Skip to content
leadflip
Sign inCreate your account

Privacy policy

How we collect, use and safeguard information when you use Leadflip.

Last updated: 17 September 2026

Not yet reviewed by counsel. This policy describes what the platform actually does and has been corrected where the previous version described an older product. It has not been checked by a lawyer, and it is not a data processing agreement — that is a separate document you receive as a customer.

1. Introduction

SKAJ Ventures GmbH ("we", "us") operates the Leadflip platform (the "Service"). This privacy policy explains how we collect, use, disclose and safeguard information when you use the Service.

For data you store in the Service about other people — your leads — you are the controller and we act as processor on your instructions.

2. Information we collect

2.1 Account information

When you create an account we collect your name, email address and a hashed password. If you sign in with Google, we receive the profile information that Google provides for that purpose.

2.2 Lead data

You may store records in the Service — names, email addresses, telephone numbers and whatever custom fields you define on your entities. This data is processed on your behalf and under your instructions.

2.3 Usage data

We record which actions were taken in an account, by whom and when, in a change log. Server logs contain IP addresses and request metadata for the purpose of operating and securing the Service.

2.4 Payment information

The Service currently has no self-service checkout and processes no card data. Where a subscription exists, it is invoiced directly. If that changes, this section will name the processor before any payment data is collected.

3. How we use information

  • To provide, operate and maintain the Service
  • To secure the Service and investigate misuse
  • To send service notifications that are necessary to operate an account
  • To comply with legal obligations, including retention and deletion duties

4. Legal bases (GDPR)

  • Contract performance — processing necessary to provide the Service you requested (Art. 6(1)(b) GDPR).
  • Legitimate interest — securing and improving the Service (Art. 6(1)(f) GDPR).
  • Consent — where you have given it explicitly, for example for marketing communications (Art. 6(1)(a) GDPR).
  • Legal obligation — retention periods and other duties under applicable law (Art. 6(1)(c) GDPR).

5. Encryption and masking

Secrets that the Service holds on your behalf — SMTP and IMAP credentials, API tokens, webhook secrets — are encrypted at rest with AES-256-GCM.

A field marked as sensitive is masked in the interface, in lists and in exports. Masking is not encryption: the value is stored in the database like any other field value. We say so plainly because an earlier version of this policy described a different product and claimed per-field encryption of lead data.

All data in transit is protected with TLS.

6. Sharing

We do not sell personal data. Data is shared only in these cases:

  • Infrastructure providers — hosting, database and file storage, operated in the European Union, under data processing agreements.
  • Distribution partners — when you configure lead distribution, record data is delivered to the partners you designate, in the shape you configure. You decide who they are and what they receive.
  • Your own mail server — outgoing mail leaves over the SMTP credentials you configure, not over ours.
  • Legal requirements — where disclosure is required by law, regulation or legal process.

7. Retention and deletion

Every dataset in the platform carries a retention rule, and a dataset without one fails our build rather than an audit. Deletion runs can be previewed before they execute, respect a legal hold, and leave proof that the deletion happened — what was deleted, when and under which rule.

Account data is retained for as long as the account is active. You may request deletion of your account and its data at any time.

8. Your rights

Under the GDPR you have the right to:

  • Access your personal data
  • Have inaccurate personal data corrected
  • Request erasure of your personal data
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent at any time, without affecting prior processing
  • Lodge a complaint with a supervisory authority

9. Cookies and tracking

This website sets no cookies and runs no analytics or advertising scripts. The platform behind the login uses cookies that are strictly necessary for authentication and session management.

10. Changes to this policy

We may update this policy. Significant changes will be communicated by email or within the Service, and the date at the top of this page will change.

11. Contact

For privacy enquiries: privacy@leadflip.net. Company details are in the legal notice.