Your name or email appears in BananaLead results and you want it gone? Use the opt-out form or write to legal@bananalead.com. We act on it within one month at the latest.
1. Controller
P209, SAS (simplified joint-stock company), SIREN 917 694 218, 78 avenue des Champs-Élysées, bureau 326, 75008 Paris, France, is the data controller for the processing described here. Contact for any privacy question: legal@bananalead.com.
2. Customers and visitors
What we collect
- Account: email, name, login identifiers (managed by our identity provider; we do not store your password).
- Billing: company name, billing address, VAT number, top-ups and invoices. Card data is handled by Stripe only.
- Usage: searches you run, their inputs and results, credit consumed, API keys, connection logs and IP addresses for security and fraud prevention.
- Support: the messages you send us.
Why and on which legal basis
- Providing the Service, billing and support — performance of the contract.
- Invoices and accounting records — legal obligation.
- Security, abuse and fraud prevention, improving the Service, service emails about your account — legitimate interest.
How long
Account data: while the account is open, then up to 3 years for prospect follow-up. Invoices and accounting records: 10 years (French commercial law). Security logs: up to 12 months. Your search history: while your account is open, results cache as described in section 3.
Cookies
We only use cookies strictly needed to keep you logged in and secure the session. No advertising cookies; no consent banner is therefore required.
3. People who appear in our results
BananaLead helps businesses find professional contacts. As a result, it processes data about people who never signed up to BananaLead: this section is for you.
What data and where it comes from
- Data: name, job title, employer, professional email address and whether it accepts mail, professional phone number when published, public profile URLs, public social media statistics (creators), business listing details.
- Sources: the public web only — public LinkedIn profiles, company websites, Crunchbase and PitchBook public pages, Google Maps business listings, public online store pages, and public YouTube / TikTok / Instagram profiles. Emails can be inferred from the company domain and checked by an SMTP test that does not send any message.
- We do not collect sensitive data (health, opinions, religion…), private messages, or data behind a login.
Why and on which legal basis
We collect this data on request of our business customers so they can find and contact professionals in a B2B context. The legal basis is our and our customers’ legitimate interest (GDPR art. 6(1)(f)) in B2B prospecting, limited to professional data that people have made public in a professional capacity. Each customer then becomes an independent controller of the results it keeps, and must inform you and honour your objection (see our Terms).
How long
- Results are cached for at most 12 months to avoid re-collecting the same public pages, then deleted or refreshed on a new request.
- If you object, we keep only the minimum needed (your email address or profile URL, or a hash of it) in a suppression list so we never return your data again. This list is kept for as long as the Service runs.
How to object or ask for erasure
Fill in the opt-out form with your email address or LinkedIn URL, or write to legal@bananalead.com. We remove you from our cache, add you to the suppression list, and answer within one month at the latest. We may ask for a proof of identity if a request is ambiguous. We cannot delete copies already exported by customers before your request, but they are required to honour your objection too.
4. Who receives the data
Data is processed by our team and by the processors below, under contracts that require them to protect it. Customers receive the results they ask for. We never sell your account data.
| Processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website and application hosting | USA / EU edge |
| MongoDB Atlas (MongoDB Inc.) | Database hosting (accounts, credits, searches, results cache) | EU / USA |
| Stripe | Payments, invoices, card data (we never see full card numbers) | EU / USA |
| Bright Data | Proxy network used to fetch public web pages | Israel / worldwide |
| Identity provider (signintrust.com, Keycloak) | Account login and authentication | EU |
| Heroku (Salesforce) | Email verification service | USA / EU |
Our background workers run on servers in France. When data is transferred outside the European Economic Area (notably to the USA), the transfer relies on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses.
5. Security
Encrypted connections (HTTPS), access restricted to people who need it, hashed API keys, managed databases with encryption at rest, and regular deletion of what we no longer need.
6. Your rights
Whether you are a customer or appear in our results, you have the right to access, rectify and erase your data, to restrict or object to its processing (an objection to prospecting is always honoured), to data portability for data you gave us, and to give instructions about your data after your death. Write to legal@bananalead.com.
You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr, 3 place de Fontenoy, 75007 Paris), or with the authority of your country.
7. Changes
We may update this policy; the date at the top shows the latest version. Significant changes are announced to customers by email or in the app.