Last updated August 20, 2026
This Privacy Policy explains what personal data Musak Leads Media (“Musak Leads,” “we,” “us”) collects, why we collect it, how it is used and shared, and the choices available to you. It applies to the Musak Leads website and CRM application, and to data processed through our integration with the WhatsApp Business Platform (Cloud API) operated by Meta Platforms, Inc. (“Meta”).
Your relationship with Musak Leads depends on who you are, and the role we play changes accordingly:
Musak Leads uses Meta Platforms, Inc. and the official WhatsApp Business Platform (Cloud API) to send, receive, and store WhatsApp messages on your behalf. This means:
Account details. Name, email, business name, role, and password (stored as a salted hash, never in plain text). Payment is handled via tokenized processing through Supabase and our payment processors (Stripe and CMI) — we do not store full card numbers on our own servers.
Messaging data. Contact phone numbers, WhatsApp display names, WhatsApp Business Account (WABA) IDs, message payloads (text and media), media files, delivery/read timestamps, and conversation metadata needed to operate the unified inbox.
Contact & lead data. Names, phone numbers, tags, notes, and any other lead/contact fields our Tenants add to manage their pipeline.
Usage & device data. Log data, IP address, browser type, and pages visited, collected automatically to secure and improve the service.
AI feature data. Where AI-assisted features are enabled, relevant conversation content is processed by our configured AI/LLM provider to generate a response. See Section 6.
We do not sell personal data, and we do not share personal data with third parties for their own advertising purposes. See Section 8 for California-specific disclosures.
Where applicable law requires a legal basis (for example under the EU/UK GDPR or Morocco's Law 09-08 on the protection of individuals with regard to the processing of personal data), we rely on: performance of our contract with you (providing the service), our legitimate interests (security, fraud prevention, service improvement), your consent (for optional features such as AI processing, where required), and compliance with legal obligations.
Under Law 09-08, and independently of your rights under GDPR described in Section 11, data subjects in Morocco have the right to object, on legitimate grounds, to the processing of their personal data; the right to be informed before their data is used for the first time for direct marketing purposes and to object to such use; and the right to lodge a complaint directly with the CNDP. Requests can be directed to info@musakleads.com.
If your Musak Leads workspace has AI-assisted features enabled — automated replies, message suggestions, conversation summaries, or lead scoring — personal data from your conversations (including messages from your end-contacts) may be processed by an AI language model to generate a response or output. This is a form of automated processing within the meaning of the EU AI Act and applicable state AI-transparency laws.
We share data only as needed to operate the service, and only with:
A full list of sub-processors handling Tenant data is maintained in our Data Processing Agreement.
Musak Leads does not sell or share personal data for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Because we don't sell or share personal data, no opt-out is required to take effect — but California residents may still submit a request at any time:
Do Not Sell or Share My Personal Information
We do not knowingly collect, sell, or share the personal data of consumers under 16 years of age without the opt-in consent required by CCPA/CPRA. California residents also have the right to know, delete, and correct their personal data, and the right to non-discrimination for exercising these rights.
Our infrastructure and service providers may be located outside your country, including in the European Union and the United States. Where we transfer personal data originating from the EU/EEA or UK to a country not recognized as providing an adequate level of protection — including transfers to US-based sub-processors such as our database, hosting, and AI providers — we rely on the European Commission's Standard Contractual Clauses (Module Two: Controller to Processor, or Module Three: Processor to Processor, as applicable) and, for transfers from the UK, the UK International Data Transfer Addendum to those clauses, as the transfer mechanism. The specific mechanism used per sub-processor is detailed in our Data Processing Agreement.
Depending on your location, you may have the right to access, correct, export, or delete your personal data (the "Right to Erasure" / "Right to be Forgotten" under GDPR), restrict or object to certain processing, and withdraw consent where processing is based on consent. To exercise these rights:
We acknowledge verified requests within 5 business days and complete them within 30 days.
If you are located in Morocco, you may also exercise the statutory rights described in Section 5, including the right to lodge a complaint directly with the CNDP, independent of contacting us first.
We use administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit (TLS/HTTPS), encryption at rest (via Supabase's managed PostgreSQL encryption), role-based access controls, and tenant isolation between customer workspaces enforced at the database level (Row-Level Security). No system is completely secure, and we encourage you to use a strong, unique password and enable multi-factor authentication where available.
Musak Leads is a business tool and is not directed at, or intended for use by, children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the platform at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Musak Leads Media — info@musakleads.com
Musak Leads has appointed a Privacy Lead responsible for handling data protection inquiries and requests, reachable at the email address above. A formal Data Protection Officer has not been appointed, as Musak Leads' processing activities do not meet the large-scale or core-activity monitoring thresholds under Article 37 of the GDPR that would make such an appointment mandatory. We will appoint a DPO and update this Policy if that changes.
EU Representative (GDPR Article 27). Musak Leads is established in Morocco. Article 27 requires the designation of an EU representative only where our processing relates to offering goods or services to, or monitoring the behavior of, data subjects located in the EU. Musak Leads' services are not currently marketed or offered on a targeted basis to customers established in the EU; should that change, we will designate an EU representative in accordance with Article 27 in advance of that expansion, and this Policy will be updated with their contact details.