Privacy Policy

This policy explains how LeadMighty handles personal data. It applies to visitors to our website, people who contact us, and users of our products such as LeadMightyHR.

For most product data, your employer is the controller and LeadMighty is the processor — we handle the data on their instructions. If you're an employee using the product, please also read your employer's own privacy notice.

You give us

• Account details: name, work email, organisation and role.
• Product content your organisation enters: employee records, leave, claims, payroll figures, attendance and documents.
• Messages you send us, such as support requests and enquiries.

We collect automatically

• Usage and device data needed to run and secure the service (e.g. log data, IP address, browser).
• Cookies and similar technologies for sign-in, preferences and analytics.

We use personal data to:

• Provide, maintain and secure the products.
• Process billing and manage subscriptions.
• Respond to support and communicate about the service.
• Improve reliability and build new features.
• Meet legal and regulatory obligations.

We do not sell personal data, and we do not use your product content to train third-party AI models.

Depending on where you are, we rely on your consent, the performance of a contract, our legitimate interests in running the business, or compliance with law. Where the Singapore PDPA applies, we handle personal data in line with its consent, purpose-limitation and protection obligations.

We share personal data only as needed to run the service, and under appropriate safeguards:

• Sub-processors that host and support the product (for example, cloud hosting, email delivery and payment processing).
• Authorities where the law requires it.
• A successor entity in the event of a merger or acquisition, subject to this policy.

A current list of sub-processors is available on request at privacy@leadmighty.com.

We keep personal data for as long as your organisation's account is active and as needed to provide the service. After termination we delete or return product content on request, following a short grace period, unless the law requires us to keep it longer.

We apply technical and organisational measures including encryption in transit, tenant isolation, role-based access controls and least-privilege access for our team. See our Security page for more detail.

Subject to local law, you may request access to, correction of, or deletion of your personal data, and object to or restrict certain processing. For product content held on your employer's behalf, we'll direct your request to them.

To exercise a right, email privacy@leadmighty.com. You may also complain to your local data protection authority.

For any privacy question, contact our team at privacy@leadmighty.com. We'll update this policy as our products and obligations evolve and will note the date of the latest change above.