Privacy Notice

1. Who we are

Leadistry is operated by Leadistry Ltd, a company registered in England and Wales (company number 17340225), whose registered office is 195 Wood Street, London, E17 3NU, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC200538. We act as the controller for the personal data described in this notice.

For privacy-related queries, contact hello@leadistry.co.uk.

2. What data we hold

We hold company-attached records on UK incorporated entities:

• Company name, registered number, registered office address, SIC codes, incorporation date, status, and other fields from the Companies House register.
• Details of company officers (directors, members) as recorded in the Companies House register: name, role, appointment date, nationality, and stated occupation.
• Where available from the company's own publicly accessible business website: the website URL, a business email address, and the company's social profiles.
• Where available from public search engines and public professional profiles (for example a LinkedIn profile): a director's public LinkedIn profile URL, and, where a company publishes a named business contact, that person's name and business email address.

We do not collect or hold special-category data. We do not profile or score individuals; any scoring we apply (for example, our internal “website match” confidence score) describes the quality of a company-to-website match, not the individual.

3. Where the data comes from

We build each record from publicly accessible sources:

• The open Companies House register, made available by Companies House under the Open Government Licence (company details and officer information).
• The company's own publicly accessible business website (we respect robots.txt and use a clearly identifiable user agent).
• Public search engines and public professional or social profiles (for example a LinkedIn profile). We use these to locate a company's website, to identify the correct named business contact, and to record a director's public LinkedIn profile where one is publicly available.

We do not purchase marketing contact lists, and we do not buy personal data from third-party data brokers. Our enrichment uses only sources that are already publicly accessible. If you would rather not appear, you can object or ask us to remove a record at any time (see “Your rights” below).

4. The browser extension

The optional Leadistry browser extension is a companion to your account. It matches UK company websites you choose to visit against the Companies House register and your Leadistry account, and lets you save a matched company to that account in one click. That is its single purpose.

While you browse, the extension looks for UK company signals in the visible text of the page you are on (a Companies House number, a UK postcode, a VAT number, or a “Registered in” mention). This detection happens inside your browser. If no UK signal is found, nothing about the page leaves your browser: non-UK browsing is never sent to us.

When a UK signal is found, the extension sends only the page hostname, the page title, and the extracted signals to leadistry.co.uk over HTTPS, solely to check the company against the public record and tell you whether it is already in your account. The full page content and full URL path are never transmitted or stored.

• Saving is always an explicit click.If you click “Save to Leadistry”, we record the company's Companies House number and the source URL against your account and queue a server-side enrichment job (website, business email, phone, director LinkedIn) using the same pipeline as platform searches. Enrichment runs from our servers, never from your browser session.
• Authentication. The extension stores a scoped, revocable session token locally (the Chrome storage permission) so you do not have to sign in repeatedly. Your full website session is never stored in the extension, and you can sign out from the popup at any time.
• Manual scan.The optional “Scan this site” button checks the current page only when you click it. If the page is not a UK company, you can still save it to your own account as a basic capture.
• What it never does. It does not read passwords or payment fields, does not scrape LinkedIn or other sites from your logged-in sessions, does not sell or share browsing data with anyone, and does not collect anything beyond the detection and explicit actions described here. Fresh server-side lookups are limited by a daily quota shown in the popup.

You can remove the extension at any time from your browser's extensions page. Removing it does not delete companies you already saved to your Leadistry account; you can see or remove those on the “From your browser” page inside your account, or by contacting us at hello@leadistry.co.uk.

5. Connecting your own mailbox

Leadistry can send your outreach from your own mailbox, so replies arrive in your real inbox and your emails look like they came from you, because they did. Connecting a mailbox is optional, and you can disconnect it at any time. There are two ways to connect it.

With Google (Gmail and Google Workspace) and Microsoft (Outlook and Microsoft 365), you sign in on their own screen. We never see, receive or store your email password. What we receive is an access token, which we hold encrypted at rest and use only for the purposes below.

