Privacy policy

[Legal entity name — to confirm] (company number [Company number — to confirm]), [Registered address — to confirm]. ICO registration: [ICO registration number — to confirm]. Contact: [privacy contact email — to confirm].

We are the data controller for account data and for the business information we compile. For data a customer adds to its own workspace (for example contacts it imports or notes it writes), the customer is the controller and we process that data on its behalf, under our terms.

We collect:

• your name, work email address and, if you choose Google sign-in, your Google account’s basic profile (name, email and photo). We never receive your Google password;
• the organisation you belong to in LeadFlow and your role in it;
• a record of actions you take in the app (for example who moved a company in the book and when), which we keep for accountability and security;
• technical data needed to run the service securely, such as sign-in sessions and request logs.

We use this to provide the service you or your organisation signed up for (contract), and to keep it secure and improve it (legitimate interests).

LeadFlow AI helps businesses find and contact other businesses. To do that we hold information about organisations and about people in their professional roles:

• company information from public sources, such as Companies House, The Gazette, public operator-licence and regulator registers, public procurement notices and business listings;
• work contact details of people in business roles (name, job title, work email and work phone), from public sources such as company websites and from business-data providers;
• records of contact made through LeadFlow: emails sent, whether they were delivered, bounced or marked as spam, call outcomes and next steps.

Our legal basis is legitimate interests: business-to-business prospecting, carried out in a way a professional would reasonably expect, with an easy way to object. We do not collect special-category data, and we do not send marketing emails to individuals or sole traders who have not agreed to receive them, as required by the Privacy and Electronic Communications Regulations (PECR).

To stop being contacted, reply to any email asking us to stop, or write to [privacy contact email — to confirm]. We will mark you as unsubscribed. LeadFlow blocks further outreach to anyone unsubscribed, and a spam complaint unsubscribes you automatically. We keep a minimal record of the opt-out so we can keep honouring it.

LeadFlow uses automated tools, including AI decision models, to sort and score companies (for example how well a company fits a customer’s ideal-customer profile, or which signals look recent). These judgements help people decide where to focus. They do not produce decisions with legal or similarly significant effects on individuals, and outreach is approved by a person before it is sent.

We share data only with service providers who help us run LeadFlow AI, under contracts that protect it:

• Clerk: accounts and sign-in;
• Supabase: database (hosted in London, UK);
• Vercel: website hosting;
• Resend and Amazon Web Services: sending email (Ireland, EU);
• TypeSafe AI and our own servers: automated decisions and analysis;
• Google: maps and place information, and Google sign-in if you use it;
• if your organisation connects a CRM (such as HubSpot, Pipedrive, Salesforce or Zoho), the data it chooses to sync.

We do not sell personal data.

Some providers are based in, or may process data in, the United States. Where data leaves the UK we rely on UK adequacy regulations (including the UK–US data bridge where the provider is certified) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

• account data: while your account is active, then deleted within 90 days of closure unless we must keep it longer by law;
• business and contact information: reviewed and refreshed, and removed when no longer relevant or on request;
• opt-out records: kept so we can keep honouring them;
• security and audit logs: up to 12 months.

You can ask for a copy of your data, and ask us to correct it, delete it, restrict its use, or move it to another service. You can object to processing based on legitimate interests at any time, and an objection to direct marketing is always honoured. Write to [privacy contact email — to confirm]. We reply within one month.

We use only cookies needed to run the service: sign-in session cookies (Clerk) and a preference cookie remembering which view you chose in the app. We do not use advertising cookies.

Data is encrypted in transit, access is limited by role, and actions in the app are logged. No system is perfectly secure, but we work to protect your data and will tell you and the regulator about a serious breach as the law requires.

Please contact us first at [privacy contact email — to confirm]. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113.

We will update this page when our practices change, and change the date at the top.