Start free
GDPR & DPA

GDPR and Data Processing notice

Effective date: 26 May 2026

This notice describes how LEADARO complies with Regulation (EU) 2016/679 (the "GDPR") and explains how operators (workspace owners) can obtain a signed Data Processing Agreement ("DPA") for their tenancy. It is published as a companion to the Privacy Policy and the Terms of Service; in case of conflict on a specific clause, the signed DPA prevails over this notice and the Privacy Policy.

LEADARO is a B2B SaaS platform operated by The Brand Doers Media SRL (CUI RO40413030, Bucharest, Romania) — the LEADARO product brand sits inside this legal entity. We operate primarily as a Data Processor for the lead, client and conversation data that operators bring into their workspace. We operate as a Data Controller for a narrow set of account and billing data we collect directly from operators when they sign up. Both roles are covered below.

  • Processor role. For lead records, conversation transcripts (WhatsApp / SMS / voice calls / chatbot / email), bookings, notes, integration credentials and AI-generated drafts inside a workspace, the workspace owner is the Data Controller and LEADARO is the Data Processor acting on their documented instructions.
  • Controller role. For the account email, name, password hash, billing identifiers, audit logs of authentication events, and the marketing-website inquiry form submissions, LEADARO is the Data Controller.
  • Joint processing does not apply. We do not jointly determine purposes and means with operators for the data inside their workspaces.

Under the processor relationship, LEADARO processes the following categories of personal data only to deliver the contracted service:

  • Contact data of the operator's end-customers (name, phone, email, social handle).
  • Conversation content across the channels the operator has connected (WhatsApp Cloud, Meta Messenger / Instagram DM, voice via Twilio and Google Gemini, SMS via Twilio, chatbot, email via Postmark).
  • Lead status, qualification answers, booking metadata, follow-up activity.
  • Integration credentials (encrypted refresh tokens) supplied by the operator to connect their own third-party accounts.

Special categories of personal data (Article 9 GDPR — health, biometric, etc.) are not within the intended scope of the service. Operators in regulated verticals (e.g. clinics) must avoid pushing such data into LEADARO unless their own DPA addendum explicitly authorizes it.

Data subjects have the following rights under Articles 15–22 GDPR:

  • Access — receive a copy of personal data held about them.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten") — subject to legal-obligation exceptions.
  • Restriction — pause processing in defined circumstances.
  • Portability — receive their data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • No fully-automated decisions with legal effect — LEADARO's AI surfaces produce drafts and recommendations for human review; the operator's human team makes the operator-facing decisions (qualification, booking confirmation, hand-off).

Because LEADARO is the Processor for workspace data, rights requests from end customers should be addressed to the operator (the workspace that captured the lead). The operator can then use the platform's export and deletion tools, or request our assistance under the DPA, to fulfill the request. See /legal/data-deletion for the deletion workflow.

The following sub-processors are engaged in delivering the LEADARO service. Each is bound by a written agreement (DPA or equivalent) and is restricted to processing data on documented instructions:

  • Supabase Inc. — managed PostgreSQL database, authentication, object storage. Region: Ireland (EU). supabase.com/privacy.
  • Vercel Inc. — application hosting, edge runtime, structured logging. Primary region: United States; EU edge routing applied to public traffic. vercel.com/legal/privacy-policy.
  • Wildbit (Postmark) — transactional email and operator-initiated email send. EEA routing where available. postmarkapp.com/privacy-policy.
  • Anthropic PBC — Claude LLM inference for AI Brain features. United States. Data processed under Anthropic's DPA and not used to train models. anthropic.com/legal/privacy.
  • OpenAI OpCo LLC — GPT LLM inference for AI Brain features. United States. Data processed under OpenAI's DPA and not used to train models. openai.com/policies/privacy-policy.
  • Google LLC — voice AI (Gemini real-time speech model). United States. policies.google.com/privacy.
  • Twilio Inc. — PSTN voice trunk and SMS in supported markets. United States with EU regional storage where available. twilio.com/legal/privacy.
  • Meta Platforms Ireland Ltd. — WhatsApp Cloud, Messenger and Instagram DM access through the Meta Graph API. Ireland (EU). facebook.com/privacy/policy.
  • Better Stack — operational log retention and alerting (no personal data of end customers; only operational metadata, request IDs, and audit events). EU region. betterstack.com/privacy.

We notify operators in writing (email to the workspace owner address) at least 14 days before adding or replacing a sub-processor that processes workspace data. Operators who object on reasonable, documented data-protection grounds may terminate the affected workspace under the Terms of Service.

Personal data is stored at rest in the European Union (Supabase, Ireland). Some sub-processors (Vercel, Anthropic, OpenAI, Google, Twilio, Better Stack) operate from the United States. For these transfers we rely on:

  • European Commission Standard Contractual Clauses (SCCs) signed with each US sub-processor;
  • Supplementary technical measures including TLS 1.2+ in transit, AES-256 at rest, secret-key isolation, and minimization of personal data sent to each sub-processor;
  • Self-certification under the EU-US Data Privacy Framework where the sub-processor publishes one (we do not rely on the DPF alone).
  • Workspace business data — retained for the lifetime of the workspace, including conversation history (we do not auto-purge conversations on a fixed schedule). Operators may request deletion of specific conversations, leads, or the entire workspace data set in writing at any time; per-record deletion completes within 30 days of the request, end-of-workspace deletion completes within 30 days of account closure.
  • Integration credentials — until the operator disconnects the integration.
  • Account data — for the lifetime of the LEADARO account; deleted within 30 days of account closure unless legally required to retain longer.
  • Technical and security logs — 90 days, then aggregated or deleted.
  • Supabase database backups — daily backups retained for 7 days. Point-in-time recovery is not currently enabled. Deletions in the production database propagate to subsequent daily backups; the deleted rows expire from the backup window within 7 days.
  • Invoices and tax records — 10 years, as required by Romanian fiscal law.

See the Security overview for the full set of measures. Summary:

  • AES-256-GCM encryption at rest for integration credentials; the per-environment encryption key is held in a separate secret manager.
  • TLS 1.2+ in transit for every public and internal endpoint.
  • Per-workspace Row-Level Security policies enforced at the database tier and verified by a CI policy suite.
  • Three-layer multi-tenant isolation (route-handler membership check, RLS, per-workspace credentials).
  • Operational alerting on Better Stack with a 24/7 on-call rotation.
  • Access to production data restricted to named operators under the principle of least privilege.

In the event of a confirmed personal data breach involving workspace data, LEADARO will:

  • Notify affected operators in writing without undue delay and in any event within 72 hours of becoming aware of the breach;
  • Provide the operator with the information required by Article 33(3) GDPR (nature of the breach, categories and approximate numbers affected, likely consequences, mitigation taken);
  • Cooperate with the operator's own data-subject notification obligations where applicable.

The operator (as Data Controller) is responsible for notifying their supervisory authority and, where required, their data subjects.

Operators on a paid plan may request a signed Data Processing Agreement at any time. Email office@thebrandoers.com with subject line "DPA request" and the workspace ID. We return a countersigned PDF within 10 business days. The DPA incorporates the EU Commission's 2021/914 SCCs by reference for any sub-processor transfer outside the EEA.

General data-protection inquiries and rights requests should be sent to office@thebrandoers.com. LEADARO has not appointed a designated Data Protection Officer because the processing does not meet the mandatory-DPO thresholds in Article 37 GDPR (no large-scale special-category processing as our core activity); the operator-facing privacy inbox above is monitored as the single point of contact.

Data subjects who believe their rights have not been respected may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro or with the supervisory authority of their EU country of residence.