WaLead

Four agents cover the funnel and the buyer picks which model runs each one, but the product survives their removal.

The agent layer is real and named. Screener filters, Scorer ranks, Prospector searches, Closer reads each conversation and proposes the reply that moves it toward a meeting. A Copilot answers questions about operating the platform itself. Generated variables personalise each message from a single prompt. All of it is included in the subscription with no separate module.

The credit table proves the model layer is metered rather than decorative. Generating one message costs half a credit on the cheapest model, two on a mid tier model and ten on the most capable, so a buyer choosing quality pays for it per message and can see the exact ratio.

What holds the grade below the top is what remains after the agents are stripped out. A database of more than 16 million Spanish contacts, a twenty supplier enrichment cascade, sequencing across the professional network, a unified inbox and synchronisation with five record systems. That is a complete and saleable product on its own, and for a Spanish buyer it is arguably the reason to sign.

The credit unit also spans both halves. One credit buys a mail address, ten buy a mobile number, and the same currency buys inference, so consumption alone does not separate data spend from model spend.

Ask what proportion of a typical account's credits go to enrichment rather than generation.

The sending path runs alone, the reply path stops for a human, and the split is stated rather than blurred.

Outbound is autonomous once a sequence starts. Profile visits, connection requests, messages, follow ups and interactions execute on a schedule without further approval, across as many connected profiles as the buyer pays for.

The reply side deliberately holds back. The Closer agent reads each conversation and proposes the response it thinks best, and a separate assistant classifies incoming replies by intent so the operator knows who to answer first. Both inform a person rather than replace one, and the vendor describes them that way.

Two systems act without asking and both are disclosed. The health score adjusts daily activity on its own judgement of account risk. A recovery mode pauses the account entirely when it detects anomalies. Pending invitations are deleted automatically when they accumulate.

The oversight controls a buyer actually needs are present and configurable. Daily ceilings on invitations, messages, visits and follows. Permitted days, hours and timezone. An account wide blocklist of people and companies that will never be contacted.

What is absent is any published approval gate on generated message content before it sends, and the vendor states plainly elsewhere that validating the legality of generated content before using it with third parties is the customer's job.

Ask whether a campaign can be held for review between generation and send.

The model is named, the version is named, the price of each is published, and the buyer may swap in their own.

Three providers are named in the privacy policy as supplying the models behind the agent layer. The pricing page goes further and names specific model versions beside the credit each consumes to generate one message, so a buyer can read the cost difference between the cheapest and the most capable at a ratio of one to twenty before signing anything.

Model selection is exposed to the customer per agent, with the tradeoff stated openly: the more capable models produce better results and consume more credits, and the decision is left to the buyer. Customers may also supply their own provider keys and spend their own inference budget instead.

The data handling around the models is stated with the same directness. Processing agreements are signed with each provider. Public models are not trained on private customer data. Content produced by the agents, meaning messages, scores and summaries, is stored inside the customer workspace and remains under their control.

A native connector exposes the platform to one of the named assistants directly, which means the buyer can inspect what the system does from outside it.

One gap keeps this short of complete. The company also refers to models of its own without describing what they do or how they were built, and the scoring and screening logic behind the agents is not documented.

Naming a model version alongside its per message cost is the clearest disclosure of this kind recorded in the index.

Named customers with checkable identities, sitting beside large logos and round numbers that carry no method.

The testimonials are the strong part and they are unusually verifiable. Three appear with full name, job title and employer, including a chief executive at a sales training company and a chief executive at a growth consultancy. One of those same individuals appears independently on a major review directory writing about the product under his own name and company size. Corroboration of a site testimonial against an independent platform is rare and it happened here without being claimed.

The claims around them are softer. Sixty percent more meetings and two to three hours saved daily are quoted from customers rather than measured, with no sample, period or baseline. More than a thousand customers and zero account bans are published as headline counters, and the second of those cannot be falsified by anyone outside the company.

Eight recognisable brands appear as customer logos, including a consumer electronics manufacturer, a networking hardware maker and a Spanish bank. Two passes located no case study, no named deployment and no published detail behind any of the eight.

