Privacy Policy

This Privacy Policy is issued by HeyLead LLC ("HeyLead", "we", "us", or "our"), a company offering digital marketing services and software products.

• ›Legal entity: HeyLead LLC
• ›Website: https://heylead.com and regional variants (including /uk/, /au/, /sg/, /es/)
• ›Privacy contact email: [email protected]
• ›Phone: +1 415-420-4059

Where a local representative or data protection officer is required by law, we will provide those details on request at the contact address above.

This Privacy Policy describes how we process personal data when you:

• ›Visit or use the Website, free tools, blogs, or contact forms
• ›Engage HeyLead for agency services (SEO, SEM, Meta Ads, web design, analytics, CRM integration, audits, consulting)
• ›Subscribe to or use HeyLead Insights (session recordings, heatmaps, behaviour analytics)
• ›Subscribe to or use HeyLead Auto Blogger (research-to-publish content system)
• ›Communicate with us by email, phone, WhatsApp, chat, or scheduling tools

2.1 When HeyLead is the controller

We act as an independent controller for personal data we collect for our own business purposes, including Website analytics, marketing, sales, billing, account administration, support, and security of our systems.

2.2 When HeyLead is a processor (client products)

For certain product features, our customers ("Clients") decide what data is collected on their properties and why. In those cases:

• ›The Client is the controller (or equivalent) of end-user / website-visitor data
• ›HeyLead is a processor (or service provider) processing data on the Client's instructions
• ›This Policy explains product processing at a high level; the Client's own privacy notice and any data processing agreement (DPA) with HeyLead govern the Client relationship

2.3 Related documents

• ›Terms & Conditions - contract terms for Website and services/products
• ›Cookie Policy - cookies and similar technologies on the Website and product trackers

3.1 Information you provide to us

• ›Identity and contact data: name, email, phone, company, job title, region
• ›Business data: website URL, industry, goals, budgets, CRM or ad-account details you choose to share
• ›Form and enquiry content: free audit requests, contact messages, proposal answers, WhatsApp messages
• ›Account and billing data: plan selection, invoices, payment references (card data is typically handled by payment processors, not stored by us in full)
• ›Credentials and integrations you supply for services or products (for example CMS, GTM, analytics, ad platforms) - used only to deliver the engagement
• ›Support communications and feedback

3.2 Information collected automatically on our Website

• ›IP address, approximate location derived from IP, device and browser type
• ›Pages viewed, referrers, timestamps, session duration, clicks and scroll behaviour on our Website
• ›Cookie and similar identifiers (see Cookie Policy)
• ›Diagnostic logs, security events, and error reports from hosting and edge providers (for example Cloudflare)

3.3 Information from third parties

• ›Analytics and advertising platforms (for example Google, Meta) about campaign performance and conversions
• ›Scheduling tools (for example Calendly) when you book a call
• ›CRM, email, and messaging tools used to manage leads and client work
• ›Publicly available business information you point us to for audits or SEO work

3.4 Sensitive personal data

We do not seek to collect special-category / sensitive data (health, biometric, religious, etc.) through the Website. Please do not submit such data in forms. If a Client project requires processing of sensitive data, we will only do so under a documented lawful basis and written instructions.

HeyLead Insights helps Clients understand on-page behaviour through features that may include session replay, click heatmaps, scroll and pageview context, multi-site dashboards, and related tools. Clients install a lightweight JavaScript snippet or Google Tag Manager tag on their own websites.

4.1 Data that may be collected via the Insights tracker

Depending on configuration and page content, the tracker and related backend may process:

• ›Technical and usage data: URLs, page titles, referrers, device type, browser, viewport, timestamps, session IDs, site IDs
• ›Interaction data: clicks, taps, mouse movements, scroll depth, form focus/blur, navigation path
• ›Session replay / DOM snapshots: reconstructed views of pages as experienced during a visit, which may incidentally include text users type into forms if not excluded
• ›Aggregated heatmap and engagement metrics derived from the above
• ›Operator account data: team logins, roles, ingest keys, site registration details

4.2 Personal data in session recordings

Session recordings and form interactions can include personal data if website visitors enter it (names, emails, phone numbers, messages). Clients should:

• ›Configure masking/blocking of sensitive fields where available
• ›Avoid collecting payment card data, passwords, government IDs, or health data through unmasked fields
• ›Disclose Insights (or equivalent analytics) in the Client privacy notice and cookie banner where required
• ›Obtain consent where ePrivacy / PECR / similar rules require it before non-essential tracking

4.3 Our role and instructions

• ›Client determines purposes (CRO, UX diagnosis, marketing optimisation) and installs the tracker
• ›HeyLead processes Insights data to operate the product, store sessions/heatmaps, display dashboards, maintain multi-site isolation, provide support, and secure the service
• ›We do not sell end-user Insights data and do not use Client end-user recordings to advertise HeyLead to those end users
• ›Staff access is limited to operations, support, and security needs under confidentiality obligations

4.4 Multi-site isolation and keys

Clients may register multiple properties. Site IDs and ingest keys are designed so data remains isolated per property. Clients must keep keys confidential and rotate them if compromised.

