How InstaLeadSync handles your data

InstaLeadSync is operated by InstaLeadSync, a product of Moleiver ("we", "us"), based in Spain. We are the data controller for the personal data described in this policy.

This policy covers the website at https://www.instaleadsync.com, the web application at https://app.instaleadsync.com, the InstaLeadSync browser extension, and the emails we send. It explains what we collect, why, who we share it with, how long we keep it and the rights you have.

If you use InstaLeadSync on behalf of a company, that company is responsible for the leads, contacts and other people's data it chooses to load into the platform. We process that data on its instructions, as described in section 4.

Account data. Your name, work email, password (stored only as a hash), company, country, the plan you chose, and the settings you save such as your writing voice, content pillars and outreach limits.

Connected accounts. When you connect LinkedIn, Facebook, Instagram or YouTube through their official sign-in, we store the access tokens they issue, your profile name and picture, and the pages or accounts you authorise. Tokens are encrypted at rest and never shown in the browser.

LinkedIn session through the extension. The InstaLeadSync browser extension runs inside your own logged-in LinkedIn session, in your browser. To do that it reads the LinkedIn session cookies of the browser profile you install it in and sends them to our servers, where they are encrypted. The extension only acts on LinkedIn pages and only when you have connected it. It does not read other websites, your browsing history or the content of other tabs.

Content you create and load. Posts, drafts, carousels, designs, brand kit files, photos you upload or paste, lead lists you import (CSV, Google Sheets, LinkedIn searches or a webhook), contacts, companies, deals, tasks and notes.

Public content we collect for you. When you ask us to monitor a LinkedIn profile, a YouTube channel or an RSS feed, we collect its public posts, videos, titles, engagement counts and author names so we can show trends and suggest ideas. We only collect what the platform shows publicly.

Outreach activity. The invitations, messages, visits and comments the extension performs for you, their timing, and LinkedIn's responses, including safety warnings such as captchas or checkpoints. We keep this so the safety limits work and so you can see what was done.

Usage and device data. Log-in times, IP address, browser type, the pages and features you use, error reports, extension version and performance measurements. A "trusted device" token is stored in your browser so you can skip the email code for seven days.

Payment data. When billing is enabled, card details are entered on Stripe's pages and never reach our servers. We keep the plan, invoices, amounts and payment status.

Support and requests. Anything you send us by email or through the book-a-call, contact and waitlist forms.

We do not sell personal data, and we do not use your content, your leads or your monitored posts to train AI models. AI providers we use are bound by contract not to train on the data we send them.

Leads, contacts, prospects and the authors of public posts are people who have not signed up with us. For that data you are the controller and we are your processor. In practice this means:

• You decide which people to add, monitor or contact, and you are responsible for having a lawful basis to do so, for example a legitimate interest in B2B prospecting, and for honouring their objections.
• We process that data only to provide the features you use and never for our own purposes.
• We apply the same security measures to it as to your own data, and we delete it when you delete it or close your account.
• If someone asks us directly about data you loaded about them, we will point them to you and help you respond.

Our Terms of Service contain the data-processing terms that apply between us for this data.

We use a small number of service providers, listed below, who process data on our instructions and under written contracts. We do not share your data with anyone else, except when the law requires it or when you ask us to, for example by connecting a platform or a webhook.

When you set a webhook URL (for example Zapier, n8n or Make) or connect a CRM, we send the data you choose to that endpoint. Their handling of it is governed by their own policies.

If InstaLeadSync is ever sold or merged, your data would be transferred to the new operator under the same commitments, and we would tell you first.

Your account, content and CRM data are stored in the European Union (Ireland). Some providers listed above process data in the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. Content sent to AI providers is limited to what the feature needs and is not retained by them beyond the request, per their API terms.

• Account and content: for as long as your account exists. When you delete your account we delete it within 30 days, except invoices and tax records, which we keep for the period the law requires (in Spain, generally 6 years).
• Connected accounts and the LinkedIn session: until you disconnect them in Settings or the extension, or until the token expires. Disconnecting deletes the stored credentials immediately.
• Monitored public posts and trending topics: while you keep monitoring the profile; removing a profile removes its posts. Topics are rebuilt from recent posts and replaced each time.
• Outreach and delivery logs: 12 months, or earlier if you clear them in Settings.
• Sign-in codes: 10 minutes. Trusted-device tokens: 7 days. Security and rate-limit counters: 24 hours.
• Backups: encrypted database backups are kept for up to 30 days and then overwritten.

• Everything travels over HTTPS. Data is encrypted at rest; platform tokens and LinkedIn session data are additionally encrypted with keys held only on the server.
• Every database table is protected by row-level security, so one account can never read another's data, even through a bug in the interface.
• Sign-in uses a password plus a one-time code sent by email. Public endpoints are rate-limited to stop guessing and abuse.
• Automated security scans run on every code change and weekly against the live database, with findings tracked until fixed.
• Access to production data is limited to the people who operate the service and is logged.

No system is perfectly secure. If we discover a breach that affects your data we will notify you and, where required, the supervisory authority within 72 hours.

The web app uses browser storage strictly to work: your session, a trusted-device token, your interface preferences and a local cache of your own data so screens load faster. The marketing website sets no advertising or tracking cookies. We do not use third-party analytics that profile visitors across sites.

The browser extension stores your InstaLeadSync session and its own settings in the extension's storage, isolated from websites.

Because the extension acts inside your LinkedIn account, we want to be exact about what it does:

• It runs only on linkedin.com pages and only after you click Connect.
• It reads the LinkedIn pages it needs to complete the actions you queued (profile visits, invitations, messages, comments, reading replies) and reports the outcome to us.
• It sends your LinkedIn session cookies to our servers so scheduled actions can run at a human pace; these are encrypted and deleted when you disconnect.
• It does not read your email, other tabs, files or keystrokes, and it never posts, connects or messages anything you did not approve in InstaLeadSync.
• It collects anonymous error and performance reports so we can fix breakages when LinkedIn changes its pages.

We do not sell or transfer extension data to third parties except the providers listed in section 5, and we do not use it for purposes unrelated to the extension's function.

Under the GDPR and the Spanish data protection law you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data ("right to be forgotten");
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format. Contacts, deals, posts and designs can be exported from the app at any time;
• withdraw consent where processing is based on it, for example marketing emails, without affecting what happened before.

Write to privacy@instaleadsync.com. We answer within 30 days and may ask you to confirm your identity. You can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or the authority in your own EU country.

InstaLeadSync is a business tool for adults. We do not knowingly collect data from anyone under 16, and we delete it if we learn we have.

We update this policy when our practices or the law change. The date at the top always shows the current version. For material changes we notify you by email or in the app at least 14 days before they take effect.

InstaLeadSync, a product of Moleiver
Spain
Privacy requests: privacy@instaleadsync.com
Everything else: team@instaleadsync.com