The directory rating is high at four point nine, on a review count in the low single digits, which is too thin to carry weight in either direction.

The founder speaks publicly about the origin of the product on an independent podcast, which supports the company narrative but not the outcome figures.

A buyer should ask for one reference in their own segment and the definition behind the sixty percent.

A genuine suppression route for people in the database, wrapped around an outreach model that shifts every obligation to the customer.

The strong part is clause fourteen of the privacy policy and it deserves credit. Anyone whose details sit in the contact database may demand removal whether or not they are a customer, by writing from the associated address or otherwise identifying themselves. The company commits to acting within one month, deleting the profile and keeping only what is needed to record the exclusion and stop the record being reinstated later. A published suppression register that survives future imports is more than most data vendors offer.

Inside the product, an account wide blocklist prevents named people and companies from ever being contacted, and it applies across campaigns rather than per campaign.

The posture on the outreach itself is the opposite. Use of the automation is stated to be at the exclusive responsibility of the user. The company disclaims responsibility for misuse, for unconsented commercial communications, for impersonation and for harassment, and requires the customer to validate the legality of generated content before sending it. No consent framework, permitted use policy or jurisdiction guidance accompanies the sending tools.

The volume ceiling is published at eight hundred invitations per month per connected profile, and profiles are unlimited, so a buyer can compute the reachable population and the vendor does not hide it.

European data rules are engaged seriously. The rules governing unsolicited contact are handed to the customer.

A detailed and current policy that collects little, names its processors, and hedges in two places that matter.

Collection at signup is genuinely minimal: a mail address and a profile link, nothing else. Additional data arrives only through integrations the customer authorises. Usage data is limited to address, browser, timestamps and interactions.

The policy carries a July 2026 revision date, enumerates all six European data rights with a one month response commitment, names the Spanish supervisory authority and its address as the complaint route, and adds Californian access and deletion rights separately. Subprocessors are named rather than described by category, covering payments, in product support and the community platform. Payment card data is never held.

Retention is differentiated properly. Account data persists while the relationship is active or until deletion is requested. Usage data is held for shorter periods. Billing and credit consumption records follow statutory commercial and tax retention.

Two hedges hold the grade down. Encryption is committed to only where applicable, which is the kind of qualifier that should not appear in a security clause at all. And the company reserves the right to change the policy at any time, effective on publication, with no obligation to notify anyone individually.

A third point is framing rather than practice. The company states it does not extract personal data itself and acts as an orchestrator while specialist suppliers obtain the mail address or mobile number. That description positions the enrichment liability outside the company while the customer receives the result either way.

Five upstream suppliers named unprompted on the pricing page, and silence on how the proprietary half was assembled.

The disclosed part is better than the category norm. The enrichment runs as a cascade of up to twenty suppliers queried in sequence until a datum is found and verified, and four external names plus its own are printed on the pricing page beside the credit cost of each lookup. Naming who sits upstream of your data, on a commercial page, without being asked, puts this vendor in the small group in this index that discloses provenance at all.

Verification is described as a step rather than a claim. Each mail address and mobile number is checked before it reaches the customer, and the stated purpose is bounce reduction.

The undisclosed part is the one a European buyer most needs. More than 16 million Spanish business contacts and more than 55 million companies are described as the company's own database, built without third party scrapers, and nothing is published about how those records were gathered, under what lawful basis, or whether the people in them were ever told. For a database marketed on being domestic and compliant, the collection method is the load bearing question and it is absent.

The orchestrator framing complicates it further. If specialist suppliers obtain the personal identifiers, the provenance question moves to them and the twenty supplier cascade is only partly named.

One awkward juxtaposition sits in the feature list. The product ships scraping tools pointed at the professional network and at four public web sources, while the marketing repeats that the database uses no third party scrapers. Both statements can be true and together they read badly.

An evasion stack sold as safety, and an authorisation claim the company's own legal text contradicts.

