LEAD SAVAGE PRIVACY NOTICE

Last Updated: October 1, 2026

This Privacy Notice explains how Lead Savage ("we", "us" or "our"), incorporated in United States, collects, uses, shares, and stores personal information.

Lead Savage provides marketing automation software and related services to service-based businesses. We use personal data primarily to provide access to our platform, deliver and support our services, and understand how our website and platform are used. We are committed to protecting your privacy, and this Notice explains our data practices to support transparency and compliance with applicable privacy laws. For questions, contact us at [email protected].

Definitions

• Personal data (also referred to as Personal information) - Information that identifies, relates to, or could reasonably be linked with a particular individual.

• Processing - Any action or operation performed on personal information, such as collection, storage, use, disclosure, or deletion.

• Controller (also referred to as Business under certain state laws) - The entity that determines the purposes and means of processing personal data.

• Processor (also referred to as Service Provider or Contractor under certain state laws) - A third party that processes personal data on behalf of the Controller for the purposes of this policy, based on documented instructions and without determining the purposes or means of the processing.

Data controller and contact information

Lead Savage acts as the Controller of personal information about our website visitors, prospects, and customers, and as a Processor of the Client Data we handle on behalf of our clients.

Address:

115 E Main St, Ste. A1B-9H

Buford Georgia 30518

United States

Email: [email protected]

The information we collect

We collect personal information to provide and improve our services, tailor your experience, and meet legal or operational needs. Below, we explain the types of information we may collect when you use our services, such as our website, apps, or other platforms, to help you understand how your personal data is used.

In the course of our activities, we process information about individuals in different roles. You may fall into one or more of the categories listed below, depending on how you interact with our services: Customers,Users,Website visitors,Partners,Vendor representatives

We also process personal information about prospects and leads, webinar and event attendees, and the contacts and customers of our client businesses (processed on our clients' behalf).

Categories of information we collect when you interact with our website:

Categories of information we collect when you create an account with us:

Legal grounds for processing

The table below describes the purposes and legal grounds for processing your personal information:

We use automated systems to make decisions that help deliver our services efficiently, improve user experiences, or protect our systems. These systems process your personal information using algorithms or predefined rules without human intervention.

We rely on legitimate interests to use automated tools for fraud prevention and security monitoring, and on your consent for interest-based advertising through cookies and pixels. You can withdraw your consent to advertising cookies at any time through our cookie settings.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. We use AI tools to help configure accounts and draft copy for a client's own campaigns; that content stays within the client's account and is never used to train AI models or improve services outside that account. Clients may choose to enable AI features within their own accounts (such as AI assistants that respond to their leads), and the client controls how those features are used with their contacts. Interest-based advertising relies on your consent to advertising cookies, which you can withdraw at any time.

• We use automated processes to analyze your preferences, such as browsing or purchase history, to show you ads or content tailored to your interests. This helps deliver relevant offers or recommendations, enhancing your experience while respecting your privacy settings and preferences.

• We employ automated tools to detect potential fraud or security threats by analyzing patterns in data, like irregular transactions or login locations. This allows us to respond quickly to suspicious activity, protecting your account and personal information from misuse or cyberattacks.

Data selling to third parties

Under a number of state laws, "sale" of personal information refers to sharing or disclosing your personal information, such as your name, email, or browsing habits, with third parties in exchange for money or other benefits, like services or business advantages.

We share your personal information with certain third parties to support our services, enhance user experiences, or comply with legal and business requirements. Any sharing is limited to what is necessary for the specified purposes. Below are the categories of third parties with whom we may share your personal information:

• Ad networks and platforms: To deliver targeted advertisements or measure ad campaign effectiveness, such as sharing data about your interests to show relevant ads, using anonymized or aggregated data where possible. This may involve receiving payment or free ad services in return.

• Analytics and audience segmentation tools: To analyze user behavior, like tracking feature usage to group you with similar users, optimizing our services, often with de-identified data. This may involve trading data for analytics services.

• Advertising and analytics providers such as Google (Google Analytics and Google Ads) and Meta Platforms (Meta Pixel), used for ad measurement, remarketing, and interest-based advertising when you consent to advertising cookies.

