Privacy Policy — Lead Points AI

Effective date: 28 November 2025

1. Who we are and how to contact us

LeadPointsAi is an AI automation agency currently in the process of incorporation in Mauritius. Until registration is complete, we operate as a sole proprietorship in South Africa.

Data Protection Officer / Responsible person:
Email: seb@leadpointsai.com

2. The categories of personal data we process

Category	What we collect	Where it comes from	Why we need it
Website visitors & analytics	IP address, browser type, pages visited, time spent, UTM parameters, device info	AWS CloudFront (hosting), Google Analytics	Improve site performance and user experience
Contact / booking inquiries	Name, email, phone (optional), company, role, message content	Contact form, Calendly / Cal.com booking	Respond to you and schedule your free audit
Lead generation systems (for clients)	Business name, name, job title, business email, phone (if public), company website data	Public sources: LinkedIn profiles, Google Maps listings, company websites, public business directories	Build lead lists for clients (B2B only)
Cold outreach campaigns (for clients)	Same as above + reply behaviour (opens, clicks, replies)	Same public sources + campaign tracking pixels	Run, optimise, and prove results of outreach campaigns
Client websites (hosted/managed by us)	Visitor data: IP address, browser/device info, pages visited, form submissions (e.g., name, email, message if forms are on the site), analytics data (anonymized where possible)	Directly from the website (e.g., contact forms, embedded tools), Google Analytics (integrated as standard), or client-provided integrations	To host, maintain, support, and improve the website; provide analytics dashboard access (via Google Analytics); ensure security and performance

Note: We act as an operator/processor for client website data — the client (responsible party) determines the purposes and any direct marketing. We process as part of our standard service agreement with them.

We never collect or process consumer/personal data for outreach — only verified business contacts.

3. How we use your information

To reply when you contact us or book a call
To deliver and improve the services you or our clients purchase
To run compliant B2B lead-generation and cold outreach campaigns (only for clients who hire us for that)
To analyse website usage (completely anonymised where possible)
To host, maintain, and support client websites (including processing any personal information collected via those sites, such as contact form submissions or analytics data from Google Analytics), as part of our standard service agreement
To comply with South African and Mauritian law once registered

4A. Lead Generation Systems — How we stay 100% POPIA compliant

All data is sourced from public business directories and platforms (LinkedIn, Google Maps, company websites, etc.). We follow POPIA Sections 10–14, 19–21 at minimum:

Lawfulness & legitimacy (B2B legitimate interest)
Purpose limitation & data minimisation
Collection directly from public sources
Security safeguards & operator responsibilities
Retention: leads are deleted or handed over to the client within 90 days unless otherwise agreed

4B. Cold Email Outreach Campaigns — Extra POPIA promises we keep

Every single campaign we run complies with POPIA Section 18 (notification) and the rest of the Act:

Every email contains your full name + company + one-click unsubscribe
Clear identification of sender
Physical address & contact details included
Immediate suppression on unsubscribe or reply
No data retained longer than 30 days after the initial email was sent (unless client requests justified extension)
Full audit trail available on request

4C. Client Websites — Our Role as Operator

When we design, deploy, host, or maintain a custom website for you:

You (the client) are the responsible party under POPIA and decide why and how personal information is collected/used on the site (e.g., for lead capture, user inquiries).
We act as your operator/processor: we host the site automatically as part of our standard service, integrate Google Analytics for dashboard access, process any personal data it collects (e.g., form entries or Google Analytics data), and apply occasional minor updates/support — per our service agreement/T&Cs. Major changes or custom updates are applied only on your specific instructions.
We never use site visitor data for our own purposes beyond what's needed for hosting/maintenance/support.
We apply the same security safeguards (Section 6) and treat all such data as confidential.
Analytics on client websites use Google Analytics (integrated as standard with the service). We provide a very basic default privacy policy template for your website that covers Google Analytics usage, but we highly recommend that you customize and expand it as needed for your specific business and compliance requirements. This default template is provided only as a starting point — we do not take any responsibility for its completeness or suitability, and you remain ultimately responsible for your website's privacy notice and overall POPIA compliance.
If you request transfer of the site/code (per our T&Cs), we hand over control, and our operator role ends — no further processing by us.
You remain responsible for obtaining any necessary consents from site visitors (including for Google Analytics cookies), posting your own privacy notice on the site, and handling data subject requests related to the site's data.

5. Cookies & tracking on our website

We use only essential cookies to make the site work. Optional analytics cookies are 100% anonymised and can be rejected via the cookie banner. No advertising or cross-site tracking.

6. How we keep your data safe

We use enterprise-grade security measures on every platform we touch:

End-to-end encryption in transit (TLS 1.3) and at rest (AES-256 where available)
Mandatory two-factor authentication (2FA) for all team members and systems
Strict role-based access controls — no one sees data they don't strictly need
All credentials and API keys stored in encrypted vaults
Regular third-party penetration tests and security audits
All third-party processors are SOC 2, ISO 27001, or equivalently certified and bound by operator agreements that fully satisfy POPIA Section 21
This includes personal information processed on client-hosted websites, where we implement appropriate technical and organisational measures as required for operators under POPIA Section 21

We're happy to share our full sub-processor list and certifications with any client.

7. How long we keep your data

Type of data	Retention period
Contact form / audit booking data	12 months after last contact (or sooner if you ask us to delete)
Client project data & lead lists	Duration of contract + 90 days (then handed to you or deleted)
Cold outreach campaign contacts	Maximum 30 days after last touch (unless client gives written justification)
Unsubscribed / opted-out contacts	Removed within 48 hours — only kept on permanent suppression list
Website analytics	Maximum 26 months (anonymised after 30 days where possible)
Invoices & accounting records	5 years (required by South African & Mauritian tax law)
Client website data (forms/analytics)	Duration of hosting agreement + 90 days after termination/transfer (then deleted unless legally required to retain)

8. Your rights — you stay in control

Under POPIA (and GDPR if you're in the EU) you can, completely free:

See every piece of data we have about you
Correct anything wrong
Ask us to delete or restrict it
Object to any processing (especially marketing)
Get your data in a portable format
Withdraw consent anytime

Email seb@leadpointsai.com

For data collected via a client website we host/maintain, requests should usually be directed to the client (responsible party) first, but we will assist as operator where required.

You can also complain to the Information Regulator (South Africa) or the Data Protection Commission (Mauritius) once we're registered there.

9. International data transfers

Your data is processed primarily in South Africa and the European Union. Limited transfers to the United States only happen through processors protected by Standard Contractual Clauses and additional safeguards (encryption + access controls). This may include hosting infrastructure for client websites and Google Analytics processing.

10. Contact us

Email: seb@leadpointsai.com

Once we complete registration in Mauritius, we'll add the official company number and registered address here.

Thank you for trusting us with your data. We treat it exactly the way we'd want ours treated.
— LeadPointsAi Team