The product automates a professional network whose user agreement prohibits automated access. Around that core it assembles the most complete avoidance apparatus recorded in this sweep: rotation across unlimited connected profiles from one campaign, a dedicated fixed address per profile in a chosen country across six territories, support for customer supplied addresses, connection by stored credentials as an alternative to the browser extension, automatic deletion of accumulated pending invitations, pacing that the company states mimics genuine human rhythm, adaptive daily ceilings, and an automatic pause when the system detects it is being noticed.

Every one of those exists to prevent the platform from identifying the activity as automated.

The contradiction is the more serious finding. The company page claims to be the first certified partner of that network in Spain and describes an official certification endorsing its expertise in prospecting that complies with the network's terms. The footer of every page on the same site states the company is neither associated with nor endorsed by that network. The privacy policy states it is not affiliated, sponsored, authorised or linked to it. Both statements are published simultaneously in Spanish and English. Two passes located no independent record of any such certification.

The guarantee behaves the same way. Marketing promises an anti ban guarantee and counts zero bans. The privacy policy disclaims responsibility for blocks, suspensions, restrictions and cancellations, and states that the technical measures guarantee no specific outcome.

A buyer inherits the account risk in full and should read clause two before believing the front page.

The three commitments a buyer asks for are stated plainly, and nothing sits behind them.

The stated position is clear on the points that matter commercially. Data processing agreements are held with each model provider. Public models are not trained on private customer data. Generated messages, scores and summaries stay inside the customer workspace under customer control. Those are the right three commitments and they are made without hedging.

Internal access is described with unusual candour: only the chief executive, the technical lead and the developers can reach customer data, and only when needed to operate, maintain or support the service. On a team of five that description is credible precisely because it is so narrow.

What is missing is everything downstream of the commitments. Two passes located no acceptable use policy governing what the agents may generate, no description of guardrails on generated message content, no evaluation, red team or accuracy testing of the scoring and screening agents, and no disclosure of what happens when an agent scores a person wrongly.

The burden runs the other way instead. The customer is told to validate the legal compliance of anything the agents produce before using it with a third party, which places the safety review at the point of use rather than the point of generation.

Monitoring and incident response procedures are asserted in a single line each with no detail, and the encryption commitment is qualified as applying where applicable.

A future published use policy for the agent layer would move this grade. Restating the three provider commitments would not.

The sender is a real person and everything about the sending is engineered to look like they typed it.

Identity itself is genuine, and that keeps this off the floor of the category in principle. The message arrives from an actual profile belonging to an actual member of the buying team. No fabricated persona is involved.

What is concealed is that a machine wrote it and a machine sent it. The message is generated per recipient from a prompt, with no marking, label or indication that it was produced by a model. The vendor states that its pacing system imitates genuine human rhythm, which makes indistinguishability an engineering goal stated in the product description rather than an incidental effect.

Rotation compounds it. One campaign runs across many connected profiles, so several apparently unrelated people may contact the same recipient about the same thing, and nothing reveals the shared origin.

The fixed address per profile completes the picture. Activity is routed through a chosen country so that it consistently appears to originate from one location, which is presented to the buyer as protection and functions toward the recipient as a further layer of consistency in a fiction.

The recipient is never told they are inside an automated sequence, cannot see what is held about them, and has no route to stop the messages. The blocklist exists but only the sender operates it.

One genuine countervailing provision sits elsewhere: a person in the contact database can demand deletion and be recorded as excluded permanently. That addresses the data, not the messages.

Broad where a small Spanish buyer works, absent where an enterprise buyer works.

Direct record system connectors cover five names, all of them credible in the small and mid market: two international mid market platforms, one Spanish platform, one agency oriented platform and one social selling tool. General automation runs through three orchestration services. Cold mail, which the company does not operate, is handed to three named specialist tools rather than imitated.

The developer surface is real. A public application interface with published documentation on its own subdomain, webhooks, and outbound calls available inside sequences. Continuous two way synchronisation with spreadsheets. Comma separated export. A browser extension.

A native model context connector exposes the entire platform to an assistant, which places this vendor in the small group in this index shipping one, and the company markets it as the only tool in its competitive set that does.

