Privacy Policy

1. Data controller

Noventik SAS, whose registered office is located at 8 place Antonin Poncet, 69002 Lyon, France, is the data controller for the personal data collected in connection with the Priorlead service.

Contact: [email protected]

2. Data collected and purposes

3. Retention period

4. Recipients of the data

Subscriber data is transmitted to the technical processors strictly necessary to provide the service:

• Stripe Inc. : management of payments and subscriptions. Company established in the United States; Stripe states that it has certified its adherence to the EU-U.S. Data Privacy Framework. Stripe privacy policy, Data Privacy Framework (accessed on October 11, 2026)
• Brevo : sending of transactional emails (account confirmation, weekly digest, alerts). The recipient’s email address and the content of the message are transmitted to it.
• OVH SAS : hosting of the infrastructure (database, servers).
• Cloudflare : network and access tunnel to the service. Company established in the United States; Cloudflare states that it relies on the standard contractual clauses of the European Commission and on its certification under the EU-U.S. Data Privacy Framework. Cloudflare page (accessed on October 11, 2026)
• Brave Search : search for the official website of an applicant company. No subscriber data is transmitted: the query contains the name of a brand and of an applicant company. Brave states that its servers are hosted by Amazon Web Services in the United States; the transfer mechanism could not be verified.
• Google (Google Ads) : measurement of ad effectiveness (section 2). Click identifier, date and time of sign-up and hashed email address, only for a sign-up that came through an ad.
• Backblaze : storage of encrypted backups. Company established in the United States; Backblaze states that it adheres to the EU-U.S. Data Privacy Framework. Backblaze privacy policy (accessed on October 11, 2026)

No data is sold to third parties. Apart from the ad measurement described in section 2, no data is used for advertising purposes.

5. Your rights

In accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have the following rights over your data:

• →Right of access (Article 15 GDPR): obtain a copy of the data concerning you.
• →Right to rectification (Article 16 GDPR): have inaccurate data corrected.
• →Right to erasure (Article 17 GDPR): delete your account and your data directly from your account area (“Your data” section), within the limits of the legal retention obligations. The subscription is then terminated immediately, with no refund of the period already started (general terms and conditions of sale, clause 10.4).
• →Right to data portability (Article 20 GDPR): receive your data in a structured, machine-readable format.
• →Right to object (Article 21 GDPR): object to processing based on legitimate interest.
• →Right to restriction (Article 18 GDPR): request the temporary suspension of a processing operation.

6. Cookies and trackers

The service sets no cookie from Google or from any advertising network, and loads no advertising script. It uses browser storage as follows:

• Session token (localStorage) : kept after sign-in to authenticate your account; it is necessary for the service to work.
• First-visit attribution (sessionStorage) : campaign parameters (utm_source, utm_medium, utm_campaign) and referring page of the first page you view, kept for the life of the browser tab and transmitted to the service when you sign up.
• Onboarding resume (sessionStorage) : answers entered during the initial setup, kept for the life of the browser tab.
• Display preference (localStorage) : collapsed or expanded state of the navigation bar of the subscriber area.
• Ad click identifier (cookie pl_clic) : set only if you arrive through one of our Google Ads ads (gclid, gbraid or wbraid parameter), kept for 90 days, unreadable by the page scripts and read by our servers only when you sign up (section 2).

Audience measurement. The service uses Umami, a self-hosted audience measurement tool: the script is served by Priorlead itself, without cookies and without any third-party service. Purpose: website traffic statistics.

7. Security

Appropriate technical and organizational measures are implemented to protect your data against any unauthorized access, disclosure, alteration or destruction: encryption of passwords, encrypted connections (HTTPS/TLS), restricted access to production data.

8. Commercial prospecting by email

Noventik SAS, the data controller, emails professionals to introduce Priorlead. This section describes that processing, which is separate from the processing of subscribers described above.

• Legal basis: legitimate interest (Article 6(1)(f) GDPR): introducing the service to professionals whose activity is related to it.
• Data: the business email address and the name of the organization, nothing else. They are not shared with any third party other than our technical service providers.
• Source: the public pages of the organization’s website. The first email states the page the address came from.
• Measuring opens and clicks: each email contains an invisible image (a pixel) and links that pass through our servers before opening our website. For each message, we record the date of the first open, the number of opens and the link clicked. Purpose: measuring how well the campaign performs, nothing else. The footer of each email says so and points to this page.
• Retention: open and click events are deleted after 3 months. The address is kept for three years at most from our last exchange, unless you object before then; after an unsubscribe, we keep only a fingerprint of the address, not the address itself, so that we do not write to you again.
• Objection and unsubscribing: you may object to this processing at any time (Article 21 GDPR). Each email contains an unsubscribe link: one click, no account, immediate effect. It stops our messages and any recording of opens and clicks concerning you. You can also exercise your rights (section 5) by writing to [email protected].