With any other email host, for example IONOS, GoDaddy, 123 Reg, Hostinger, Zoho or Fasthosts, and with Gmail if you would rather use an app password, you give us the mailbox's address and its password. We check them with your host once, then hold that password encrypted at rest, with the same protection as the access tokens above, and use it only to send the emails you have approved and to read the replies to them, in the ways set out below. Where your host offers an app password, we ask for that instead, because you can withdraw it on its own without changing the password you use yourself.

What we access, and why. With your permission we use the following, and nothing else:

• Your email address, to confirm which mailbox you connected and show it in your account.
• Permission to send mail as you, used only to send the outreach messages you have set up and switched on. We never send anything you have not configured.
• Read access to your messages, used only on the threads we sent for you, and for three things. First, to spot a reply, so we can stop emailing that person. Second, to spot a bounce notice, so we can suppress an address that does not exist. Third, when the reply is to a message you sent from your Feed, to fetch that reply itself: we store its sender, subject and the first 8,000 characters of its text, show it to you on your Desk, and use it to draft your answer when you ask us to. Drafting your answer sends that text to Anthropic, as described in section 8. For every other message we sent, we read only the headers we need (sender, subject, and the flags that mark an automatic reply or a delivery failure). We match every read against the threads we sent on your behalf. We do not read, index, store or display any message that is not a reply to one of them, and we never touch the rest of your mailbox.

What we never do. We do not sell mailbox data. We do not use it for advertising or to build profiles. We do not use it to train generalised artificial intelligence or machine learning models. We do not let humans read your mail, except in the narrow cases the Limited Use policy allows: with your explicit consent, where it is necessary for security purposes such as investigating abuse, or where we are required to by law.

Leadistry's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting.You can disconnect a mailbox at any time from your Leadistry account, which deletes the stored tokens or password and stops all access immediately. You can also revoke our access directly from your Google account's security settings or your Microsoft account, and we will keep no usable access after you do.

6. What we use it for

We make these records available to our customers, who are UK businesses, for the sole purpose of identifying and contacting other UK corporate businesses for legitimate B2B marketing (for example: a UK accountant identifying other UK businesses that might wish to engage their services).

When a customer emails you through Leadistry, the message carries no open-tracking pixel: we do not record whether you opened it, or when. The links in a first email go straight to where they point. In a follow-up email the links go through our click counter, so if you click one we record which link it was and when, for the customer who sent it, and that email says so at the bottom. The unsubscribe link and the link to remove your details are never counted. The counter stores nothing on your device and keeps no IP address. We also record whether you replied, whether the address bounced, and whether you used the unsubscribe link, which is what stops anything further reaching you. If you would rather not be contacted through the platform at all, you can ask us to remove your company's record at /remove-company (see “Your rights” below).

We also use a limited set of business contact details (a company name, its business email address, and SIC sector) to contact relevant UK businesses about Leadistry itself, our own B2B service. We only do this for incorporated entities at their business email address, never consumer webmail or individual subscribers, and every message identifies us and carries a one-click unsubscribe.

You can opt out at any time (see “Your rights” below, or the unsubscribe link in any message); we then add you to a permanent suppression list and will not contact you again.

If you hold a Leadistry account, we may send you product updates and prospecting tips by email. When you sign up with an email and password we offer an optional checkbox for this; where you sign up another way (for example with Google) we rely on the PECR “soft opt-in”, because you are an existing customer and the messages are about our own similar B2B service.

Either way you can switch these marketing emails off at any time in Settings → Email preferences, and every marketing email includes a one-click unsubscribe (RFC 8058) that takes effect immediately. Service emails about your account (receipts, security notices, search results) are not marketing and are sent regardless of this preference.

Emails we send to account holders, whether service or marketing, carry no open-tracking pixel. The links in them may go through a click counter, ours or our email provider's, so we can see which links are used and whether a message arrived. We use this only to measure and improve our own emails, never to profile you.