Disclosure to third parties

We share personal information with the following categories of third parties to operate our business and provide our Services. These recipients may use your personal information only for the purposes for which it was shared:

• Cloud infrastructure and hosting providers

• Analytics and measurement platforms

• Communication service providers (email and SMS)

• Payment processors and financial intermediaries

• Advertising technology providers

• Customer support and CRM platforms

• Auditors and professional advisors

• Public or regulatory authorities, where required by law

• Outsourced technical support providers who may access client accounts to troubleshoot issues

• Telecommunications carriers and messaging aggregators, for SMS delivery and A2P 10DLC carrier registration

• Domain, website, and email deliverability service providers

• Parties involved in a merger, acquisition, financing, or sale of business assets

International data transfers

For transfers of your personal information outside the European Union or European Economic Area, we follow the requirements of the GDPR to protect your personal information. Such transfers may occur to support our operations, such as engaging third-party service providers or affiliates located globally. To support compliance, we use the following mechanisms:

When your personal information is transferred outside of the United Kingdom, such transfers are done in accordance with the requirements of the Data Protection Act 2018 and the UK Data (Use and Access) Act 2025. These transfers may be necessary to provide our services, such as hosting data with international cloud providers or sharing with global partners. To protect your personal data, we implement the following safeguards:

When we transfer your personal information to a country outside the UK, EU, or EEA that has data protection laws similar to the GDPR, we apply safeguards to secure your personal data. Such transfers may occur to support our services, such as processing or storage by third-party providers. We only transfer data where there are adequate safeguards in place, including:

• Standard Contractual Clauses (SCCs): Legally binding agreements approved by relevant authorities to confirm that the recipient protects your personal data, consistent with GDPR-like requirements.

• Adequacy Decision: Where the receiving country is recognized as providing a level of data protection equivalent to GDPR standards.

Retention of information

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including providing our services and complying with applicable legal obligations. The retention period depends on various factors, including the nature of the information, its intended purpose, and applicable legal or regulatory requirements.

Your personal information is retained only as long as needed for the purposes described in this notice or as required by law, as follows: account information is kept while your account is active and for a reasonable period after cancellation to resolve disputes or meet legal obligations; Client Data and account content (contacts, conversations, files, workflows, forms, and reporting) is permanently deleted when you cancel your account and cannot be recovered, so please export anything you want to keep before cancelling; transaction and billing records are kept for 7 years for tax and accounting purposes; communications records are kept for 3 to 7 years depending on the nature of the communication; SMS opt-out records are kept indefinitely so opt-out requests are always honored; SMS delivery logs are kept for 90 days; technical and security logs are kept for 90 days to 2 years; and marketing data is kept until you opt out or it is no longer needed. Deletion requests sent to [email protected] are completed within 45 days, subject to legal retention requirements. When your personal information is no longer necessary for the purposes for which it was collected or required by law, we employ secure erasure methods to permanently delete it. This process results in your personal information being irretrievable, using industry-standard techniques to overwrite or remove it from our systems, in compliance with applicable data protection laws.

How we protect your personal information

We take the security of your personal information seriously and use a combination of technical and organizational measures to keep it safe. Below, we explain the steps we take in simple terms to protect your personal data and uphold responsible handling practices.

• Encryption in transit and at rest:

  We use advanced encryption to protect your personal data, like your name or contact details, both when it is sent (e.g., when you submit a form on our website) and when stored on our servers. Encryption scrambles your personal data into a code that only authorized systems with a secure key can unlock, which keeps your sensitive information private even if intercepted or targeted by hackers.

• Firewalls and intrusion detection/prevention systems:

  We deploy digital barriers called firewalls and advanced monitoring tools to block unauthorized access and detect potential threats, like hacking attempts. Firewalls act as security gates, allowing only trusted traffic, while intrusion detection alerts us to suspicious activity, and prevention systems stop attacks, keeping your personal information safe from cybercriminals.

• Role-based access control (RBAC):

  We limit access to your personal data by assigning specific roles to employees, so only those who need your information for their job, like billing staff accessing payment details, can view it. This reduces the risk of mishandling or unauthorized access, keeping your personal data visible only to those with a legitimate need.

• Multi-factor authentication (MFA):

  We require extra identity verification steps, such as a password plus a code sent to a phone or email, to access our systems. This added layer of security makes it much harder for unauthorized individuals to gain access, even if a password is compromised, protecting your personal data from impostors.

• Internal data protection policies and guidelines:

  We maintain clear, detailed rules that all employees follow to handle your personal information responsibly.