HeyLead Auto Blogger is a multi-client content system that may research, outline, draft, enrich, validate, and publish posts (for example via WordPress REST or static/Git publish paths).

5.1 Data processed

• ›Client playbook data: brand voice, keywords, seed topics, testimonials, industries, regions, publish rules
• ›Content artifacts: briefs, drafts, media metadata, quality grades, validation results, publish logs
• ›Integration credentials and endpoints you provide (CMS tokens, repository access) - used only for authorized publish paths
• ›Operator accounts, spend/run metrics, digests, and support tickets
• ›Third-party model/API processing: draft generation or enrichment may involve AI providers acting as subprocessors under our instructions

5.2 AI processing notice

Content generation may use third-party large language models or related APIs. Inputs (briefs, playbook snippets, research context) and outputs may be processed by those providers as needed to deliver the feature. We select providers and contractual settings intended for business use; Clients should not include secrets, card numbers, or unnecessary personal data of third parties in prompts or seed materials.

5.3 Client content responsibility

Clients remain responsible for reviewing published content for accuracy, legal compliance (advertising, regulated claims, IP), and brand safety, especially in human-review or auto-publish modes.

We offer free tools and forms (for example free audits, content briefs, analyzers, contact forms, URL checkers) and related APIs. When you use them we may process:

• ›Submitted URLs, form fields, and tool inputs
• ›Results generated for you and technical logs needed to run the tool
• ›Contact details if you request follow-up or book a call

Tool outputs are informational only. We may store submissions to improve tools, prevent abuse, and (where permitted) follow up about HeyLead services. Lead data may be stored in our CRM / email systems.

Depending on context, we use personal data to:

• ›Provide, operate, secure, and improve the Website, free tools, agency services, Insights, and Auto Blogger
• ›Respond to enquiries, deliver audits/consultations, and manage client projects
• ›Create and manage accounts, billing, and support
• ›Send service messages (transactional, security, product notices)
• ›Send marketing communications where allowed (with opt-out)
• ›Measure marketing performance and Website analytics
• ›Detect, investigate, and prevent fraud, abuse, and security incidents
• ›Comply with law, enforce agreements, and protect rights
• ›As a processor: process Client product data only for documented product purposes and Client instructions

We do not sell personal information for money. Where "sale" or "sharing" is defined broadly under US state law (for example for cross-context behavioural advertising), we address that in Section 14 and provide opt-out rights.

Where EU/EEA or UK data protection law applies, we rely on one or more of:

• ›Contract - to provide services or products you request
• ›Legitimate interests - for example securing systems, improving products, B2B marketing to corporate contacts, analytics of our own Website (balanced against your rights)
• ›Consent - where required (for example certain cookies, email marketing, non-essential tracking)
• ›Legal obligation - tax, accounting, responding to lawful requests

You may withdraw consent at any time without affecting prior lawful processing. For processor activities, the Client is responsible for establishing a lawful basis for end-user data.

We share personal data only as needed with:

• ›Infrastructure and security: hosting, CDN, DNS, WAF (for example Cloudflare), cloud storage
• ›Analytics and ads: Google Analytics / Ads, Meta, LinkedIn or similar tags used on our Website
• ›Communications and CRM: email delivery (for example Brevo or similar), CRM, WhatsApp Business, scheduling (for example Calendly)
• ›AI and content tooling: model/API providers used for Auto Blogger or internal tooling under contract
• ›Payment processors if you pay online
• ›Professional advisors (legal, accounting) under confidentiality
• ›Authorities when required by law or to protect rights and safety
• ›Business transfers in a merger, acquisition, or asset sale (with notice where required)

We require service providers that process personal data for us to implement appropriate security and to use data only for our instructions (or as controllers for their own limited purposes, such as fraud prevention, as disclosed in their policies).

A current list of key subprocessors is available on request at [email protected].