How we count visits to our website. When you arrive at our website, our own visit counter records the date and time, the site you came from (for example Google or ChatGPT), the page you landed on, and any campaign tags in the link you followed (such as utm_source). It also records each page of our public website that you open during the same visit, and the order you open them in. If you then open the sign-up page or press a sign-up button, it records that too, and if you create an account in the same visit, the record is linked to your account. If you use the box that shows example companies, it records that the box was shown, that a choice was made in it and whether you closed it, but not what you chose. If you go on to create an account, the choice goes into your set-up and is kept on your account. To tie these steps together, the page makes a random number when it opens and sends it with each step; your browser forgets it when you close the page.

The visit counter sets no cookie, stores nothing on your device, and does not keep your IP address or any details of your browser or device. Visits from search engine robots are left out. We rely on our legitimate interests for this: knowing which pages, and which sites, bring people to us and lead them to sign up. We keep these records for 400 days.

We do not use the data for credit decisions, fraud assessment, employment screening, insurance pricing, or any automated decision-making that produces legal or similarly significant effects on individuals.

7. Lawful basis

Our lawful basis for processing under UK GDPR Article 6(1)(f) is legitimate interests. The legitimate interest is enabling UK businesses to identify and contact other UK businesses for B2B marketing, which we believe is a recognised commercial interest. We have conducted a written Legitimate Interests Assessment (LIA) recording the purpose, necessity, and balancing tests.

We rely on the same basis, Article 6(1)(f) legitimate interests, for our own direct marketing of Leadistry to UK businesses, together with the business-to-business exemption in PECR Regulation 22(3) for marketing email to corporate subscribers. A separate Legitimate Interests Assessment records that purpose, necessity, and balancing test. We send only to business email addresses of incorporated entities, never to individual subscribers, and we honour opt-outs immediately and permanently.

Where personal data is delivered to a customer (for example, a named director email address), we additionally apply the following safeguards on top of Article 6(1)(f):

• Named personal email addresses are only ever delivered for incorporated entities (private limited, public limited, LLP, and similar). They are never delivered for sole traders or general partnerships.
• Named personal email addresses on freemail domains (gmail, outlook, proton, UK ISP webmail, and similar) are never delivered, regardless of the company type, because such addresses are individual subscriber addresses under PECR.
• Email addresses are MX-validated before being classified for delivery. Addresses on domains that do not accept email are not delivered.
• The public objection mechanism at /remove-company applies globally across every customer's subsequent searches.

We rely on the Article 14(5)(b) exemption (information not provided directly to data subjects because it would involve disproportionate effort), supported by this publicly accessible privacy notice and the global suppression mechanism. We are available to discuss the basis for this reliance with the ICO on request.

8. Who we share it with

We share the records with our paying customers, subject to contractual restrictions in our Terms of Service requiring them to (a) contact only corporate subscribers, (b) honour opt-out requests they receive, and (c) identify themselves clearly in any marketing they send. Customers act as independent controllers in respect of any marketing they send.

Our technical processors (Stripe for payments, Resend for transactional email, Vercel for hosting the website and for cookieless traffic and performance measurement, Railway for hosting our backend, Cloudflare for content delivery and counting clicks on email links, Microsoft 365 for operating the hello@leadistry.co.uk mailbox (UK/EU region), Sentry for error tracking, PostHog (US region) and Microsoft Clarity for product analytics and session replay, Google Analytics 4 for traffic measurement, Serper (US) for the web searches described below, Webshare (US) for the proxy network our crawler uses to fetch public web pages, and Fontshare (Indian Type Foundry) for one of the typefaces on this site, which its licence requires us to serve from their servers rather than ours, so your browser requests it from them) process limited operational data on our behalf under Article 28 controller-processor contracts. The current list, with each processor's location and purpose, is published at leadistry.co.uk/sub-processors.

Serper (US) runs web searches on our behalf as part of building the records described in section 3. Those searches contain a company name and, where we are looking for a named officer's published work address or public professional profile, that officer's name. Serper returns public search results; it is not given any customer data.

