Privacy Policy

Last updated: 4 July 2026

1. Who we are

LeadKing is operated by Kabaata (“we”, “us”). For privacy matters contact support@kabaata.com.

This policy explains how we handle personal data across our website and the LeadKing application. In short: we collect what’s needed to run a sales engagement product, we don’t sell personal data, we don’t run advertising trackers, and business-lead data belongs to the customer who manages it.

2. Two roles: controller and processor

We wear two hats, and your rights route differently depending on which applies:

  • For LeadKing users (our customers) — account, billing, and usage data — we are the data controller.
  • For leads and prospects managed by our customers inside LeadKing, the customer is the controller and we act as their processor: we store and process that data only to provide the service to them.

3. If you are a LeadKing user — what we collect

  • Account data: email address, password (stored as a hash by our authentication provider), name, and company details you add to your profile.
  • Billing data: your plan, subscription status, and billing cycle. Payments are handled by Mollie; we never see or store your full card or bank details.
  • Connected LinkedIn account: when you connect LinkedIn, our connectivity provider (Unipile) holds the authenticated session; we store the account identifier, display name, and profile picture. We never see or store your LinkedIn password.
  • Content: your campaigns, ICP descriptions, message drafts, and the conversations synced from your connected account so you can read and reply in the inbox.
  • Usage and log data: feature usage counters (e.g. plan limits), and technical logs (IP address, browser type, timestamps) kept for security and debugging.
  • Support: messages you send us.

4. Why we use it (legal bases)

  • To provide the Service (contract): accounts, campaigns, LinkedIn connectivity, inbox, billing.
  • To secure and improve the Service (legitimate interests): logs, abuse prevention, usage limits, product analytics based on aggregate usage.
  • To communicate with you (contract / legitimate interests): transactional emails such as email confirmation, password reset, security notices, and service updates.
  • To comply with law (legal obligation): tax and accounting records via our payment provider.

We do not sell personal data and we do not use it for third-party advertising.

5. If you are a lead or prospect — read this

A LeadKing customer may manage information about you in our platform for business-to-business outreach. That data typically includes your name, professional headline, role, company, public profile URL and picture, and business contact details.

  • Where it comes from: your publicly visible professional profile (e.g. LinkedIn), accessed through the customer’s own LinkedIn account, or data the customer imported themselves.
  • Why: the customer’s business outreach to professionally relevant contacts, normally based on their legitimate interest in B2B prospecting.
  • Who is responsible: the customer who contacted you is the controller of this processing; we process the data on their behalf.
  • Your rights: you can object to the processing or ask for access, correction, or erasure at any time — reply directly to the person who contacted you, or email support@kabaata.com and we will forward your request to the responsible customer and ensure removal from our systems where we are able to.

6. AI processing

Campaign context and message drafts are sent to AI model providers (OpenAI and Anthropic) to generate copy and power the assistant. Under their API terms, these providers do not use API data to train their models. AI output is drafting assistance — customers review messages before sending.

7. Who we share data with (subprocessors)

We share personal data only with the providers we need to run LeadKing, under data processing agreements:

  • Supabase — database, authentication, and file storage (EU region, Frankfurt).
  • Vercel — application hosting and delivery.
  • Unipile — LinkedIn connectivity; holds the authenticated LinkedIn session for connected accounts.
  • Mollie — payment processing (Netherlands).
  • Resend — transactional email delivery.
  • OpenAI and Anthropic — AI text generation.
  • Serper and Firecrawl — web search and website content retrieval used to research companies for campaign copy.

Some providers process data in the United States. Where personal data leaves the EEA/UK, we rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework as applicable. We may disclose data where required by law.

8. Retention

  • Account data: kept while your account exists; deleted within 30 days of account deletion (backups purge within a further ~30 days).
  • Lead data: kept until the responsible customer deletes it or their account is deleted.
  • Billing records: kept as long as tax law requires.
  • Logs: kept for a short rolling window for security and debugging.

9. Security

Data is encrypted in transit; production access is restricted and credentialed; LinkedIn sessions are held by our connectivity provider rather than in our application database; payments never touch our servers. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you and the competent authority as required by law.

10. Cookies and local storage

We use only essential cookies: authentication session cookies (set by our auth provider) that keep you signed in. Your theme preference is stored in your browser’s local storage. We currently use no advertising or third-party analytics cookies — which is why you don’t see a cookie banner. If this changes, we will update this policy and ask for consent where required.

11. Your rights

If you are in the EEA, UK, or a jurisdiction with similar laws, you can request: access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time.

Write to support@kabaata.com — we respond within one month. You can also lodge a complaint with your local supervisory authority.

12. Children

LeadKing is a business tool and not directed at anyone under 18. We do not knowingly process children’s data.

13. Changes to this policy

We will post updates here and, for material changes, notify you by email or in the product. The date at the top shows the latest revision.