Privacy Policy

Last updated: 15 October 2026

Mailseed respects your privacy. This policy explains what personal data we collect through the mailseed.tech website and our services (including VelopLead), for what purposes, on what legal basis, and what your rights are under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Portuguese Law 58/2019.

1. Data controller

Francisco Miranda Oliveira da Silva, a sole trader operating under the Mailseed brand, Portuguese tax ID (NIF) 253728614, based in Porto, Portugal.
Email: contact@mailseed.tech · Phone: +351 913 347 109

2. Data we collect

• Contact and demo request forms: name, email, phone (optional), company (optional), service of interest and your message.
• Direct contact: the data you send us by email, phone or WhatsApp.
• Technical data: IP address, browser type and date/time of the request, used for security and spam prevention.
• Visit source: landing page, referring page and campaign parameters (e.g. UTM, fbclid or gclid), when present, so we know which campaign generated the contact.
• VelopLead accounts: name, email and password (stored as a hash) of dashboard users. When a user connects Facebook through Facebook Login for Business, we store their Facebook user ID, an access token (stored encrypted), the list of Pages they granted access to and those Pages' access tokens (stored encrypted), used only to list and connect Pages, read their lead forms and receive new leads. We also store salespeople's Telegram chat ID, used to deliver leads.
• Analytics and marketing cookies: only with your consent. See our Cookie Policy.

3. Purposes and legal bases

We do not sell your data or use it for automated decisions with legal effects.

4. How long we keep data

• Contact requests that don't lead to a contract: up to 24 months after the last contact.
• Client data: for the duration of the relationship and then for legally required periods (e.g. 10 years for invoicing records).
• Technical data linked to a request: for the same period as the request.
• Facebook Login data: kept while the Facebook connection is active; deleted when the user removes VelopLead from their Facebook settings or requests deletion. Leads remain with the client business, which is their controller.
• Cookies: for the periods set out in the Cookie Policy.

5. Who we share data with

We use service providers (processors) that handle data only on our behalf:

• Amazon Web Services: hosting of the website and services.
• Titan (Flock FZ-LLC): hosting of our email (contact@mailseed.tech).
• Google: sending contact form notifications (Gmail) and, with consent, Google Analytics.
• Meta Platforms Ireland: WhatsApp (when you contact us that way) and, with consent, Meta Pixel.
• Telegram: delivering VelopLead alerts with each lead's details (name, phone number and form answers).
• Functional Software (Sentry): application error monitoring (EU region), configured not to collect request bodies or personal data.

Some of these providers may transfer data outside the European Economic Area (e.g. to the US or the United Arab Emirates). In those cases, transfers rely on appropriate safeguards such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We may also disclose data to authorities where required by law.

6. VelopLead and data processed on behalf of clients

When a client business uses VelopLead, or a solution built by Mailseed, to manage its own contacts (for example, leads from Meta Lead Ads forms, its website or its chatbot), that business is the data controller. Mailseed acts as a processor under Article 28 GDPR and processes that data only on the client's instructions and to provide the service.

Data obtained through Meta platforms (Facebook, Instagram, WhatsApp) is used solely to deliver leads to the relevant client and for the contact that client requested. It is not sold, shared with third parties for other purposes, or used for Mailseed's own advertising.

To notify the client's team, VelopLead sends each lead's details (name, phone number and form answers) via Telegram to the accounts the client designates. Contacting the lead on WhatsApp is done by the client, from its own account.

If a VelopLead customer turns on campaign optimisation, we send Meta Platforms Ireland Ltd., through the Conversions API, the stage reached by each lead that came from a Facebook or Instagram lead form (for example: contacted, scheduled, closed), identified only by the ID Meta itself assigned to the lead. We do not send names, phone numbers, emails or form answers. This is done on the customer's instructions, so that Meta can optimise the customer's ads, and it can be turned off at any time in the settings.

If you submitted your details through a form of a business that uses VelopLead, you can exercise your rights with that business, or contact us and we will forward your request.

7. Your rights

At any time you can:

• access your data and get a copy;
• ask us to correct inaccurate data;
• ask us to erase your data (how to request deletion);
• ask us to restrict processing, or object to it;
• request data portability;
• withdraw your consent, without affecting processing already carried out.

To exercise these rights, email contact@mailseed.tech. We reply within one month. You also have the right to lodge a complaint with the Portuguese Data Protection Authority, CNPD.

8. Security

We use encrypted connections (HTTPS), restricted access to systems and databases, and providers with recognised security standards to protect data against unauthorised access, loss or disclosure.

9. Children

Our services are aimed at businesses and professionals, not at children under 16.

10. Changes to this policy

We may update this policy. The current version is always published on this page, with its last updated date.