Privacy policy

1. Purpose and scope

This policy explains how LEADSTAR processes personal data through its website and B2B service. Leadstar does not offer paid individual subscriptions; access is provided by a client organisation.

Leadstar is designed to support execution and decision-making. It is not designed to monitor, score, rank or individually evaluate employees.

2. Identity and contact

LEADSTAR is a French SASU located at 229 rue Saint-Honoré, 75001 Paris, France, registered under number 929 763 985 R.C.S. Paris.

For any question or request relating to personal data, contact eva+support@leadstar.co. You may also lodge a complaint with the French Data Protection Authority (CNIL).

3. Respective roles

For processing carried out at a client organisation’s request to provide the service to its staff, the client organisation determines the purposes of the deployment and generally acts as data controller. Leadstar then acts as data processor on the client’s documented instructions.

Leadstar acts as controller for its own purposes, including commercial relationship management, service security, supplier-account management, support and requests received directly.

The exact qualification may depend on the contractual and functional context and is specified in the data-processing agreement entered into with the client.

4. Data processed

Depending on the features enabled, Leadstar may process:

• account and identification data: first name, last name, professional email address, technical identifier, organisation and role;
• professional information supplied during onboarding: position, responsibilities, priorities, objectives and work context;
• agent conversations: messages, responses, transmitted context and feedback;
• voluntary user statements, including reported mood or energy level;
• files and contextual materials submitted for a mission, when this feature is enabled;
• usage data: feature used, date, time and events required to operate the service;
• technical and security data: IP address, device, browser, connection logs, errors and security traces;
• information required for support and management of the client relationship.

Users should not submit sensitive data or third-party data that is not necessary. If such data is nevertheless entered into a free-text field, it is processed only to provide the requested feature and in accordance with the applicable instructions.

5. Purposes and legal bases

Provision of the B2B service

Account creation, authentication, agent personalisation, response generation, objective tracking and production of the reports agreed with the client.

Where Leadstar acts as processor, the client organisation determines the legal basis. Leadstar processes data under the contract and the client’s documented instructions.

Security and continuity

Preventing unauthorised access, diagnosing errors, logging, incident management and service continuity. For its own processing, Leadstar relies on its legitimate interest in securing and administering the service and, where applicable, its legal obligations.

Support and commercial relationship

Handling requests, arranging demonstrations and preparing and performing contracts. These activities rely on pre-contractual steps, performance of the contract or Leadstar’s legitimate interest in managing a B2B relationship.

Communications

Sending messages required for the service and, where applicable, professional communications about Leadstar. Recipients may object to non-essential communications.

6. Conversation confidentiality and collective reporting

Individual conversations are not made available to the client organisation and must not be used for individual HR decisions.

Collective reporting is designed not to display individual identities or verbatim statements. It is displayed only when at least seven distinct contributors are represented. This threshold reduces re-identification risk but does not, by itself, make all data legally anonymous.

Leadstar prohibits use of the service to recruit, discipline, dismiss, score, rank or individually evaluate an employee, or to make an automated decision producing legal or similarly significant effects.

7. Artificial intelligence

Conversations are processed using OpenAI’s business API. Leadstar has entered into OpenAI’s Data Processing Addendum (DPA). Data submitted through the API is not used to train or improve OpenAI models unless the API account holder explicitly opts in to data sharing.

Leadstar has disabled API call logging at organisation level and configures compatible calls with store: false, so that the relevant responses are not retained by OpenAI as application state. Depending on the service and the controls for which the organisation is eligible, OpenAI may still apply limited abuse-monitoring logs for up to thirty days.

Anthropic may be used for certain internal or editorial processing, but not for individual user conversations within the scope of this policy.

For further information, see our AI transparency notice.

8. Recipients and subprocessors

Data is accessible only to authorised persons and providers required to deliver the service. The main categories are hosting, authentication, artificial intelligence and service-related messaging.

The detailed list, including each provider’s purpose and stated location, is available in our public subprocessor register.

Leadstar does not sell personal data.

9. Locations and international transfers

Leadstar’s core application, PostgreSQL, Redis and object storage are hosted by Clever Cloud in its Paris region.

Certain specialist providers may process data outside the European Economic Area. Where required by the GDPR, these transfers are covered by an adequacy decision, Standard Contractual Clauses, a data-processing agreement and, where necessary, supplementary measures. For enterprise deployments, active providers, regions and applicable safeguards are specified in the contractual documentation.

10. Retention periods

• raw conversations used by the agent: 30 days;
• pseudonymised signals derived from conversations: 18 months;
• collective aggregates: 36 months;
• Clever Cloud infrastructure logs: generally 7 days;
• Clever Cloud operational PostgreSQL backups: 7 days;
• account data: for the duration of the contract, followed by deletion or return within no more than 60 days, subject to legal obligations and backup cycles;
• support and commercial-relationship data: for the period required to process the request and defend Leadstar’s rights, within applicable statutory limits.

Data may be retained for longer where required by law, necessary to establish, exercise or defend legal claims, or where an incident requires controlled preservation.

11. Security

Leadstar applies measures proportionate to the risks, including encryption in transit, named production access, strong authentication for hosting, environment separation, security logging and scheduled conversation deletion.

No measure eliminates all risk. Leadstar maintains an ongoing improvement process. Public information is available in the Trust Center.

12. Your rights

Depending on the processing and its legal basis, you may request access, rectification, erasure, restriction or portability of your data, or object to certain processing. You may withdraw consent where processing relies on consent.

Where Leadstar acts as processor, the request may be forwarded to the client organisation acting as controller. Leadstar will assist it in accordance with the contract.

Send requests to eva+support@leadstar.co. Leadstar responds within one month, subject to any extension permitted by law. Proportionate identity verification may be requested.

A user may object to their contributions being used in collective reporting. In that case, the relevant contributions are excluded from that processing.

13. Changes to this policy

This policy may change to reflect developments in the product, providers or applicable law. The latest update date appears at the top of the page. Material changes are communicated to affected clients or users through an appropriate channel.