# Privacy Policy · Leadraft

URL: https://leadraft.co/privacy
Summary: What personal data Leadraft handles, where it comes from, why, and how to remove or correct it.

Legal · Last updated October 31, 2026

# Privacy Policy

What we hold, where it comes from, why, and how to have it removed.

This policy explains what personal data Leadraft handles, where it comes from, why, and what you can do about it. It covers two different groups of people:

-   **People who appear in our business data**, for example the owner of a bakery whose work email is listed on the bakery's website.
-   **Our customers and visitors**: people who use leadraft.co and the Leadraft app.

If you only want your business removed or corrected, you don't need to read all of this. Use the [opt-out page](https://leadraft.co/opt-out). It takes a minute and no account is needed.

## Who we are[#](#who-we-are)

Leadraft ("Leadraft", "we", "us") runs leadraft.co and app.leadraft.co. For the business data described below, we are the data controller. For files and lists our customers upload or export, we act on our customers' instructions.

Legal entity and registered address: \[to confirm\]. Contact for anything in this policy: [privacy@leadraft.co](mailto:privacy@leadraft.co).

## Our business data[#](#our-business-data)

### What it is and where it comes from[#](#what-it-is-and-where-it-comes-from)

Leadraft finds businesses on public map listings, chiefly Google Maps, and then reads each business's own public website. From those two public sources we collect:

-   **Business details**: name, category, address, coordinates, phone number, website, opening hours, rating and review count, and links to its listing.
-   **Business contact details**: email addresses and social profiles that the business publishes on its own website or listing, such as `info@`, `bookings@` or a named work address.
-   **Information we derive**: whether an email address can receive mail (see [how verification works](https://leadraft.co/methodology/verification)), its role (e.g. "sales", "general"), where we found it, and when.

We do not collect private or home addresses, personal social media accounts, or any data behind a login. We do not buy data from brokers.

### Why we process it and on what legal basis[#](#why-we-process-it-and-on-what-legal-basis)

We process business data so our customers can find and contact businesses that may want their products or services, which is business-to-business prospecting.

Where data protection law requires a legal basis (for example the EU and UK GDPR), ours is **legitimate interest**: our interest, and our customers' interest, in business-to-business prospecting, using contact details that businesses have chosen to publish for that kind of contact. We have weighed this against the interests of the people concerned. To protect them, we:

-   collect only professional contact details that are already public;
-   check emails without ever sending a message to them;
-   keep a suppression list: once you object, we stop delivering your details to customers, and our customers' exports remove you automatically;
-   require customers to follow email-marketing laws (see our [Terms](https://leadraft.co/terms) and [Acceptable Use Policy](https://leadraft.co/acceptable-use)).

### Who receives it[#](#who-receives-it)

Our paying customers receive business records that match their searches. They become independent controllers of the data they export, and are responsible for using it lawfully. We don't sell the database as a whole, and we don't publish personal contact details on our public website.

### How long we keep it[#](#how-long-we-keep-it)

We keep a business record while it remains available at its public source and is useful to the service. We refresh records over time: when a business or email disappears from its source, it stops being delivered. If you object, we keep only the minimum needed to make sure you stay suppressed (for example your email address or a hash of it).

### Telling people we hold their data[#](#telling-people-we-hold-their-data)

Because this data comes from public sources rather than from you directly, we tell you through this policy and the [opt-out page](https://leadraft.co/opt-out) rather than contacting every business, which would mean sending unsolicited email to millions of addresses.

## Our customers and visitors[#](#our-customers-and-visitors)

### What we collect[#](#what-we-collect)

-   **Account data**: name, work email, organization name, team members, and sign-in details (handled by our authentication provider; we never see your SSO password).
-   **Billing data**: plan, invoices and payment status. Card details are handled by Stripe and never stored by us.
-   **Usage data**: searches you run, areas you draw, lists you export, settings, and the destinations you connect (we store API keys for those destinations encrypted).
-   **Support**: messages you send us.
-   **Website data**: basic logs (IP address, browser, pages visited) and the cookies described in our [Cookie Policy](https://leadraft.co/cookies).

### Why and on what legal basis[#](#why-and-on-what-legal-basis)

To provide the service you signed up for (contract); to bill you and keep records (contract and legal obligation); to keep the service secure, fix problems and improve it (legitimate interest); and to send you service emails. We send product news only if you have not opted out. You can unsubscribe at any time.

### How long we keep it[#](#how-long-we-keep-it-1)

Account and usage data are kept while your account is open and deleted within 30 days after you close it \[to confirm\]. Invoices and billing records are kept as long as tax law requires (typically up to 7 years). You can export or delete your organization's data yourself from the app's settings.

## Service providers and transfers[#](#service-providers-and-transfers)

We use a small number of providers who process personal data on our behalf under contracts that require them to protect it. Current list \[to confirm\]:

Scroll horizontally if needed →

| Provider | Purpose |
| --- | --- |
| Stripe | Payments and invoices |
| WorkOS | Sign-in, single sign-on, multi-factor authentication |
| Sentry | Error monitoring |
| OpenAI | Suggesting related search keywords (receives search terms only, never business contact data) |
| Serper | Web search used to find a business's website when the listing has none (Pro and Scale plans) |
| Hosting and storage providers | Running the service and storing data \[to confirm: names and regions\] |

Some providers are based outside your country, including in the United States. Where the law requires it, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.

When you connect a destination such as Instantly, HubSpot or a webhook, we send the data you choose to that destination on your instruction. That destination's own terms and policies then apply.

## Your rights[#](#your-rights)

Depending on where you live, you may have the right to:

-   **access** the personal data we hold about you;
-   have it **corrected** or **deleted**;
-   **object** to its use, including for prospecting. You can object at any time, without giving a reason;
-   **restrict** its processing, or receive a **portable** copy;
-   **complain** to your data protection authority (for example your national supervisory authority in the EU, or the ICO in the UK).

**California residents** have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its "sale" or "sharing". Customers pay to access business records, which may count as a "sale" under California law, so you can opt out using the [opt-out page](https://leadraft.co/opt-out). We will not discriminate against you for exercising these rights.

To use any of these rights, use the [opt-out page](https://leadraft.co/opt-out) or email [privacy@leadraft.co](mailto:privacy@leadraft.co). We reply within 30 days. We may ask for information to confirm the request is genuine, for example a reply from the email address in question.

## Security[#](#security)

Data is encrypted in transit. Access is limited to people who need it, and sign-in supports single sign-on and two-factor authentication. Read more on our [Security page](https://leadraft.co/security).

## Children[#](#children)

Leadraft is a business tool and is not directed at children under 16. We don't knowingly collect their data.

## Changes[#](#changes)

We may update this policy. If a change is significant, we will tell customers by email or in the app before it takes effect. The date at the top shows when it last changed.

## Other policies

-   [Terms of Service](https://leadraft.co/terms)
-   [Acceptable Use Policy](https://leadraft.co/acceptable-use)
-   [Cookie Policy](https://leadraft.co/cookies)
-   [Security](https://leadraft.co/security)
-   [Remove or correct your business](https://leadraft.co/opt-out)

Last built: 2026-11-09