1. Who is responsible
The controller for your personal data is Jaspero d.o.o., Drniška 9, 31000 Osijek, Croatia ("we", "us"), which runs Byline Leads. Contact us about privacy at hello@bylineleads.com.
2. What we collect from customers
- Account: your email address and, if you give it, your name. Sign-in links and sessions are stored only as one-way hashes.
- Billing: handled by Stripe. Stripe collects your card details; we never see or store the full card number. We receive and keep your Stripe customer ID, subscription status, trial and billing dates, and payment outcomes. When you open checkout we also send Stripe the time zone your browser reports, kept with your subscription, so our emails can state the trial deadline in your own time.
- Trackers: what you enter when you set one up: its name, your product's name, your website, a description of what you sell, the searches, the countries, an optional city or region, the platforms, how often to scan, whether to email you new results, your instructions for its replies, and the secret address of its private RSS feed.
- Your website: when you paste your website into a new tracker, our server fetches that public page once to suggest your product's name and description. We keep only what you then save.
- Results: for each tracker, the public pages we found in Google's results (address, title and the short snippet Google shows, platform, rank for each search and country, and when we first and last saw it), plus the status and notes you give them, and when each result was released to you (to apply the daily number of results).
- Sender brief: what you enter about yourself and your company: name, title, company, website, what it does, facts, expertise, an optional budget and your email signature.
- Drafts: the reply drafts we write automatically for results released to you, the new versions you ask for, and how many you asked for each day (to apply the fair-use limit).
- Notification channels: the channels you connect to receive new results: their type and name, the address you give us (an email address, a webhook URL or an ntfy topic address), which trackers they cover, and a log of each delivery (when, how many results, and whether it worked).
- Service emails: a record of which account, billing and digest emails we have sent you, so none is sent twice.
- Technical data: IP address, browser and request details in server logs, for security and to fix faults, kept for a limited period.
We use one essential cookie, which keeps you signed in. We do not use advertising or analytics cookies.
3. Why, and on what legal basis
- To provide the service you signed up for, including scans, results, drafts, digests and billing: performance of a contract (GDPR Art. 6(1)(b)).
- To keep invoices and payment records: legal obligation (Art. 6(1)(c)).
- To keep the service secure, prevent abuse such as repeated free trials, and send service messages: our legitimate interests (Art. 6(1)(f)).
We do not sell your data and do not use it for advertising.
4. Who processes it for us
- Stripe (payments and the billing portal).
- Serper (serper.dev, our search results provider). When a tracker scans, each search is sent to Serper together with its country, language and any city or region you set, and Serper returns Google's results for it. We send no name, email address or account details with a search. To avoid repeat requests, the results of a search are cached for the day they were fetched and may be reused for any customer who runs the same search that day; the cache holds the search and its results, not who ran it.
- Google Cloud (Vertex AI, which runs Google's Gemini models: search suggestions, match scores and drafts). When you ask for suggested searches, your product's name, description, website and countries are sent to Vertex AI. When a scan finds results, each result's title, snippet, address, search and country are sent together with what you told us about your product (including who buys it, the problems it solves and the alternatives people compare), so the model can score how well the result matches. When a result is released to you, a reply is drafted automatically, and again when you ask for a new version: your sender brief, what you told us about your product, your instructions for the tracker, and the result's title, snippet, address, search and country are sent.
- Hosting: Hetzner Online GmbH (servers in Ashburn, Virginia, USA) (runs the application and database).
- Email delivery: Resend (resend.com), USA (sign-in links, billing emails and new results by email).
Each processor handles data only on our instructions. Where data is transferred outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on the Commission's standard contractual clauses.
Services you choose. When you connect a notification channel, we send summaries of your new results (such as the tracker's name and each result's title, address, platform and rank) to the service you chose: Slack, Discord, Microsoft Teams, Google Chat, Mattermost, ntfy, or the webhook address you gave us (for example Zapier, Make or n8n). We send them because you asked us to; that service handles them under its own terms and privacy policy, not as our processor. Anyone who has a tracker's private RSS feed address can read that feed, so keep it to yourself.
5. People in search results
A result is a public page that Google shows for a search. Its title and snippet can contain the name or username of the person who posted it. We store only what Google's results show (the address, the title and the short snippet), not the page itself, and we do not build profiles of people.
- Purpose: to show our customers where public discussions about the products and services they sell are taking place, so they can take part in public.
- Legal basis: legitimate interests (Art. 6(1)(f)): our customers' interest in joining public discussions relevant to their business, which the authors chose to publish openly. Our terms forbid customers from using results to profile, track or privately contact anyone.
- Removal and objection: anyone can ask us to remove a result about them by writing to hello@bylineleads.com. We remove it within one month. As long as a page is public and Google still ranks it, a later scan can find it again; tell us and we remove it again. Removing or editing the post on the platform also removes it from Google over time.
This section is the information we give under GDPR Art. 14 to people who appear in our data.
6. How long we keep data
- Account, trackers, results, drafts and sender brief: while your account exists.
- Notification channels and their delivery log: until you remove the channel or your account.
- Deleting a tracker deletes its scans and results.
- Cached search results hold no customer details and are reused only on the day they were fetched.
- After you ask us to delete your account: deleted within 30 days, except billing records, which we keep for as long as tax and accounting law requires.
- Sign-in links expire after 30 minutes. Sessions last up to 30 days and are extended while you use them.
- Cancelling a subscription does not delete your account, so you can come back to your work. Ask us to delete it.
7. Your rights
You can ask for access to your data, a copy of it in a portable format, correction, deletion, restriction of processing, and you can object to processing based on legitimate interests. Write to hello@bylineleads.com from the email address on your account. We answer within one month.
You can also complain to a data protection authority: ours is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), azop.hr, or you can contact the authority where you live or work.
8. Security
Connections are encrypted. Sign-in links and sessions are stored as hashes, so a copy of our database would not let anyone sign in. Card details go directly to Stripe and never touch our servers. We never ask for, and never hold, your passwords for any social platform.
9. Children
Byline Leads is a business tool and is not meant for anyone under 16.
10. Changes
If we change this policy in a way that matters, we tell customers by email before the change applies. The date at the top shows the latest version.