GDPR and data processing terms.

Version 2026-10-01. Lead Finder is operated by Overbuilt Studio SRL, Bucuresti, Romania ("we", "us"). Questions: hello@madefast.dev.

These data processing terms are part of the Terms of Service and meet Article 28 of the GDPR. "You" are the user and controller; "we" are the processor.

1. Subject, duration and nature

• Subject: running searches for business leads on public sources through your Apify account, returning the results to you, and remembering who you already saw or asked us to exclude.
• Data subjects: business contacts and people who post publicly about topics you search (LinkedIn members, Reddit users, Instagram accounts).
• Data: names, public profile details (headline, role, company, location, public posts and comments, profile links), and, if you ask for it, a business email address found by the scraper. No special categories on purpose.
• Duration: results for at most 12 hours; keyed fingerprints for 1 year; do-not-contact fingerprints until you remove them; all of it is deleted when your account is deleted.

2. Our commitments

1. We process lead data only on your documented instructions (your searches and tool calls, these terms) and tell you if an instruction seems unlawful.
2. Only people who need access to run the service have it, under confidentiality.
3. Security: encrypted connections; your Apify token encrypted at rest; each user's data isolated; deleted rows overwritten; no lead data in logs; results excluded from long-term backups by their 12-hour lifetime; access to the admin panel restricted.
4. Sub-processors: hosting (Hetzner Online GmbH, servers in Germany). We will announce changes in advance so you can object. Apify, the scrapers you run and Anthropic are your own providers, not ours.
5. We help you answer requests from people (access, deletion, objection): forget_person deletes someone and blocks them; our support helps with anything else.
6. We tell you without undue delay, and within 48 hours where possible, after we learn of a personal data breach affecting your data, so you can meet your 72-hour deadline.
7. We help with data protection impact assessments and consultations where needed, and give you the information needed to show compliance (including reasonable audits, on notice).
8. At the end, we delete your data (it expires on its own within 12 hours; fingerprints are deleted with your account).

3. Transfers

Our servers are in the EU/EEA. Scrapers you run on Apify may use their own providers outside the EU (for example HarvestAPI's LinkedIn actors are operated from Hong Kong); that transfer is part of your relationship with Apify and the actor developer, and you should check it covers your use.

4. Your duties as controller (short version)

• Have and document a lawful basis (a short legitimate-interest assessment per campaign is good practice).
• Inform people at first contact (text below), honour objections at once, and keep your own files lean.
• Follow the electronic marketing rules of the recipient's country.

5. Text to inform the people you contact

Add a line like this to your first message (adapt the bracketed parts). The Lead Finder plugin adds it to drafts for you.

Short version for connection notes: "Found your profile on LinkedIn. Not interested? Just say so and I'll delete your details."