Security & GDPR

How we protect your data

LeaderAffiliate is a product of LeaderHQ, operated by Know Freedom Technologies. We apply the following measures to keep your data secure:

• Encryption in transit. All data between your device and our servers is encrypted using TLS 1.2 or higher. We do not serve the application over unencrypted HTTP.
• Encryption at rest. Stored data — including affiliate and referral records, commission data, and payout details — is encrypted at rest in our database infrastructure.
• Access controls. Internal access to production data is restricted to authorised personnel on a need-to-know basis. We do not grant broad database access to staff without a legitimate operational requirement.
• Authentication. User accounts are protected by password-plus-OTP two-factor authentication. Passwords are hashed using industry-standard algorithms; we never store plaintext passwords.
• Vendor security. We use reputable, SOC 2-compliant infrastructure providers. Third-party services we integrate with are assessed for security posture before use.

Lawful basis for processing (GDPR Article 6)

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction covered by GDPR-equivalent legislation, we process your personal data on the following lawful bases:

• Contract performance. Processing necessary to provide the LeaderAffiliate service you have signed up for — tracking your referrals, commissions, and payouts.
• Legitimate interests. Processing necessary for fraud prevention, security monitoring, and product improvement — where those interests are not overridden by your rights.
• Consent. Where we send optional marketing communications, we do so only with your consent, which you may withdraw at any time.
• Legal obligation. Processing required to comply with applicable law.

Your rights as a data subject

Under GDPR (and equivalent legislation), you have the following rights regarding your personal data. To exercise any of them, email us at privacy@leaderhq.io with your request. We will respond within 30 days.

• Right of access. You may request a copy of the personal data we hold about you.
• Right to rectification. You may ask us to correct inaccurate or incomplete data. Most account and profile data can be corrected directly in your dashboard.
• Right to erasure ("right to be forgotten"). You may request deletion of your account and associated personal data. We will action this within 30 days, subject to any legal retention obligations.
• Right to data portability. You may request your data in a structured, machine-readable format (JSON or CSV).
• Right to restrict processing. You may ask us to pause processing of your data while a dispute is resolved.
• Right to object. You may object to processing based on legitimate interests, including any direct marketing.
• Rights related to automated decision-making. We do not make decisions about you solely by automated means that produce legal or similarly significant effects.

Data retention

We retain your personal data for as long as your account is active and for a reasonable period afterward to allow for account recovery, dispute resolution, and legal compliance. Specifically:

• Account data: retained for the life of your account plus 90 days after deletion request.
• Affiliate, referral, and commission records: retained with your account; deleted on account erasure request.
• Transactional emails and logs: retained for up to 12 months for fraud and security purposes.
• Billing records: retained for 7 years as required by applicable financial regulations.

Sub-processors and third-party services

We use the following categories of third-party processors to operate LeaderAffiliate. Each is bound by a data processing agreement consistent with GDPR requirements:

• Cloud infrastructure: servers, databases, and object storage
• Transactional email: delivery of OTP codes, sign-in messages, and account notifications (Postmark)
• Payment processing: Stripe — we do not store card numbers; all payment data is handled by Stripe directly

A full list of sub-processors is available on request at privacy@leaderhq.io.

Data Processing Agreement (DPA)

If you use LeaderAffiliate in a business context and require a Data Processing Agreement for your own GDPR compliance, email privacy@leaderhq.io with "DPA Request" in the subject line. We will provide a signed DPA within 5 business days.

Supervisory authority

If you are in the EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection supervisory authority. In the United States, please contact us directly at privacy@leaderhq.io and we will work to resolve your concern promptly.

Contact