Privacy Policy

Article 01

Controller and scope

The controller for the processing described in this policy is Thomas Casale, individual entrepreneur (EI), trading as Geo Lead, SIRET 878 503 317 00025, professional address: 8 rue des Combattants d’Afrique du Nord, 06000 Nice, France, email: thomas@geolead.co, telephone: +33 6 61 91 24 28. This policy applies to geolead.co, Geo Lead accounts, purchases, support, searches, exports and the professional prospect database made available through the service. Geo Lead acts as controller for the purposes and means it determines. A Customer who exports or uses prospect information for its own purposes generally acts as a separate controller.

Article 02

Data categories and sources

Geo Lead distinguishes data relating to users and customers from professional information relating to prospects. Fields marked as required in a form are necessary to create an account, process a purchase or answer the request concerned; optional fields may be omitted, although the corresponding feature may be less personalised.

• Account and identity data: first name, last name where provided, email address, optional telephone number, password in hashed form, Google authentication identifier, verification status and account dates.
• Transaction and subscription data: selected offer, credit balance and operations, order and invoice references, payment status and subscription dates. Full payment-card details are processed by Stripe and are not received by Geo Lead.
• Service content and usage data: search criteria, configurations, campaigns, files, exports, support messages, AI search requests and technical logs necessary to operate and secure the service.
• Technical data and cookies: IP address, browser and device information, security events, authentication, CSRF and map-session cookies, language, cart, search configuration, campaign and credit-display preferences, and audience-measurement identifiers.
• Professional prospect information: business name, activity, public professional contact details, website, location, opening information, identifiers and other professional attributes obtained from Google Maps, public websites and other publicly accessible professional sources. Some fields may identify a natural person and therefore remain personal data even when public.

Article 03

Purposes and legal bases

Geo Lead processes only data relevant to the following purposes and legal bases:

• Create and administer accounts, provide searches, credits, exports, subscriptions and support: performance of the contract or steps requested before entering into it.
• Process payments, issue invoices and keep accounting records: performance of the contract and compliance with legal obligations.
• Authenticate users, prevent fraud, secure the service, investigate incidents and establish or defend legal claims: Geo Lead's legitimate interests in protecting the service and its users, balanced against the rights of the persons concerned.
• Build, update and make available a professional prospect database from publicly accessible sources: Geo Lead's legitimate interest in providing B2B information and search services, subject to data minimisation, transparency, objection rights and a balancing assessment.
• Send operational emails: performance of the contract. Send optional marketing communications: consent where required or legitimate interest where the law permits professional customer prospecting, with an unsubscribe option.
• Improve the service and generate AI-assisted search suggestions: performance of the requested feature and Geo Lead's legitimate interest in improving it. Users must avoid entering unnecessary sensitive or confidential personal data.
• Measure audience with Google Analytics: prior consent. Refusing or withdrawing consent does not prevent access to the service except for strictly necessary cookies.

Article 04

Recipients, processors and transfers

Access is limited to Thomas Casale and service providers that need the data to perform their tasks, subject to contractual and confidentiality obligations. Geo Lead does not sell users' personal data. Data may also be disclosed to authorities where required by law or where necessary to establish, exercise or defend legal claims.

• OVHcloud: application and database hosting. The application and MongoDB database are hosted on the same server located in France.
• Stripe: payment, subscriptions, invoices and fraud prevention.
• Google: Google account authentication, Google Workspace email delivery and Google Analytics audience measurement.
• OpenAI: standard API used for AI-assisted search generation. Search parameters and text entered into that feature may be sent to OpenAI and may contain personal data if the user includes such data.
• Transfers outside the European Economic Area may result from the use of Stripe, Google or OpenAI. Depending on the recipient and processing location, they must rely on an applicable adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses. Information on the applicable safeguard may be requested at thomas@geolead.co.