Pushing leads to a record system costs zero credits, which matters more than it sounds: the integration is not metered, so connecting the platform to systems the buyer already owns carries no ongoing charge.

The gap is at the top of the market. Two passes located no connector for the dominant enterprise record system, none for the major productivity suite vendor's platform, and none for the widely used mid market alternative. A buyer running enterprise infrastructure reaches this platform through an orchestration service or the interface, not directly.

Two counts published on the site disagree, one banner citing more than a thousand connected tools and another more than six thousand, with the larger figure presumably counting an orchestration catalogue.

European residency claimed repeatedly and firmly, with no named host and no way for a buyer to check it.

The commitment is stated more often and more plainly than most. Personal data sits on servers located in the European Union. The site counts full European residency as a headline figure. Where a supplier operates outside the European Economic Area, the transfer runs under standard contractual clauses or another valid mechanism, and the policy says so specifically rather than gesturing at adequacy.

For a Spanish buyer that is the point of the whole product, and the claim is consistent across the marketing, the about page and the legal text.

What cannot be verified is anything underneath it. Two passes located no hosting provider name, no region or availability zone, no architecture description, no subprocessor list covering infrastructure as opposed to payments and support, no service status page, no uptime commitment and no recovery objectives. European residency asserted without a named host is a claim a buyer must take on faith.

Delivery is cloud only. There is no private, self hosted or dedicated tenancy option, which is consistent with the market being served and closes the door on anyone whose procurement requires one.

One unusual control does exist at the network layer. Each connected profile receives a dedicated fixed address in a chosen country from six available territories, and customers may supply their own. That gives per account control over apparent origin, which is a residency adjacent lever few competitors expose, though its purpose is platform avoidance rather than data governance.

Ask for the hosting provider and region before a security review.

A privacy policy section headed with the name of a standard the company has not been examined against.

Clause seven of the privacy policy is titled with the words information security and the name of the service organisation control standard. The body of that clause says the company applies technical and organisational measures aligned with the principles of the standard. Alignment with principles is a self description. An examination produces a report from an accounting firm, covering a named scope over a named period, and a buyer can request it. Two passes located no auditor, no report type, no period, no scope boundary and no request route.

Placing the standard's name in a clause heading means a reader scanning the seventeen item index of that policy sees the credential and never reaches the qualifier. That is the failure mode this axis exists to catch.

The underlying controls are described in a single line each: access limited to three named roles, encryption where applicable, system monitoring, secure supplier management, incident response procedures. All asserted, none evidenced.

Two passes located no trust portal, no penetration test summary, no information security management certification and no vulnerability disclosure route.

One genuine credential exists and is being read for more than it says. The company holds a certification from the Spanish innovation agency under the Ministry of Industry, which attests to the innovative character and viability of a funded project. It is a public financing credential, not a security one. Its acronym is shared with the European cybersecurity agency, and the badge appears on the about page beside a European servers claim, which invites exactly the wrong inference.

A completed examination would move this grade. Nothing short of one will.

One plan, a calculator, and a published price for every action that consumes anything.

The structure is a single subscription from 65 euros monthly, including one connected profile and a thousand data credits. Additional profiles cost 25 euros each and additional credits 50 euros per thousand. A calculator on the pricing page produces the exact monthly figure for any combination before signup. Team members are unlimited and free. Taxes are stated as excluded and applied by country.

The consumption table is what earns the grade. Each action is priced individually: one credit for a mail address, ten for a mobile number, half a credit to two to ten credits to generate a message depending on the model chosen, one credit to retrieve a recent post or reaction.

More useful still, the vendor publishes what costs nothing. Sending invitations, sending messages, visiting profiles, following up, importing contacts, synchronising with a record system and pushing to cold mail tools all consume zero credits. Publishing the free actions is the disclosure that lets a buyer model real spend instead of guessing, and almost nobody does it.

Every feature is enumerated by category with its inclusion status, and the volume ceiling of eight hundred invitations per month per profile is printed rather than buried.

