your agreement with HubSpot. You can stop this transfer at any time; HubSpot keeps what it has already received.
6.5 Transfer to the AI assistant you connect
If you connect FindMyLead to an artificial intelligence assistant (Claude, ChatGPT…), it receives the lists, contacts, campaigns and replies of your team that you ask it to read. You are an independent controller of the data so transferred, governed by your agreement with that service. You can cut the connection at any time from the Connected tools page; the assistant keeps what it has already received.
6.6 Business referrer applications
The details of an application are read only by the founders of FindMyLead. They go to no one else but our technical email providers.
6.7 If you are a business referrer
To pay your commissions and keep our accounts, we keep your identity, your address, your bank and tax details and the proof of the signature of your contract. This data rests on the performance of your contract and on our accounting and tax obligations. It is read by the founders and passed to our bank for your transfers. We check your company's number against the public company directory.
7. Data retention
| Data type | Duration | Legal basis |
|---|---|---|
| Account data | Duration: Until your account is deleted. A copy stays in the backups for 21 days at most | Legal basis: Contract performance |
| Invoices and payments | Duration: 10 years | Legal basis: Legal obligation (French Commercial Code, art. L123-22) |
| Connection logs | Duration: 1 year | Legal basis: Legal obligation (LCEN) |
| Audience measurement | Duration: 25 months | Legal basis: CNIL recommendation |
| Search history | Duration: Your last 50 searches, with the sentences you typed. These sentences are also kept 12 months to improve the search | Legal basis: Legitimate interest (ease of use, improving the search) |
| People and addresses that objected, unsubscribed or are invalid | Duration: No time limit. Only what is needed to never contact the person again is kept (their email address or LinkedIn identifier) | Legal basis: Legal obligation (honouring objections and unsubscriptions); legitimate interest for invalid addresses (no more emails to addresses that cannot receive them) |
| Emails sent and replies received | Duration: As long as your team exists: erased with the campaign or with the team. The text of a reply received is erased 3 years after it is received at the latest | Legal basis: Legitimate interest (B2B prospecting, keeping the history of your campaigns) |
| People saved in your lists (profile, company, email address found) | Duration: As long as your team exists. Erased as soon as an objection is validated, or when the team is deleted | Legal basis: Legitimate interest (B2B prospecting) |
| Imported contact files | Duration: 30 days after the search ends | Legal basis: Performance of the contract (finding the people in your file) |
| LinkedIn texts written by AI for a person in your lists | Duration: Unused drafts: erased after 90 days. Texts sent or planned in a campaign: kept as long as the campaign | Legal basis: Legitimate interest (saving you from rewriting them) |
| Record of our answer to an objection request (dates, decision, reason, and an unreadable version of the LinkedIn identifier, never the identifier itself) | Duration: 6 years after the answer | Legal basis: Legal obligation (showing that the right to object is respected, GDPR art. 5.2) |
| Applications to become a partner (business introducer) | Duration: 2 years at most after the last exchange | Legal basis: Legitimate interest (being able to contact you again), within the limit the CNIL recommends |
| Security backups | Duration: 21 days at most. The data of a deleted account stays in the backups until then | Legal basis: Legitimate interest (security, getting everything running again after an outage or an attack) |
8. Data security
We implement appropriate technical and organizational measures:
- Encryption: of data in transit and of sensitive data at rest
- Passwords: never stored in plain text
- Infrastructure: hosted in France, ISO 27001 certified
- Access: limited to the strictly necessary (least privilege)
9. Your rights (GDPR)
| Right | Description | Response time |
|---|---|---|
| Right of access (Article 15 GDPR) | Description: Obtain confirmation that your data is being processed and receive a copy | Response time: 30 days |
| Right to rectification (Article 16 GDPR) | Description: Have your inaccurate personal data corrected | Response time: 30 days |
| Right to erasure (Article 17 GDPR) | Description: Request the deletion of your data (under conditions) | Response time: 30 days |
| Right to restriction (Article 18 GDPR) | Description: Request the restriction of the processing of your data | Response time: 30 days |
| Right to data portability (Article 20 GDPR) | Description: Receive your data in a structured format and transfer it | Response time: 30 days |
| Right to object (Article 21 GDPR) | Description: Object to the processing of your data on legitimate grounds | Response time: 30 days |
| Withdrawal of consent (Article 7 GDPR) | Description: Withdraw your consent at any time (without affecting the lawfulness of earlier processing) | Response time: Immediate |
Exercise your rights
- From your account: in Settings, “Export my data” downloads your profile and preferences, “Delete my account” deletes your account
- By email: dpo@findmylead.fr, for a copy of all your data, including lists, templates, campaigns and search history
Rights of people whose data is processed
If you are a person whose professional contact details are processed by FindMyLead, you have the following rights:
- Right of access (article 15 of GDPR): obtain confirmation that data concerning you is being processed and obtain a copy
- Right of rectification (article 16): have inaccurate data corrected
- Right of erasure (article 17): request the deletion of your data
- Right to object (article 21): object to the processing of your data. In the context of commercial prospecting, you may object at any time and without justification.
To exercise these rights, contact us at: dpo@findmylead.fr
To object, you can also fill in the form on the page Stop appearing. All it takes is the link to your LinkedIn profile, and your request takes effect at once.
Response time: We commit to responding to any request within 30 days. If you believe your rights are not being respected, you may lodge a complaint with the CNIL (www.cnil.fr).
CNIL complaint
You may lodge a complaint with the CNIL: www.cnil.fr
10. Information to data subjects (article 14 GDPR)
In accordance with article 14 of GDPR, people whose data is processed are informed by the FindMyLead user who writes to them, as the controller of their campaigns, within a month of adding the person to a list, and in their first message at the latest. FindMyLead adds no text to emails. That first message must give the following information:
- The data source named precisely, for example “I found your professional contact details with FindMyLead, a professional-profile search tool”
- The legal basis for processing (legitimate interest)
- The rights they hold
- A way to object that is simple, such as a “STOP” reply, which FindMyLead records as an unsubscribe for all its users
A person a team saved without writing to them is informed by this policy (article 14, paragraph 5, point b of GDPR) and may object at any time on the page Stop appearing.
12. Modifications
We may update this policy. The version in force is the one published on this page.
13. Contact
Personal data contact
To exercise your GDPR rights or for any questions about your data
Email: dpo@findmylead.fr