WarmerlyWarmerly ahead on this row
Customer data is hosted in the EU.
Warmerly
Skylead
One-to-one · Where data is held
Where data is held
One row, in depth: what each tool does, the verified numbers, and who each suits.
Skylead details read from its pricing page, terms, privacy policy and feature pages on 21 October 2026.
Warmerly
Customer data is hosted in the EU.
Skylead
Personal data processed primarily in the UK and US, per its privacy policy, last updated March 2023.
The short answer
Where data is held, in one look.
Warmerly states that customer data is hosted in the EU. Skylead's privacy policy says it processes personal data primarily in the United Kingdom and United States, names no hosting provider or sub-processor, and says it was last updated in March 2023. Last checked 21 October 2026.
Skylead
Personal data processed primarily in the UK and US, per its privacy policy, last updated March 2023.
The picture
Drawn side by side.
Where customer data sits
As each company states it
WarmerlySkylead
Hosted in the EU
- Where data is held: Hosted in the EU, as Warmerly states
- Sub-processors: Listed in full on its sub-processors page
- Transfers: Adequacy decision, else the UK addendum and standard contractual clauses
Processed primarily in the UK and US
- Where data is held: Processed primarily in the UK and US
- Sub-processors: None named in its privacy policy
- Policy last updated: March 2023, as the policy states
Skylead's statement is from its privacy policy, which says it was last updated in March 2023. It names no hosting provider and no sub-processors. We compared published statements only.
How Warmerly does it
Warmerly, in detail.
Warmerly states that customer data is hosted in the EU, lists the services behind it, publishes how credentials, backups and staff access work, and gives fixed periods for retention and notice.
01
Hosted in the EU
Warmerly's trust page says customer data is hosted in the EU, and the services behind Warmerly are listed in full.
Warmerly product, checked 21 October 2026
02
Transfers
For transfers of personal data to a recipient, the privacy policy says Warmerly relies on an adequacy decision or regulation where one covers the recipient, and otherwise on the UK addendum and standard contractual clauses.
Warmerly product, checked 21 October 2026
03
What we did not check
This page compares published statements only. We did not audit either company's systems.
Warmerly product, checked 21 October 2026
04
Notice before the list of services changes
Warmerly gives at least 15 days' notice before a new sub-processor starts processing customer data, on the sub-processors page and by email to anyone who asked. A customer who objects on reasonable data protection grounds can say so within that period, and if it cannot be settled within 30 days they may end the affected part of the service.
Warmerly product, checked 21 October 2026
05
Breach notice
After confirming a personal data breach that affects customer personal data, Warmerly tells the account owner without undue delay, and within 72 hours where feasible, with enough detail for the customer to meet its own duties.
Warmerly product, checked 21 October 2026
06
Credentials and passwords
Mailbox OAuth tokens, IMAP and SMTP passwords and the credentials of hosted mailboxes are encrypted at rest with AES-256-GCM, using a key held outside the database. Account passwords are hashed with Argon2id, and API keys and reset tokens are stored only as SHA-256 hashes.
Warmerly product, checked 21 October 2026
07
Backups
The production database and the mail servers' databases are backed up nightly, each backup encrypted with a key held off-server. Servers hold write-only credentials, so a compromised server cannot read or delete existing backups. The database log is also archived at least every five minutes, which allows point-in-time recovery.
Warmerly product, checked 21 October 2026
08
What is deleted, and when
Mailbox passwords and tokens are deleted the moment a mailbox is disconnected, and synced mail goes with it, in any case within 30 days. A deleted workspace can be restored for 30 days and is then permanently deleted. Warmup activity logs are kept 12 months. Deleted data stays in encrypted backups until they expire, currently within about 50 days.
Warmerly product, checked 21 October 2026
09
Staff access
A Warmerly administrator can open a customer workspace, including the inbox, only to resolve a problem the customer raised or to investigate a credible abuse report. The access needs a permitted role, is written to an audit log, is shown in the interface while it happens and expires within 24 hours.
Warmerly product, checked 21 October 2026
10
Privacy requests
Access, correction, deletion and objection requests are answered within one month, and no account is needed to make one.
Warmerly product, checked 21 October 2026
How Skylead does it
Skylead, in detail.
Personal data is processed primarily in the UK and US, under transfer safeguards, with no hosting provider, sub-processor list or fixed retention period published in the privacy policy.
01
Primarily the UK and US
The privacy policy says Skylead processes your personal data primarily in the United Kingdom and United States.
skylead.io/privacy-policy · read 21 October 2026
02
Transfers and safeguards
Transfers elsewhere are described as carried out only if necessary for the execution of contracts, using European Standard Contractual Clauses, the UK International Data Transfer Addendum and transfer risk assessments where protection is not adequate.
skylead.io/privacy-policy · read 21 October 2026
03
No provider or sub-processor named
The policy names no hosting provider and no sub-processors. It refers to suppliers, partners and other carefully managed third parties. It mentions a Data Processing Addendum that we could not read.
skylead.io/privacy-policy · read 21 October 2026
04
Retention
Data is kept while you have an account. When you close it, its content is deleted, while transactional information may be kept for audit, tax and financial purposes.
skylead.io/privacy-policy · read 21 October 2026
05
Who is responsible
The policy names the controller as Skylead Technologies Ltd, operating as Skylead. It gives no company address or country, only 'by post to our registered office'. Where Skylead acts as a processor for your data, it points to a Skylead Data Processing Addendum.
skylead.io/privacy-policy · read 21 October 2026
06
Retention has no fixed periods
Data is kept for as long as you have an account, content is deleted when you close it, transactional information may be kept for audit, tax and financial purposes, and marketing data is kept until you withdraw consent or use an unsubscribe link. No number of days or months is given for any of these.
