Privacy Policy
Ces documents sont publiés en anglais, version qui fait foi. Les traductions sont en préparation.
This policy explains how REACH TECHNOLOGIES SAS ("1st Minute Lead", "we") processes personal data as data controller: data of visitors to our websites, of the persons who create and manage a client account, and of prospects.
It does not cover the data of Leads (persons who submit a form on a Client's website) or of Advisors invited to an account: that data is processed by 1st Minute Lead on behalf of the Client, as processor, under the Data Processing Agreement. For any request concerning your data as a Lead, contact the company whose website you visited; we forward to the relevant Client any request we receive directly (see §9).
1. Controller and contact
REACH TECHNOLOGIES SAS, 1 rue du Quai, 59800 Lille, France — SIREN 953 284 296.
- Privacy: privacy@1stminutelead.com
- Data Protection Officer (DPO): dpo@1stminutelead.com
2. Data we process and why
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Browsing on 1stminutelead.com | Technical server logs (truncated IP, requested pages, user agent) | Legitimate interest (security, operation) | 12 months |
| Account creation and management | First and last name, professional email, company name, country, website URL, interface language, password (stored hashed) | Contract (Terms of Use) | Life of the account + 30 days after closure |
| Email verification and security | Email, verification codes, sign-in events | Contract; legal obligation (security) | Life of the account |
| Billing and subscription | Billing identity, email, plan, invoices; card data is entered directly with Stripe and never touches our servers | Contract; legal obligation (accounting) | 10 years (accounting documents) |
| Transactional and service emails | Email, first name (verification, password reset, invitations, quota and trial notifications, onboarding tips during setup) | Contract; legitimate interest for setup tips (opt-out available) | Life of the account |
| Support and contact | Email exchanges with contact@1stminutelead.com or support@1stminutelead.com | Legitimate interest (answering you) | 3 years after last contact |
| Demo appointment booking | First and last name, email address, phone number, company website, chosen time slot and time zone, entered on the booking page of our scheduling provider (Calendly, United States) when you click "Book a demo" | Pre-contractual steps taken at your request | 3 years after the meeting or after the last contact |
| Feature waitlist | Email, name, feature of interest, interested yes/no (collected in-app when you express interest in an upcoming feature) | Consent | 3 years or until withdrawal |
| Audience and advertising measurement on 1stminutelead.com | Pseudonymous identifiers stored in the cookies listed in the Cookie Policy, pages viewed, traffic source, IP address and browser, sent to Meta (pixel) and to Google (Google Analytics 4) | Legitimate interest (measuring our audience and our advertising campaigns) | Cookie lifetime: 90 days (Meta), 2 years (Google); then as set out in those providers' own policies |
| Product usage analytics | See §3 | Legitimate interest (improving the product) | First-party: 180 days (events), 90 days (error reports). Contentsquare: 13 months (analytics), 1 month (session replays), 3 days (IP addresses) |
We do not sell personal data and we send no marketing emails without a legal basis to do so. The showcase site does load two third-party measurement tags, the Meta pixel and Google Analytics, described in §4.1 and in the Cookie Policy; they are absent from the web application, the mobile application and the Script placed on Clients' websites.
3. Product usage analytics
Two sources, both used only to understand how the product is used and to improve it (legitimate interest). You may object at any time (§8).
3.1 First-party statistics. The application (app.1stminutelead.com) and the "One Minute Lead" mobile application send usage statistics to our own infrastructure.
- What is recorded: named product events (e.g. "lead claimed", "page viewed"), screen/route, app version, operating system, language, a random device identifier and a session identifier, plus technical error reports.
- What is never recorded: the content of Leads (no name, email, phone or message of a Lead in analytics events — only internal identifiers), and full IP addresses: the IP is truncated on arrival (last byte removed in IPv4, /48 in IPv6) before storage.
- Retention: raw events are automatically purged after 180 days, error reports after 90 days.
