Privacy Policy
Last updated: 4 novembre 2026
This policy explains what personal data SincroLead processes, and how. It is written pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Who we are
The data controller is:
DA_CAMBIARE Srl DA_CAMBIARE — via, numero, CAP, città, Italy VAT number DA_CAMBIARE Email: contact@sincrolead.it Certified email (PEC): pec@DA-CAMBIARE.example
SincroLead is a subscription service (SaaS) available at app.sincrolead.it.
Businesses use it to collect the contacts generated by their own Facebook Lead Ads forms
and to assign them to their own sales agents.
2. Two different kinds of processing, two different roles
⚠️ This is the part that matters most — read it even if you skip the rest.
SincroLead processes two categories of data, under different rules.
2.1 Data of the people who use the app — we are the controller
The data of people who log into SincroLead: the administrator of the client business and its agents. We decide the purposes and means, so we are the data controller.
2.2 Lead data — we are the processor
The data of people who fill in a lead form on a client business's Facebook Page, or on an Instagram account linked to that Page. That data belongs to the relationship between the client business and the person who filled in the form: the client business decides why it is collected and what happens to it.
We process it only on that business's instructions, as a data processor under Article 28 GDPR, on the basis of a written agreement.
What this means in practice if you filled in a form: if you want to know what data was collected, correct it, or have it deleted, your counterpart is the business that ran the ad, not us. If you write to us, we forward your request to that business and tell you we have done so — see §9.
3. What data we process
3.1 Account data (as controller — §2.1)
| data | why |
|---|---|
| First and last name | identify the user inside the app |
| Email address | login, service messages, two-factor verification code |
| Password | stored only as a hash (bcrypt): not readable, not even by us |
| Role and permissions | determine what the user can see and do |
| Business details | company name, VAT number, billing data |
| Activity log | who did what and when inside the app, for security and incident reconstruction |
| IP address and session technical data | security, abuse prevention |
| Login history | date, outcome, IP address and browser of every login attempt, to spot anyone trying to get into an account. The email or code typed is stored only in unreadable form (hash). Only the platform operator can view it |
| Devices with notifications turned on | only if the user turns them on from their profile: the delivery address the browser assigns to the device, its encryption keys, the browser and last use, to send alerts to the phone or computer. Deleted when the user removes the device, signs out or is deactivated |
3.2 Data received from Meta (as processor — §2.2)
When a client business connects one of its Facebook Pages — and with it any linked Instagram account — we receive from Meta:
| data | why |
|---|---|
| Page access token | read that Page's forms and leads, including those submitted on Instagram. Stored encrypted in the database |
| Page ID and name, and those of the linked Instagram account | show the user what they connected |
| The Page's lead forms | let the user choose which forms to sync |
| All answers submitted in the form: name, email, phone and every custom question | this is the lead itself — the service exists for this |
| Advertising context: campaign, ad set, ad, and whether the form was submitted on Facebook or Instagram | show the business which campaign and which channel produced the contact |
| Submission date and time | ordering, and measuring response times |
We do not receive and do not request: your posts, your messages, your friend list, or your payment details on Meta.
3.3 Data sent to us by the client business's other systems (as processor — §2.2)
A client business may also connect sources other than Meta. In particular it can connect its own Google Ads lead forms, which deliver the data to us directly; and it can send us contacts from other systems — its website forms, an industry portal, its existing software — through our application programming interface (API). It can also upload a list of contacts from a file (Excel or CSV) or enter them by hand: in that case it declares that it has the right to contact those people, and consent to marketing messages is not recorded unless the file states it explicitly. The uploaded file is deleted once the import is finished.
In that case the client business decides what to send us: typically name, email, phone and the answers to the form it published. We process that data exactly as we process data arriving from Meta: only on that business's instructions, as a processor, and never for purposes of our own.
⚠️ For the person who filled in that form, the counterpart remains the business that published it — as set out in §2.2.
3.4 What we do not do
- We do not sell data to anyone.
- We do not use a client's leads for our own purposes, for profiling, or to train artificial intelligence models.
- We do not pool data across client businesses: each business sees only its own, and that separation is enforced by the database, not merely promised.