We operate internationally and may process data in the United States and other countries where our providers run infrastructure. Where we transfer personal data from the EEA/UK/Switzerland to countries without an adequacy decision, we use appropriate safeguards such as Standard Contractual Clauses (and UK addenda where applicable), plus supplementary measures as needed.

Clients using Insights or Auto Blogger acknowledge that product data may be processed in these locations to deliver the service.

We keep personal data only as long as reasonably necessary for the purposes above, including:

• ›Sales and enquiry leads: typically up to 24 months after last meaningful contact, unless you become a client or ask us to delete sooner
• ›Client project records: for the engagement plus a retention period for accounting, claims, and legal requirements (often up to 7 years for financial records)
• ›Insights session/heatmap data: retained per product configuration and Client settings; default operational windows may range from weeks to months unless a longer archive is agreed
• ›Auto Blogger artifacts: while the account is active and for a limited period after cancellation to allow export/support, then deleted or anonymised
• ›Security logs: typically 30-180 days unless needed longer for investigations
• ›Website analytics: per tool defaults and our cookie settings

When retention ends, we delete or irreversibly anonymise data where feasible.

We implement technical and organisational measures appropriate to risk, which may include TLS in transit, access controls, least-privilege staff access, logging, network protections via our edge/hosting providers, and multi-site isolation design for Insights.

No method of transmission or storage is 100% secure. You are responsible for safeguarding credentials, ingest keys, CMS tokens, and devices you use to access our products. Notify us promptly of suspected unauthorised access.

Depending on your location, you may have rights to:

• ›Access a copy of personal data we hold about you
• ›Correct inaccurate data
• ›Delete data (subject to legal exceptions)
• ›Restrict or object to certain processing
• ›Data portability
• ›Withdraw consent
• ›Lodge a complaint with a supervisory authority

To exercise rights for data HeyLead controls, email [email protected] with enough detail to verify your request. We may need to confirm identity.

For data collected on a Client website via Insights (or similar), contact that Client first. We will assist Clients as a processor in responding to valid requests.

If you are a resident of California or another US state with comprehensive privacy law (for example CPRA, CPA, CTDPA, VCDPA, and similar), this section applies in addition to the rest of this Policy.

14.1 Categories of personal information

We may collect identifiers, commercial information, internet/network activity, professional information, and inferences used for lead qualification - as described in Section 3. We do not intentionally collect sensitive personal information for Website browsing.

14.2 Purposes and sources

Sources and purposes are described in Sections 3 and 7. We do not use or disclose sensitive personal information for purposes that require a right to limit under CPRA beyond what is necessary to provide services.

14.3 Sale / sharing

We do not sell personal information for money. Our Website may use advertising/analytics cookies that some laws treat as "sharing" or "targeted advertising." You can opt out via cookie controls, browser settings, Global Privacy Control (GPC) signals where we are able to honour them, and industry tools linked in the Cookie Policy. Email [email protected] with the subject "Do Not Sell or Share" for additional assistance.

14.4 Your rights

• ›Know / access categories and specific pieces of personal information
• ›Delete
• ›Correct
• ›Opt out of sale/share/targeted advertising
• ›Non-discrimination for exercising rights

Authorized agents may submit requests with proof of authority. We aim to respond within statutory timelines.

• ›UK: UK GDPR and Data Protection Act 2018 principles apply as described above; complaints may be directed to the ICO.
• ›Australia: We handle personal information in line with the Privacy Act 1988 (Cth) and Australian Privacy Principles where applicable. You may request access/correction via our contact email.
• ›Singapore: Where the PDPA applies, we process personal data with consent or other PDPA bases (for example legitimate interests / contractual necessity analogues as allowed), and maintain reasonable security.
• ›Regional site paths (for example /uk/, /au/, /sg/, /es/) do not change the core processing described here unless a local addendum is published.

We may send B2B marketing emails or messages about HeyLead services where permitted. You can unsubscribe via the link in emails or by contacting us. Transactional and service messages (billing, security, product notices) are not marketing and may continue as needed to operate the service.

Our Website, services, and products are directed to businesses and adults. We do not knowingly collect personal data from children under 16 (or higher age required locally). If you believe a child provided data, contact us and we will delete it where appropriate.

Our Website may link to third-party sites. Their privacy practices are their own. Client websites that install Insights or publish Auto Blogger content are controlled by those Clients - review the Client's privacy notice for end-user practices on those sites.

We may update this Policy to reflect product, legal, or operational changes. We will post the revised version with a new "Last updated" date. Material changes may be highlighted on the Website or communicated to account holders. Continued use after the effective date constitutes acceptance where permitted by law.