• Strict access management and user roles:

  We tightly control who can access your information by assigning specific roles and permissions, so only employees with a legitimate need can see your personal data.

• Incident response and breach notification procedures:

  If a security issue, like a data breach, occurs, we have a clear plan in place to respond and notify you if your data is affected, as required by law.

• Service providers with access to client accounts use individually assigned accounts with no shared credentials, multi-factor authentication where supported, and least-privilege access. We maintain a current access inventory, review administrative privileges, remove access promptly when a role changes or ends, and preserve access logs. Suspected security incidents are escalated immediately, and affected clients are notified without undue delay and no later than 72 hours after we become aware that an incident has affected or is reasonably likely to affect their data. Data is encrypted in transit using SSL/TLS, and we maintain backup and disaster recovery measures through our infrastructure providers.

Your rights with regard to your personal information

If you are a resident of the United States, you have rights regarding your personal information under state privacy laws, such as California’s Consumer Privacy Act (CCPA) or similar laws in states like Virginia, Colorado, Connecticut, Utah, or others. These rights allow you to control how your personal data is collected, used, and shared. Below, we explain the rights you have and how to exercise them to manage your personal information.

• Right to know: You can request details about the personal information we collect, use, share, or sell, such as your name, email, browsing history, or transaction details. This includes the categories of data, why we collect it, and who we share it with (e.g., third-party vendors). This helps you understand how your information is handled and what it is used for.

• Right to access: You can ask for a copy of the personal information we hold about you, like your account details or purchase history.

• Right to deletion: You can request that we delete your personal information, such as your profile data or usage records. We will remove it where possible, unless we need to keep it for legal reasons, like fraud prevention or complying with regulations, helping you limit the data we hold.

• Right to correct: If the information we have about you, like your contact details or billing information, is inaccurate, you can ask us to update or correct it. This keeps your personal data accurate, so our services work correctly for you.

• Right to opt out of sale or sharing: You can opt out of us selling or sharing your personal information with third parties, such as for targeted advertising (e.g., based on your browsing habits).

• Right to limit use of sensitive information: You can request that we limit the use of sensitive data, such as financial details or precise location, to only what is necessary for providing services. This helps protect your most private information from unnecessary processing.

• Right to non-discrimination: We will not treat you differently, such as by denying services or charging higher prices, if you exercise your privacy rights. This means you can use these rights freely without penalty.

If you are a resident of the European Union, European Economic Area, Switzerland, the United Kingdom, or another jurisdiction with similar data protection laws, you have several rights concerning your personal information. Below, we outline these rights and explain how you can exercise them to manage how your personal data is handled.

• Right to access: You can request a copy of the personal information we hold about you, such as your account details or browsing history. This helps you understand what data we have and how we use it. We will provide this information in a clear, readable format, typically within one month, unless your request is complex.

• Right to rectification: If the information we have about you, like your name or email, is inaccurate or incomplete, you can ask us to correct or update it, helping keep your personal data accurate and supporting the proper operation of our services for you.

• Right to erasure (right to be forgotten): You can request that we delete your personal information, for example, if it is no longer needed for the purpose it was collected or if you withdraw your consent. We will remove it where possible, unless we are required to keep it for legal reasons, like complying with regulations.

• Right to restrict processing: You can ask us to limit how we use your personal data, for instance, if you believe it is inaccurate or being used unlawfully. This means we will pause certain processing activities, like targeted advertising, while still storing your personal data securely, giving you control over its use.

• Right to data portability: You can request your personal data in a structured, commonly used, and machine-readable format, such as a CSV file, to transfer it to another service. This applies to data you provided directly, like your profile information, and helps you move or reuse your personal data easily.

• Right to object: You can object to certain uses of your personal data, such as for direct marketing or profiling based on our legitimate interests (e.g., fraud detection). If you object, we will stop that processing unless we have compelling reasons, like legal obligations, so that your preferences are respected.

• Right to withdraw consent: When we process your personal data based on your consent, such as for personalized ads, you can withdraw that consent at any time. We’ll stop processing your personal data for that purpose, though this may affect some services, like tailored recommendations.

If you are a resident of Mexico, you have ARCO rights (Access, Rectification, Cancellation, Opposition) under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

• Right to access: You can request details about the personal information we collect, like your name or purchase history, to understand how it is used and who it is shared with.