3.2 Contentsquare (web application only, since September 16, 2026). The web application loads the Contentsquare tag — Content Square SAS, Paris, France; visitor data hosted in the European Union — to analyse navigation and replay sessions: pages viewed, clicks, scrolls, timings, technical context (browser, device, screen size) and a random visitor identifier. Form field values are never collected, and text masking is enabled so that the content of Leads displayed on screen (names, phone numbers, messages) is not recorded. Contentsquare deletes IP addresses after 3 days, session replays after 1 month and analytics data after 13 months. It acts on our instructions as a subprocessor (see the Subprocessors page) and is not loaded on the mobile application, the browser extension or the Script placed on Clients' websites. Its cookies are described in the Cookie Policy.
4. Cookies and local storage
Details, including the storage used by the Script on Clients' websites, are given in the Cookie Policy. In summary:
4.1 Our own sites
- 1stminutelead.com (showcase site): two functional cookies (language, display currency) and the cookies of the two measurement tags loaded on every page — the Meta pixel (
_fbp,_fbc) and Google Analytics (_ga,_ga_*). They are placed as soon as the page opens; §6 of the Cookie Policy explains how to block or delete them. - app.1stminutelead.com (application): an authentication cookie (
oml_token, essential), a random analytics device identifier inlocalStorage(oml_aid) and a session marker insessionStorage— all first-party — plus, since September 16, 2026, the Contentsquare cookies (_cs_*) listed in the Cookie Policy, as described in §3.
4.2 The Script on Clients' websites
The Script places no cookie on visitors' devices. It keeps a browsing journal of the current visit in sessionStorage (erased when the tab closes), limited to the Client's website, and integrates with the Client's consent banner. This processing is carried out on behalf of the Client — see the DPA and the template Lead Information Notice.
5. Recipients and transfers
Data is accessed only by the authorized staff of Reach Technologies and by the providers listed on the Subprocessors page, each for its own function: hosting in France (Hostinger), payments (Stripe), transactional emails (Resend), mobile push notifications (Expo), product analytics of the web application (Contentsquare, hosted in the EU), scheduling of demo appointments (Calendly, United States) and, for accounts with the Scoring module enabled, language-model providers (Groq, Anthropic).
For the measurement of the showcase site, data is also received by Meta Platforms Ireland Ltd and Google Ireland Ltd, which act as independent controllers for that data under their own policies, and not as our processors.
The application infrastructure and the database are located in France. Some ancillary providers are located in the United States; those transfers are governed by the safeguards of Chapter V of the GDPR (adequacy decision — EU–US Data Privacy Framework — or standard contractual clauses), as detailed on the Subprocessors page.
6. Retention
Retention periods are listed per processing in §2. When you close your account (or when it is terminated), account data is kept for thirty (30) days — allowing reactivation and the handling of disputes — then permanently deleted; Lead Data follows the return-and-deletion terms of the DPA. Data subject to a legal retention obligation (invoices) is archived for the legal period only.
7. Security
Access to the Platform is protected by individual accounts and hashed passwords (bcrypt); sessions use signed tokens; all traffic is encrypted in transit (TLS); the database is not exposed publicly; access to production is restricted to authorized staff using key-based authentication. Web Call streams are encrypted end to end by WebRTC (DTLS-SRTP) and are neither recorded nor stored.
In the event of a personal data breach likely to result in a risk to your rights, we will notify the CNIL and, where required, the persons concerned, within the regulatory time limits.
8. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection provided by the GDPR, and the right to define directives on the fate of your data after death (French Data Protection Act).
- By email: privacy@1stminutelead.com (or dpo@1stminutelead.com)
- We reply within one (1) month, extendable by two (2) months for complex requests.
- You may lodge a complaint with the CNIL (cnil.fr), the French supervisory authority.
9. Requests from Leads
If you submitted a form on a website using 1st Minute Lead and wish to exercise your rights, the data controller is the company whose website you visited. Any request received directly by 1st Minute Lead is forwarded to that company without delay, and we assist it in responding to you, in accordance with the DPA.
10. Changes
We may update this policy, in particular when features or providers change. The date and version at the top of this page identify the current version; material changes are notified to account holders by email.
This document is published by Reach Technologies SAS. For any question: contact@1stminutelead.com.
See also: Legal Notice · Terms of Use · Terms of Sale · DPA · Cookies · Subprocessors