Privacy Policy
Last updated: 12 June 2026
At LeaderMix, we respect your privacy and protect your personal data.
1. Data We Collect and Why
When you use our platform, the following data is collected:
| Data type | Purpose of collection | Retention period |
|---|---|---|
| Full name, e-mail | Account management, communication | Until account deletion + 3 years |
| Company name | Service personalisation | Until account deletion + 3 years |
| Phone, billing address | Billing communication, issuing e-archive invoices | 10 years (statutory retention) |
| Turkish ID No. (TCKN) / Tax No. (VKN), tax office, company title | Issuing official invoices (tax-law obligation) | 10 years (statutory retention) |
| IP address (application layer) | Security, session management | 90 days |
| Usage logs (application layer) | Debugging, improvement | 60 days |
| Traffic / access records | Obligation under Turkish Law No. 5651 | 2 years (statutory retention) |
| Limited identity record of deleted accounts | Right of defence in legal disputes (statute of limitations) | 5 years (separate archive, automatically destroyed at the end of the period) |
Application-layer logs (60–90 days) and traffic/access records kept under Turkish Law No. 5651 (2 years) are different categories subject to different legal bases; this is why their retention periods differ.
2. Cookies
LeaderMix uses essential cookies for session management, security and form protection. In addition, only with your explicit consent, analytics cookies (Google Analytics 4, Microsoft Clarity) are run to help us understand how the site is used. No marketing / advertising tracking cookies are used.
For the full list and duration details, see the Cookie Policy.
3. Sharing with Third Parties
Your personal data is never sold to third parties for commercial purposes. Only the minimum data required to provide the service is shared with our sub-processors (server hosting, e-mail infrastructure, e-mail discovery / verification, AI analysis, payments). The current sub-processor list and international transfer mechanisms are published in Annex 2 of the Data Processing Agreement. These providers operate under GDPR/KVKK-compliant data processing agreements. In addition, where a court order or lawful request exists, data limited to that request may be shared with the competent authorities.
4. Data Security
We apply the following measures to protect your data:
- Passwords are stored as one-way cryptographic hashes (SHA-256); the original password can never be accessed
- All data transmission is encrypted via HTTPS/TLS
- Database access is restricted to authorised system accounts only
- Regular security updates and backups are performed
5. Data Retention and Deletion
If you delete your account, your personal data is immediately deleted from our live systems or anonymised; your e-mail address becomes available for re-registration. Statutory retention obligations remain: invoice/payment records are kept for 10 years under tax law, and traffic/access records for 2 years under Turkish Law No. 5651. In addition, to preserve our right of defence in potential legal disputes, a limited identity record (full name, e-mail, summary of transaction history) is kept for 5 years in a separate, access-restricted archive and automatically destroyed at the end of that period. You can send data deletion requests to [email protected].
6. Your Rights under the GDPR (EEA/UK users)
If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR) applies to our processing of your personal data in addition to Turkish Law No. 6698 (KVKK). We process your data on the legal bases of performance of a contract (Art. 6(1)(b) — account, subscription, billing), legal obligation (Art. 6(1)(c) — tax and record-keeping duties), legitimate interests (Art. 6(1)(f) — security, fraud prevention) and consent (Art. 6(1)(a) — optional analytics cookies, commercial e-mails).
You have the right to:
- Access the personal data we hold about you and receive a copy (Art. 15),
- Have inaccurate data rectified (Art. 16),
- Request erasure ("right to be forgotten", Art. 17),
- Request restriction of processing (Art. 18),
- Receive your data in a portable format (Art. 20),
- Object to processing based on legitimate interests (Art. 21),
- Withdraw consent at any time, without affecting prior processing (Art. 7(3)),
- Lodge a complaint with your local supervisory authority.
To exercise any of these rights, contact [email protected]. We respond within 30 days at the latest. Data transfers outside the EEA are protected by appropriate safeguards (standard contractual clauses) as described in the Data Processing Agreement.
7. Chrome Extension (LeaderMix Email Finder)
The LeaderMix Email Finder browser extension extracts publicly available e-mail addresses and company information from the currently open tab only when you trigger it (by clicking the extension icon). The extension:
- Does not track your browsing history in the background, does not record the pages you visit, and reads no data unless you trigger it,
- Sends extracted data only to your own LeaderMix account (LeaderMix servers); it transfers no data to third parties,
- Stores only session/connection information (API access key and server address) locally on your device,
- Contains no analytics or advertising trackers.
Company/lead data transferred to your account through the extension is subject to the same retention and deletion rules as all other lead data on the platform. Removing the extension also deletes the locally stored connection information.
8. Policy Updates
This privacy policy may be updated from time to time. Significant changes will be notified to your registered e-mail address.
9. Data Controller
The data controller within the meaning of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and, where applicable, the GDPR is:
Legal name: Hook Yaratıcı Reklam Ajansı ve Uluslararası Ticaret Limited Şirketi
Address: Cevizli Mah. Ulubey Sk. Nursallar Sitesi A Blok No: 4A İç Kapı No: 113 Kartal / Istanbul, Türkiye
E-mail: [email protected]
MERSIS No: 0463153420500001
For the detailed data protection notice see the Data Protection Notice (KVKK / GDPR) page, and for information on cookie usage see the Cookie Policy page.