4. Purposes and legal bases
| purpose | legal basis |
|---|---|
| Providing the service to the subscriber | performance of a contract (Art. 6(1)(b)) |
| Processing leads on behalf of the client business | our contract with the client business; for the person who filled in the form, the basis is the one declared by that business in its own privacy notice |
| Security, activity log, abuse prevention | legitimate interest (Art. 6(1)(f)) |
| Invoicing and accounting obligations | legal obligation (Art. 6(1)(c)) |
| Service messages (technical notices, changes to terms) | performance of a contract |
5. Who else sees this data
Nobody, except the parties listed below, who act as processors on our behalf:
| party | role | where |
|---|---|---|
| Meta Platforms Ireland Ltd. | the source of the leads | EU / USA |
| Hetzner Online GmbH | hosts the application servers and the database | Germania |
| Email provider | delivers service emails: verification, login codes, technical alerts, and the notice sent to an agent when a contact is assigned to them — ⚠️ that notice carries the person's name, never their email address or phone number | EU |
| Browser notification service (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox) | delivers notifications to the device of whoever turned them on. The text travels encrypted and the service cannot read it: it carries the contact's name (can be turned off in the profile), never email or phone | EU / USA |
Access by the provider to client data
DA_CAMBIARE Srl staff access the data only for support and maintenance and are bound by confidentiality. They can do so in two ways, both reserved to the platform administrators, with two-factor authentication required:
- Viewing: from the platform panel they can read the leads, users, agent performance, forms and connections of client businesses, without being able to change, export or use them to contact anyone. Every lead search and every lead record opened is kept in the client business's activity log: who, when, which business, which lead.
- Access to the business's account ("Log in as"): to fix a reported problem, they can use the app with the account of one of the business's users, stating the reason, for at most 60 minutes. During that time they cannot change password, email, second factor, users or roles, create tokens, or connect and disconnect social accounts. The start and end of the access, with the reason, and everything done are kept in the activity log, with their name next to the user's.
We disclose data to an authority only where compelled by a lawful request.
Transfers outside the European Union
Data is stored in Germania. Meta may also process data in the United States; that transfer relies on the safeguards required by Chapter V GDPR (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework).
6. How long we keep it
| data | how long |
|---|---|
| Account data | for the life of the subscription, then 90 days for disputes and second thoughts |
| Leads | per the client business's instructions, and in any case no longer than 90 days after the contract ends |
| Activity log | 24 months, to allow a security incident to be reconstructed |
| Login history | 12 months, then deleted automatically |
| Technical log of messages received from Meta | 90 days |
| Accounting records | 10 years, as required by law |
| Sign-ups never confirmed by email | deleted automatically, with no intervention |
⚠️ Transparency note, to be removed once it is no longer true: today, periodic deletion of leads is not automated. A request about a single lead is handled by the client business from the app (§9); other requests are handled manually by our staff within the timescales set out in §9.
7. How we protect it
- All traffic encrypted in transit (HTTPS).
- Passwords stored as hashes, never in clear text.
- Facebook Page access tokens are encrypted in the database.
- Two-factor verification available for app accounts.
- Separation between client businesses enforced at database level, on every single query, rather than left to the code that renders the page.
- Messages arriving from Meta are verified by cryptographic signature: an unsigned message is discarded.
- Activity log on every sensitive operation.
No measure is perfect. In the event of a personal data breach we notify the supervisory authority within 72 hours and, where the law requires it, the data subjects as well.
8. Cookies
SincroLead is a private, login-only business application: it uses no profiling cookies and no advertising trackers.
It uses strictly necessary technical cookies only:
| cookie | purpose |
|---|---|
| Session cookie | keep you logged in |
| CSRF token | prevent another site from submitting forms in your name |
These require no consent: without them the service does not work.
9. Your rights
You have the right to access your data, have it corrected, have it erased, restrict processing, receive it in a machine-readable format (portability), object to processing based on legitimate interest, and withdraw consent you have given.
Who to write to:
| if you are… | write to… |
|---|---|
| a user of the app | contact@sincrolead.it |
| a person who filled in a lead form | the business that ran the ad. If you do not know which one, write to contact@sincrolead.it: we will identify it and forward your request |
We reply within 30 days. Step-by-step instructions are on the Data Deletion page.
Two features of the app are there to answer requests about a lead. The client business (its administrators) can:
- export the data of a single lead — name, contact details, form answers, consent, notes and appointments — as a JSON file (machine-readable) or a CSV file (readable in a spreadsheet), to answer an access or portability request;
- erase the data of a single lead on request: name, contact details, answers and the text of notes and appointments are deleted and cannot be recovered. Only an anonymous number remains, with date, source and status, for the business's statistics.
Both operations are recorded in the activity log, with who did them and when, but without the person's contact details: the log says "data erased on request", not which.
You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of the country where you live.
10. Changes to this policy
If we change something substantial, we notify registered users by email and update the date at the top of this page. Previous versions remain available on request.
11. Contact
DA_CAMBIARE Srl — DA_CAMBIARE — via, numero, CAP, città, Italy Privacy requests: contact@sincrolead.it Support: support@sincrolead.it