• Right to rectification: If your information, like your address, is inaccurate, you can ask us to correct it to keep your personal data up to date.

• Right to cancellation: You can request deletion of your personal data, such as account details, if it is no longer needed. We will remove it unless required for legal reasons, like tax obligations.

• Right to opposition: You can object to certain uses of your personal data, like direct marketing or profiling, to limit how we process it, giving you control over its use.

If you are a resident of Brazil, you have rights under the General Data Protection Law (LGPD, Law No. 13,709/2018) to manage your personal information, such as your contact details or usage data.

• Right to access: You can request a copy of your personal data, like your profile or transaction history, to see what we collect and how it is used, provided in a clear format.

• Right to correction: If your information, like your email, is wrong, you can ask us to update it to keep your personal data accurate.

• Right to deletion: You can request deletion of your personal data, such as account information, if it is no longer needed or you withdraw consent, unless we must keep it for legal reasons.

• Right to data portability: You can request your personal data in a portable format to transfer to another service, making it easier to move your information.

• Right to object: You can object to processing, like targeted advertising or fraud detection, if you believe it violates your rights, and we will review the request.

• Right to information about sharing: You can ask who we share your personal data with, such as third-party vendors, to understand their use.

• Right to withdraw consent: When we rely on consent, like for personalized ads, you can withdraw it, which may affect certain services.

If you are a resident of Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial laws.

• Right to access: You can request a copy of your personal information, like your account or browsing data, to understand what we collect and how it is used, provided in a clear format.

• Right to correction: If your information, like your contact details, is inaccurate, you can ask us to fix it to keep your personal data correct.

• Right to withdraw consent: If we rely on your consent, such as for marketing or personalized ads, you can withdraw it at any time, which may limit related services, like tailored content.

If you are a resident of Australia, you have rights under the Privacy Act 1988, including the Australian Privacy Principles (APPs).

• Right to access: You can request a copy of your personal information, like your profile or purchase history, to see what we hold and how it is used, provided in a clear format.

• Right to correction: If your information, like your name or address, is incorrect, you can ask us to update it to keep your personal data accurate.

• Right to anonymity or pseudonymity: Where practical, you can interact with us anonymously or using a pseudonym, such as when browsing our site, to limit data collection.

• Right to stop direct marketing: You can request that we stop using your personal data for direct marketing, like targeted ads based on your browsing habits, giving you control over such communications.

• Rights related to automated decision-making: For automated decisions, like credit scoring or fraud detection, that significantly affect you (e.g., impacting loan eligibility), you can request details about the process to understand its impact, where applicable.

In addition to those listed above, for all mentioned locations, the rights you have related to automated decision-making are:

• Right to request human intervention: You can ask for a human to review an automated decision, such as a credit score that denies you a loan or an access restriction on your account. This allows a person to reassess the decision, considering additional context or information you provide, to help ensure the outcome is fair and appropriate for your situation.

• Right to contest the decision: You can challenge an automated decision that affects you by contesting - you can ask us to reconsider the decision, providing your perspective or additional details to address potential errors, helping to protect your interests and correct inaccuracies.

• Right to receive an explanation of the decision logic: You can request details about how an automated decision was made. We will provide an explanation of the key data and logic involved, helping you understand why the decision was reached and how your information was used.

• Right to opt out of profiling: You can opt out of profiling for automated decisions, such as targeted advertising based on your browsing habits or risk scoring for services, where permitted by law. This limits how we and our partners use your personal data to create profiles.

How to exercise your rights

To exercise any of these rights, or to withdraw your consent where consent has been given, please contact us using the details below:

Email: [email protected];

Phone: +14707476757;

You can submit a data subject request through our Privacy Widget. To do so:

1. Click here to re-open the widget.

2. Navigate to “Settings” to access the full menu.

3. Select and submit the relevant data subject request.

Please note that the types of requests available to you may vary depending on your location.

You can reach out to us by submitting a Data subject request form on our Governance Portal. To do so:

1. Click here to open the Portal.

2. Navigate to the “Privacy” section and click on "Data subject requests".

3. Select and submit the relevant data subject request.

Please note that the types of requests available to you may vary depending on your location.

Contact us

If you have any questions about this Privacy Notice or the way we handle your personal data, you can contact us using the details below:

Lead Savage

[email protected]

+14707476757

115 E Main St, Ste. A1B-9H

Buford, Georgia 30518

United States