Privacy Policy | Formlyy

At WhataLead (“WhataLead”, “we”, “us” or “our”), protecting your privacy and the security of your personal data is an absolute priority. This Privacy Policy explains in detail how we collect, use, store, share and protect your information when you use our websites (www.whatalead.com, agent.formlyy.com, www.formlyy.com) and our SaaS services, including the Formlyy software.

Last Update: 16/04/2026

1. Information we collect

A. Information provided by the user

Standard personal data: first name, last name, email address, phone number, professional contact details, and information about the prospect (situation, budget, needs).
Business-related data: information about your activity, products sold, commercial objectives, KPIs, number of prospects, and contacts (emails, phone numbers).

B. Information collected automatically

Technical data: IP address, browser type, operating system, pages visited, date and time of connection.
Cookies and similar technologies: we use audience measurement and behavioral analytics tools, including Microsoft Clarity, as well as technical mechanisms for domain verification and service integrity. You may disable certain cookies in your browser, but some features may become unavailable.

C. Interactions with third-party services

Convex: hosting and application data storage within the service infrastructure.
Cloudflare: network security, protection, and access performance.
Meta / WhatsApp Business API: automated exchanges with prospects via WhatsApp.
OpenAI: conversational qualification and AI processing via API.
Google, Microsoft, Cal.com or Calendly: authentication and appointment management depending on the integrations activated by the Client.

D. Data transfers outside the EU

Some processing may take place outside the European Union, notably in the United States via Meta or OpenAI. These transfers are governed by the Data Privacy Framework where applicable, or otherwise by the European Commission’s Standard Contractual Clauses. When the OpenAI API is used, data is not used to train models by default and is retained for a maximum of 30 days for moderation purposes.

2. Purposes and use of your data

Your data is used to:

Provide and improve our services: lead qualification, appointment scheduling, third-party integrations (Google, Meta, CRM).
Personalization: adapt the user experience and deliver targeted content.
Communication: respond to your requests, send notifications and service-related alerts.
Security and fraud prevention: detect suspicious activities and ensure legal compliance.
Product development: usage analysis, testing, and new features.
Research and AI: anonymized conversations used to train our models (with all identifying data removed).
Follow-up, qualification and booking: we process lead data only to contact prospects again, qualify their needs and propose an appointment on behalf of the Client.
Purpose limitation: data collected through Formlyy is not reused for other campaigns or purposes without an appropriate legal basis, including fresh consent where required.

3. Retention period and anonymization

Data is retained for the duration of the contract and then, unless otherwise instructed or legally required, for up to 24 months after the last contact with the prospect.
At the end of the contract, the Client may export all leads and exchanges from the platform; after a 30-day period following termination, the data is deleted automatically and permanently.
Prospects may also exercise their access or deletion rights through https://agent.formlyy.com/prospect-access.

4. Legal basis and consent

Processing is based on:

Explicit consent: for the processing of leads’ data, obtained by the Client.
Contract performance: to provide the SaaS service.
Legal obligation: compliance with applicable laws and regulations.
Legitimate interests: security, fraud prevention, and service improvement.
Consent to be contacted: the Client must collect clear consent on its lead generation forms and devices covering at least email, phone and WhatsApp where those channels are used.
Transparent notice: the Client must inform the prospect that their data may be used to contact them again, qualify their needs and, where relevant, be processed automatically to facilitate appointment booking.

Recommended form wording: “I agree to be contacted again by [Company name] by email, phone and WhatsApp to process my request, qualify my needs and, where relevant, offer me an appointment. The information submitted may be processed automatically (e.g. via a virtual assistant) in order to qualify your request and facilitate appointment booking. I may withdraw my consent at any time.”

5. Sharing and transferring your information

Service providers and partners: Convex, Cloudflare, Meta (WhatsApp), OpenAI, Google, Microsoft, Cal.com, and Calendly depending on active integrations.
Legal requests: disclosure may occur to judicial or administrative authorities.
Business transactions: in the event of a merger, acquisition, or transfer of assets.
Official WhatsApp framework: we use the official WhatsApp Business API in order to operate within a secure and compliant framework.
No use for our own benefit: we never use our Clients’ lead data for our own prospecting, our own campaigns or our own commercial benefit.

We never sell your data to third parties.

Our Data Processing Agreement (DPA) is available for download and supplements this policy for processing carried out on behalf of Clients.

6. Security measures

We implement technical and organizational measures to protect your data:

Secure hosting: Convex infrastructure and Cloudflare network protections.
Encryption: data encrypted in transit (TLS/SSL) and at rest (AES-256 on Convex infrastructure).
Access controls: restricted administrator access protected by multi-factor authentication (2FA), with data segregation through Better Auth and Convex.
Logging and monitoring: access logs and exchange logs retained for 7 days, with regular checks to ensure compliance.

7. Your rights

In accordance with the GDPR, you have the following rights:

Access: obtain a copy of your data.
Rectification: correct inaccurate information.
Erasure: request deletion of your data.
Restriction: temporarily restrict processing.
Objection: object to certain processing (e.g. marketing).
Portability: receive your data in a readable format and transfer it to another controller.
In-app access: Clients can view and manage relevant lead data directly within the application, subject to the permissions available on their account.

To exercise access, objection, or deletion rights as a prospect, please use https://agent.formlyy.com/prospect-access. This form allows you to enter your phone number and request deletion of your data from our database. For any other request, you may also contact us at [email protected].

8. Cookies and tracking tools

We use cookies to:

Track navigation and improve user experience,
Measure audience and understand user journeys (including through Microsoft Clarity),
Ensure technical operation, security, and certain domain verification or service integrity checks.

You can disable cookies in your browser settings.

9. Links to third-party sites

Our service relies on certain external providers identified in our DPA. We do not control their practices and encourage you to review their privacy and security documentation.

10. Children’s privacy

Our services are not intended for minors under 18 years of age. We do not knowingly collect personal data from children.

11. Changes to this Policy

We may update this Policy to reflect changes in our practices or legal obligations. In the event of a material change, users will be informed by email or via a notice on our site. The most recent version always prevails.

12. Contact

For any questions regarding this Privacy Policy:

Email: [email protected]
Head office: 60 RUE FRANCOIS IER, 75008 PARIS, FRANCE
SIRET: 93787091300012

13. Client forms and ad campaigns

When the Client uses Formlyy with its forms, landing pages, Meta Ads campaigns, Google Ads campaigns or any other acquisition setup, the Client must configure its collection points in a compliant manner:

Clear consent: provide an unchecked checkbox stating that the prospect agrees to be contacted again, ideally explicitly mentioning email, phone and WhatsApp whenever those channels are used.
Transparency: state in the form or the related privacy policy that the data may be used to contact the prospect again, qualify their needs and arrange an appointment.
Automated processing notice: display the following statement, or an equivalent wording: “The information submitted may be processed automatically (e.g. via a virtual assistant) in order to qualify your request and facilitate appointment booking.”
Unsubscribe and objection: provide an easy way for the prospect to stop being contacted, including by redirecting them to https://agent.formlyy.com/prospect-access, and handle objection, consent withdrawal or deletion requests without undue delay where applicable.

Within this framework, Formlyy acts as the Client’s service provider and processor for service execution. The Client remains responsible for the content of its forms, ads, landing pages and notices shown to prospects.