skylead.io/privacy-policy · read 21 October 2026
07
Your rights and how long answers take
Requests for access and rectification are answered within one month, which the policy says can be extended by two further months if the request is complex. Erasure, restriction, objection and portability are also listed. Complaints go to Skylead first, then to the ICO or an EU supervisory authority.
skylead.io/privacy-policy · read 21 October 2026
08
Security is not described
The policy gives no list of security measures. The nearest wording is that Skylead will always ensure appropriate technical and administrative controls are in place when it shares data with third parties.
skylead.io/privacy-policy · read 21 October 2026
09
Data from public profiles
The policy says some data comes from information found on public social networking profiles and is used for marketing and sales. It adds that its processes are not designed to be automated, including profiling.
skylead.io/privacy-policy · read 21 October 2026
10
Analytics, not cookies
Usage data is described as coming from Google Analytics and Skylead's own analytics tracking system. The policy does not have a cookie section.
skylead.io/privacy-policy · read 21 October 2026
What Skylead does not say
We looked, and found no statement on these. That is about its published pages only, not about the product.
- A statement that data is stored in the EU
- A list of sub-processors
- A named hosting provider
- The Data Processing Addendum
- Any fixed retention period in days or months
- A description of encryption or access controls
- A breach notification time
- A company address or country for the registered office
- A cookie notice inside the privacy policy
Where the sources disagree
We report each version rather than pick one.
- Skylead's privacy policy says it was last updated in March 2023, while its site shows 2026 product news. It may be out of date, so confirm with Skylead.
- Skylead's privacy policy says it processes personal data primarily in the UK and US but does not say where its data is stored, so 'processed' and 'hosted' may not mean the same thing. Ask Skylead.
The numbers
Only what we could verify.
| Measure | Warmerly | Skylead |
|---|---|---|
| Where data is held | Customer data is hosted in the EU. | Personal data processed primarily in the UK and US, per its privacy policy, last updated March 2023. |
| Sub-processors | Listed in full on its sub-processors page | None named in its privacy policy |
| Policy last updated | See its privacy policy | March 2023, as the policy states |
| Transfers | Adequacy decision, else the UK addendum and standard contractual clauses | Standard contractual clauses, the UK addendum and risk assessments |
| Answer to a privacy request | Within one month | Within one month, extendable by two more months if complex |
| Notice of a new sub-processor | At least 15 days | Not stated |
| Breach notice | Without undue delay, within 72 hours where feasible | Not stated |
| Deleted workspace | Restorable for 30 days, then permanently deleted | Content deleted when you close the account, no period given |
| Credential encryption | AES-256-GCM at rest, key held outside the database | Not stated |
In practice
What it means for you.
Our reading of the facts above. Not a promise, and not the only reasonable reading.
If EU hosting is a rule for you, Warmerly states it
Skylead says UK and US. It may still meet your own policy, but you would ask it.
A named list is easier to check
Warmerly lists the services that process customer data. Skylead's policy does not name any.
This compares published statements only
We did not audit either company's systems.
The longest wait for a privacy answer
Warmerly answers requests within one month. Skylead's policy gives one month and allows two further months for a complex request, so the longest it could take under its own wording is 1 + 2 = 3 months. Both are published limits, and neither tells you how long a typical request takes.
A security review needs more than a location
If your buyer sends a security questionnaire, the location is one line out of many. Warmerly publishes its encryption, backup, access and breach-notice wording on one trust page. For Skylead you would ask for the Data Processing Addendum it refers to, because the privacy policy does not describe security measures.
Leaving the product
Disconnecting a mailbox in Warmerly deletes its stored passwords and tokens at once. Closing a Skylead account deletes its content, according to the policy, but it gives no period, so ask how long before you rely on it for a contract.
Reading dates
Warmerly's privacy policy shows a date in October 2026 and its Data Processing Addendum shows 13 October 2026. Skylead's policy shows March 2023, so check whether anything has changed since.
Who it suits
Pick the one that fits.
Warmerly
Warmerly is the better fit if
- You want customer data hosted in the EU
- You want a published list of the services behind the product
- Your own policy prefers EU hosting
- You want fixed numbers for breach notice, sub-processor notice and deletion
- You want to see how credentials and backups are protected before you sign
Skylead
Skylead is the better fit if
- UK and US processing meets your own policy
- You will ask Skylead for its Data Processing Addendum
- You want to read its Data Processing Addendum and are happy to ask for it
- Your buyers accept data processed primarily in the UK and US
Questions
Where does Warmerly host customer data?
In the EU, as Warmerly states. Its sub-processors are listed in full, with at least 15 days' notice of a new one.
Where does Skylead process personal data?
Primarily in the United Kingdom and United States, per its privacy policy. It names no hosting provider or sub-processors.
How fast must each answer a privacy request?
Both state one month. Skylead can extend it by two more months if the request is complex.
What happens to data when I leave?
A deleted Warmerly workspace is restorable for 30 days, then permanently deleted. Skylead deletes content when you close the account and gives no period.
Sources
Skylead pages were read on 21 October 2026. Plans and wording change, so check the vendor's own page before you decide. Warmerly details come from the product as it runs today.
More features
- All features
- Main job
- Starting price (per month)
- What the price covers
- Free trial
- LinkedIn automation
- LinkedIn warm-up and limits
- Smart sequences and conditions
- Image and GIF personalisation
- Mailbox warmup
- SPF, DKIM and DMARC checks
- Email sending and mailboxes
- Reply inbox
- Lead finding and verification
- Agency and team features
- Integrations and API
See it on your own mailbox.
Connect a mailbox. Warmerly runs alongside whatever you send from now, so you can compare before you move anything.
Free plan, no card. Paid plans: 7-day trial, first charge on day 8.