Privacy policy

Last updated: 13 November 2026

This policy explains what personal data LeanAds collects when you visit our pages and request the free 48-Hour Revenue Leak Audit, why we collect it, who we share it with, how long we keep it, and your rights. We've written it in plain language. If anything is unclear, email hello@leanads.co.za.

Who we are

LeanAds is a Google Ads agency operated by Lean Corp (Pty) Ltd, a private company registered in South Africa. Lean Corp (Pty) Ltd is the controller of the personal data described here, which means we decide how and why it's used.

Contact for anything about your data: hello@leanads.co.za.

What we collect

• What you type into our forms: your name, work email, website, WhatsApp or phone number, and your answers to our questions (for example your monthly online sales or Google Ads spend, business type, typical customer value, the markets you sell in, and anything you tell us about your Google Ads).
• Technical details sent with the form: the page you were on, the link and ad that brought you there (campaign parameters such as utm_source, the Meta campaign, ad set and ad, and click IDs such as fbclid or gclid), the website you came from, how long you were on the page, your device type, operating system, browser and language, and the time you submitted.
• Details our database records when you submit: your IP address and the country it's in, and your browser's identification string.
• Only if you accept statistics cookies: the ad that first brought you to us, how many times you've visited, your screen size and your time zone.
• Public information about your business that we look up to prepare Part 1 of your audit: your website and how it's set up (tracking tags, Consent Mode, speed), the ads you run as shown in Google's and Meta's public ad libraries, how you show up in search, and public company information. This is mostly about your business, but it can include your name or role where it's publicly listed.
• Your advertising data, only if you choose Part 2 of the audit: read-only access to your Google Ads account and Viewer access to Google Analytics 4. We can see campaign and performance data but can't make changes or see billing. You can remove our access at any time.
• Booking details, if you book a call with us through Cal.com: your name, email, the time you pick, your answers to the booking questions, and which page and button you booked from. If you filled in one of our forms first, we pass your name, email and website to the booking calendar so you don't have to type them again, and we link the booking to your request.
• Our messages with you by email or WhatsApp.

We don't ask for special categories of data, such as health data. If you run a practice, please don't put patient information in the form.

Do you have to give us this?

No. But we need your name, email and website to prepare and send the audit, and your answers to decide whether Part 2 is a good fit. Without them we can't deliver the audit. Everything marked optional on the form is optional.

Why we use it, and our legal basis

• To prepare and deliver the audit you asked for, including looking up public information about your business, and to follow up about it. Legal basis: taking steps at your request before entering into a contract (GDPR Article 6(1)(b)).
• To book and hold the call you ask for, and to know which page you booked from so we can prepare for it. Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b)).
• To contact you by email or WhatsApp about your audit and our services. Legal basis: your consent, given with the tick box on the form (Article 6(1)(a)). You can withdraw it at any time by replying "stop" or emailing us. Withdrawing doesn't affect anything we did before.
• To decide whether Part 2 of the audit is a good fit, using your answers about size and spend. This is a simple rule, not automated decision-making with legal or similarly significant effects: anyone can still book a call and talk to us.
• To know which ads and pages bring in enquiries, and to keep spam and abuse out, using the technical details above. Legal basis: our legitimate interest in running and improving our advertising and protecting our forms (Article 6(1)(f)). We've weighed this against your interests: the data is limited to what's needed, kept for a short time and never sold. You can object at any time.
• To measure our own advertising with the Meta Pixel, Meta's Conversions API and Google advertising tags, only if you accept marketing cookies. When you send one of our forms, our server then tells Meta that a form was sent, with your email and phone number scrambled (hashed) so Meta can match it to an account but not read it, plus your IP address, browser and Meta's cookie IDs. Legal basis: your consent (Article 6(1)(a)).
• To understand how our website is used with Google Analytics 4, only if you accept statistics cookies. Legal basis: your consent (Article 6(1)(a)).
• If you become a client, to provide our services and keep financial records. Legal basis: our contract with you (Article 6(1)(b)) and our legal obligations (Article 6(1)(c)).

Who we share it with

We don't sell your data. Only our team (in South Africa) and these service providers handle it, each under a data processing agreement and only to provide their service to us:

• Supabase: stores form submissions (EU region).
• Vercel: hosts this website and processes the requests your browser sends to it.
• Resend: sends us an email notification with your form details when you submit.
• Google Workspace: our email, where those notifications and our messages with you are kept.
• Notion: our internal client and lead records.
• Cal.com: shows our booking calendar on our pages and handles call bookings. It sends us the booking so we can add it to your request in Supabase and Notion.
• Meta: WhatsApp messages with you, and the Meta Pixel and Conversions API if you accept marketing cookies.
• Google: Google Ads, and Google Analytics 4 if you accept statistics cookies, plus the read-only access you give us for Part 2.

We may also share data if the law requires it, for example with a tax authority or a court.

Transfers outside the EU

Our team works from South Africa, and some of our providers are based in the United States, so your data is accessed or processed outside the European Economic Area. South Africa doesn't have an EU adequacy decision. Where data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses, or on the EU-US Data Privacy Framework where a US provider is certified. You can ask us for a copy of the safeguards that apply.

How long we keep it

• Audit requests and our messages with you: up to 24 months after our last contact with you, then deleted, unless you become a client.
• IP address, browser and device details, and ad and visit details: up to 12 months, then deleted.
• Client data: for as long as we work together, and afterwards for as long as tax and accounting law requires.
• Access to your ad accounts: you can remove it at any time. We don't keep copies of your account data beyond the audit report itself.
• Cookies and browser storage: as listed under "Cookies" below.

How we protect it

Form submissions go over an encrypted connection to a database that the website can only write to, not read from. Access to lead records is limited to our team, with individual logins.

Your rights

You can ask us to:

• give you a copy of the personal data we hold about you
• correct it if it's wrong
• delete it
• restrict how we use it
• send it to you or another company in a common format

You can also object at any time to us using your data based on our legitimate interests, and to any direct marketing, and you can withdraw consent at any time. Email hello@leanads.co.za and we'll reply within one month. We may ask you to confirm who you are first.

You also have the right to complain to a data protection authority, for example the Autoriteit Persoonsgegevens in the Netherlands or the authority in the EU country where you live or work. We'd appreciate the chance to sort it out with you first.

Cookies

When you first visit, we ask before using anything optional. You can accept all, reject all or choose, and change your mind at any time with "Cookie settings" at the bottom of the page. The page and the audit work the same either way.

• Necessary (always on): remembers your cookie choice for 6 months (la_consent, stored in your browser).
• Statistics (only with your OK): remembers the ad that first brought you here and counts your visits (la_first and la_visits, kept up to 90 days, and la_counted, cleared when you close the browser). They're deleted if you withdraw consent. Google Analytics 4 also runs only with this OK and sets its own cookies (_ga and _ga_…, kept up to 2 years).
• Booking calendar: our booking calendar is provided by Cal.com in a frame or pop-up on our pages. When you open it, Cal.com may set its own cookies that it needs to show the calendar and take your booking. See Cal.com's privacy policy.
• Marketing (only with your OK): the Meta Pixel and Google advertising tags, which let Meta and Google measure our ads and show them to the right people. These set their own cookies (such as _fbp and _fbc from Meta). Google tags run in Consent Mode and stay cookieless unless you accept.

Changes

If we change this policy, we'll update the date at the top of this page. If a change affects what you've consented to, we'll ask you again.