Article 05

Retention periods

Account and service data are currently retained while the account remains open; the automatic retention period applicable to inactive accounts remains [À CONFIRMER PAR THOMAS : durée de conservation et règle de purge des comptes inactifs]. Professional prospect information is retained and updated without a currently documented automatic purge period: [À CONFIRMER PAR THOMAS : durée ou critère de conservation de la base de prospects]. A valid account-deletion request is processed within thirty days, subject to legal archiving and the rights of third parties. AI generation logs are retained for 30 days and security-event records for 90 days. Authentication and CSRF cookies expire according to their technical duration; the map-session cookie expires after 12 hours, while browser-stored preferences without a stated expiry normally end with the browser session. Accounting documents and invoices are retained for 10 years from the end of the relevant financial year. Contractual evidence and transaction data may be archived for the applicable statutory limitation period. Data subject to a dispute or legal hold is retained only for the period necessary to handle it. Retention configured directly by Stripe, Google, OpenAI and Google Analytics is also subject to each provider's settings and legal obligations.

Article 06

Security and confidentiality

Geo Lead applies proportionate technical and organisational measures designed to protect personal data, including access controls, hashed passwords, protected authentication cookies, CSRF protection, restricted database access, logging of relevant security events and encrypted transport where supported. Access is limited to persons and providers that need it. No online service can guarantee absolute security. Users must choose a robust password, keep their credentials confidential and notify thomas@geolead.co of suspected compromise. Where a personal-data breach creates a risk, Geo Lead will document it and notify the CNIL and affected persons when the GDPR requires it.

Article 07

Your rights

Subject to the conditions and exceptions provided by the GDPR, every person concerned has the following rights:

Users can download an account export and request account deletion from their Geo Lead account. Requests may also be submitted through geolead.co/en/privacy-request or sent to thomas@geolead.co with sufficient information to identify the person and the request. Additional proof of identity is requested only where reasonably necessary. Geo Lead responds in principle within one month; an account-deletion request that can be fulfilled is processed within thirty days. Prospect data is not automatically included in a user's account export because it concerns third parties. Any person appearing in the professional prospect database may request access, correction, objection or removal by identifying the listing concerned, for example with the business name, location, public contact detail or Geo Lead result URL. Once verified and applied, an objection is recorded in a suppression register designed to prevent the listing from being made available again. Removal from Geo Lead does not erase information independently published by the original source or copies previously exported by Customers, who remain responsible for handling objections addressed to them.

• Access personal data and obtain information about its processing.
• Correct inaccurate data and complete incomplete data.
• Request erasure, including deletion of an account and associated data, subject to legal retention duties and third-party rights.
• Request restriction of processing in the cases provided by law.
• Object, on grounds relating to a particular situation, to processing based on legitimate interests; objection to direct marketing may be made at any time and without justification.
• Receive data provided to Geo Lead in a structured, commonly used and machine-readable format, and request transmission to another controller where technically feasible and legally applicable.
• Withdraw consent at any time for processing based on consent, without affecting processing already carried out.
• Give instructions regarding personal data after death where French law permits, and lodge a complaint with the CNIL at cnil.fr.

Article 08

Cookies and audience measurement

Geo Lead uses cookies and local identifiers necessary for authentication, CSRF protection, security, map-view quotas, language, cart, search configuration, campaign preparation and credit display. Disabling strictly necessary storage may prevent login or the relevant feature from working. Optional services are disabled by default. Google Analytics (identifier G-KB6JYFM2X9) is loaded only after consent to audience measurement and may create _ga cookies for no more than approximately 13 months. YouTube embeds are loaded only after consent to external videos. The consent choice is stored for 183 days in the host-scoped geo_lead_consent cookie, which records the selected categories, the choice date and the mechanism version but no user identifier. Users can accept, refuse or customize optional categories, then change or withdraw their choice at any time through Cookie settings in the footer. On withdrawal, Geo Lead disables Analytics and attempts to delete accessible _ga cookies; data previously transmitted to third parties is not retroactively erased by this browser action. Browser settings may also delete or block cookies but do not replace the consent control provided by the site.

Article 09

Children, entry into force and changes

Geo Lead is a professional prospecting service and is not specifically directed at children. A minor may not make a purchase without the capacity or authorisation required by applicable law. This policy takes effect on August 10, 2026. Geo Lead may update it to reflect legal, technical or service changes. Material changes will be brought to users' attention by an appropriate means before they take effect where required. The version published on this page is the current version; users are encouraged to review it periodically.