Cancellation terms are stated without softening: monthly, no lock in, cancel at any time, effective at the end of the current cycle, access retained until then, no refund for the period already billed.

The unpublished items are minor by comparison. No annual rate or discount, no enterprise tier, and the consultancy call is booked rather than priced. Third party directories still carry a superseded three tier structure in dollars, which is their staleness rather than the vendor's.

Multiple unmetered routes out, and no stated window in which to use them after cancelling.

The egress paths are plural and none of them are charged. Comma separated export is a listed feature. Pushing leads to any connected record system costs zero credits, which means moving the working data into a system the buyer already owns carries no consumption penalty at all. The public interface and webhooks provide programmatic extraction. Continuous synchronisation with spreadsheets means a buyer can hold a live copy outside the platform while still subscribed rather than scrambling at the end.

The ownership statement is unambiguous. The company states the data belongs to the customer and can be exported whenever they want, and any integration can be revoked in one click.

European portability rights apply independently, with a one month response commitment and a named supervisory authority behind them.

The gap is the timeline. Retention is described as lasting while the relationship is active or until deletion is requested, and cancellation is described as ending access at the end of the billing cycle. What happens to the data between those two moments is unstated. Two passes located no post cancellation grace period, no stated retention window for export, and no confirmation that export remains available once access ends.

No bulk workspace export covering campaigns, sequences, message history and conversation records is documented, so a buyer leaving takes contacts more easily than they take the work.

Ask how many days after cancellation the export remains reachable, and get the answer in writing.

The most detailed sending discipline in the sweep, aimed at the platform rather than the recipient.

The mechanics are published at a level of detail almost nobody matches. A health score watches each connected profile continuously and adjusts daily limits on its own reading of risk. Invitations, messages, visits and follows each carry a configurable ceiling. Permitted days, hours and timezone are set per account. A recovery mode pauses everything when anomalies appear. The monthly invitation ceiling is printed as eight hundred per profile.

One control shows real operational understanding. Accumulated pending invitations are deleted automatically, because a large unanswered invitation backlog is a genuine risk signal on that platform and most operators never think about it. Identifying and automating that is craft.

Split testing across message versions is included, with the better performer winning on reply rate, which is the correct metric for the channel.

The honest note is what the company refuses to claim. It does not do cold mail, says so plainly in its own feature table, and integrates with three named specialist tools rather than pretending to cover the channel. Declining to claim a channel you do not operate is worth recording.

Two things hold it below the top. Two passes located no reply rate or acceptance rate benchmark with any methodology, sample or period behind it, so the discipline is described but never measured in public. And the anti ban guarantee sits directly against a liability clause disclaiming responsibility for suspensions and guaranteeing no outcome.

The discipline is engineered around avoiding enforcement. Recipient experience is not among the stated objectives.

A deliberately narrow market, defended properly, with a boundary the vendor does not pretend away.

The thesis is explicit in the company's own words: the Spanish speaking market needs a platform conceived in Spanish with European data and local support rather than an American tool half translated. Everything follows from it. Spanish first interface, support staffed in Spanish and English, more than 16 million business contacts concentrated in Spain, a community of more than eight hundred members, weekly training sessions and physical events in country.

Buyer segments are addressed individually with their own pages: lead generation agencies, business to business sales teams, revenue operations and marketing. Agencies get white label resale, which is a distinct commercial model rather than a feature.

Company size runs from a single freelancer through small business to a sales team, and the platform scales by connected profile rather than by tier, so the same product serves one person and twenty. A dedicated account executive appears above five profiles.

The boundaries are real and the vendor does not obscure them. Outside the Spanish speaking market the data advantage disappears entirely and the global company file of more than 55 million is the same commodity everyone else licenses. Upmarket, the record system connector list confirms the ceiling: mid market and Spanish platforms only, with the dominant enterprise system absent.

An English language site exists and is complete, so the product is reachable by an international buyer who wants the automation without the database.

A buyer prospecting outside Spain should evaluate this as an automation tool and price the data separately.