Privacy Policy
Last updated: [DATE]
This policy explains how Spectre Graphics handles personal data in connection with FreeLeadLog: our website at [DOMAIN] (including the early-access waitlist), the FreeLeadLog web dashboard, the FreeLeadLog mobile app, and the FreeLeadLog Telegram bot and WhatsApp number.
1. Who we are
Spectre Graphics, [LEGAL FORM], [STREET AND NUMBER], [POSTAL CODE, CITY], Tunisia. Represented by [MANAGING DIRECTOR]. Register (RNE): [RNE NUMBER]. Email: privacy@[DOMAIN].
EU representative (Art. 27 GDPR): [NAME, ADDRESS, EMAIL]. You can contact our representative about any question on this policy, in addition to contacting us directly.
2. Two different roles
- We are the controller for data about website visitors, waitlist sign-ups, and the account and billing data of people who use FreeLeadLog (section 3).
- We are a processor for the data a customer's sales team captures in FreeLeadLog: leads (prospects), notes, voice notes, photos, locations, routes and team members' work data. The company that uses FreeLeadLog (our "customer", usually the rep's employer or principal) is the controller for that data and decides why and how it is processed. We process it only on the customer's instructions under our Data Processing Agreement (section 4).
3. Data we process as controller
3.1 Website and waitlist
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address, and optionally role, crew size, industry, country, language, and whether you'd like an interview | To contact you about early access and, if you ticked the box, to schedule a short interview; to understand which markets are interested | Consent, Art. 6(1)(a) GDPR. You may withdraw it at any time. | Until you withdraw or ask for deletion, at the latest 6 months after FreeLeadLog's public launch |
| An anonymous daily count of page visits | To measure interest | No personal data is stored (a number per day) | Indefinitely |
| Server logs (IP address, time, requested URL, user agent) | Security and abuse prevention | Legitimate interest, Art. 6(1)(f) | Up to [14] days |
No cookies, no trackers. The website uses no cookies, no third-party analytics and no tracking pixels. Fonts are served from our own server. Your language choice is stored only in your browser (localStorage).
3.2 FreeLeadLog accounts (reps, team leaders, owners)
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Email, password (stored only as a hash), display name, language, time zone | To create and secure your account and to log you in | Performance of a contract, Art. 6(1)(b) | While the account exists, deleted within 30 days of account deletion |
| Team membership and role | To give you access to your team's workspace | Art. 6(1)(b) | As above |
| Linked Telegram / WhatsApp identifiers, push notification token | To let you capture leads from those channels and to send you reminders | Art. 6(1)(b) | Until you unlink the channel, log out of the app, or delete your account |
| Billing contact and invoices [when billing is live] | Invoicing and tax obligations | Art. 6(1)(b) and (c) | As required by tax law ([10] years) |
| Support emails | To answer you | Art. 6(1)(b) / (f) | [24] months after the conversation closes |
| Security logs | To protect the service against abuse | Art. 6(1)(f) | Up to [14] days |
4. Data we process for our customers (as processor)
When a sales rep uses FreeLeadLog, they may send a text, a voice note, a photo or a location pin about a prospect. FreeLeadLog turns it into a lead record that can contain: the prospect's name, phone number, address, notes, geolocation, a transcript of the voice note, photos, qualifying details (e.g. current provider, tariff interest, contract end date, fibre availability, number of units), status, reminders and planned routes.
If you are a prospect whose details were recorded by a sales rep: the company that rep works for is responsible for that data. Please direct requests (access, deletion, objection) to that company. If you contact us, we will forward your request to the customer concerned and support them in answering it.
How the processing works technically:
- Text (typed or transcribed) is sent to a language model through OpenRouter to extract the structured lead. Photos are not sent to the AI.
- Voice notes are transcribed by a speech-to-text service ([OpenAI Whisper], [VERIFY]).
- Media is stored in [S3 storage location] [VERIFY]; the database runs in Frankfurt, Germany.
- AI providers are contractually prevented from using this data to train their models [VERIFY settings].
5. App permissions
The mobile app asks for these permissions, and only uses them when you take the related action:
- Location (while in use): to attach your current position to a lead you are capturing. No background tracking.
- Microphone: to record a voice note.
- Camera / photo library: to attach a photo to a lead.
- Notifications: for reminders and route updates.
You can withdraw any permission in your device settings.
6. Recipients and sub-processors
We share data only with service providers who help us run FreeLeadLog (hosting, storage, backups, AI, transcription, messaging channels, maps, push notifications). The full current list, with locations and safeguards, is at /subprocessors. We do not sell personal data and do not use it for advertising.
Using the Telegram bot or WhatsApp number means the message also passes through Telegram or Meta under their own terms and privacy policies.
7. International transfers
Spectre Graphics is established in Tunisia, a country for which the European Commission has not adopted an adequacy decision. Our servers are in Frankfurt, Germany; some sub-processors are in the USA. Where personal data leaves the EU/EEA, we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), plus additional measures such as encryption in transit. You can request a copy of the relevant safeguards at privacy@[DOMAIN].
8. Security
Encryption in transit (TLS), passwords stored only as hashes, access restricted per team and role, a firewall and intrusion prevention on our servers, encrypted off-site backups, and least-privilege access for staff.
9. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20) and to object (21), in particular to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time with effect for the future. Write to privacy@[DOMAIN]; we reply within one month. Account holders can also [delete their account in the app under Settings → Delete account] [available once P5 ships].
You have the right to lodge a complaint with a supervisory authority (Art. 77), in particular in your EU country of residence or work. In Tunisia the competent authority is the Instance Nationale de Protection des Données à Caractère Personnel (INPDP).
10. Applicable law
Because we offer FreeLeadLog to people in the European Union, the GDPR applies (Art. 3(2)). Tunisian organic law no. 2004-63 of 27 July 2004 on personal data protection applies as well.
11. Children
FreeLeadLog is a business tool and is not intended for anyone under 16.
12. Changes
We will update this policy when our processing changes and change the date above. For material changes we will notify account holders by email or in the app.