Anthropic (US) is the primary processor for our AI-assisted features (the AI setup assistant, the AI assistant inside the app, your agents, the Desk, outreach drafting suggestions, and search interpretation), through Anthropic's Claude API. What it receives is: the text you type into those features and the minimum account context needed to answer; the pitch you have saved; the public-record information about a company that an agent is writing to, which for a small company usually includes a named director, together with the filing or trading fact the agent is writing about; and the text of each reply to an email you sent through Leadistry, as it arrives in your connected mailbox.

The AI reads each reply to sort it, for example a meeting agreed, a quote asked for or not interested, so your Desk can count your wins, and uses it to draft an answer when you ask for one. Under Anthropic's commercial API terms, API inputs and outputs are not used to train Anthropic's models.

OpenAI (US) acts as a secondary (fallback) processor for the same features and processes the same data only where a request to Anthropic fails or Anthropic is unavailable; under OpenAI's API terms this data is likewise not used to train their models.

If you use the AI setup assistant, it also reads the publicly accessible content of the business website whose address you provide (normally your own), and stores a short business profile derived from that content against your account so that it can draft searches and outreach emails for you. What the assistant writes is saved as a draft. Two things then happen without a further click, and you set both up yourself: a lead is counted when an agent you built delivers it to your Feed, and, if you switch autopilot on, the cards on your rule are sent in your sending hours whether or not you log in. Switching autopilot off brings back to you the cards on your rule that have not been sent.

The AI assistant inside the app, available on every page, can also act on your own account when you ask it to: for example, change the wording of your pitch, set up or pause an agent, or update the business name and address shown in your email footer. To do that it reads and changes your account data through the same controls you use in the app. Anything that would send an email, spend your leads, switch on autopilot or cannot be undone is shown to you first and happens only when you press Confirm. It cannot see your mailbox credentials or payment details, and it cannot act on anyone else's account.

The assistant has a microphone button for speaking a message instead of typing it. Your browser turns your speech into words. Depending on the browser, this can happen on the browser maker's own servers (for example Google for Chrome, Microsoft for Edge and Apple for Safari), under that company's terms. We never receive the sound: only the words, which appear in the message box for you to read and send yourself. Browsers that cannot do this, such as Firefox, show no microphone button.

If you connect an AI assistant of your own to your account (for example Claude, through the connector described on our Connect Claude page), the data that assistant asks for, which can include your leads, your Feed, your pitches, your replies and your results, is sent to that assistant's provider under your own agreement with that provider, not under ours. You choose what it may see on the permissions screen when you connect it, you can disconnect it in Settings at any time, and we keep a log of what it did.

If you grant that assistant the sending permission on the connection screen, it can then approve cards, send a reply and switch autopilot on without asking you again, so grant it only if you mean it; you can withdraw it by disconnecting. Whatever you grant, it has no access to your mailbox credentials, your payment details, or any do-not-contact list.

PostHog (US Cloud), Microsoft Clarity, Google Analytics, Anthropic, OpenAI, Serper and Webshare involve transfers outside the UK. For Anthropic, OpenAI and Serper those transfers include personal data about the people in the records described in section 3, not only operational data about our customers. All of them are covered by the UK's International Data Transfer Addendum to the EU SCCs or equivalent transfer mechanisms published by each processor. Analytics tools that set cookies or store anything on your device (PostHog, Microsoft Clarity and Google Analytics) only load after you accept the relevant cookie category in the consent banner. Two kinds of measurement set no cookie and store nothing on your device, so they run whether or not you accept: Vercel's traffic and performance measurement, and our own visit counter described in section 6.

We do not sell the data onward to third-party data brokers.

9. How long we keep it

Company-level records are retained for as long as the company remains active on the Companies House register or until you successfully exercise an objection right via the suppression mechanism described below. Suppression entries are kept indefinitely so that objections are honoured across all future data refreshes.

Account-level data we hold about you as a customer (sign-up email, billing records) is retained for the duration of your account plus a maximum of 7 years after account closure to meet UK statutory record-keeping requirements.

Your conversations with our AI assistants, the setup chat when you sign up included (what you type, their replies, and what they proposed or changed on your account), are kept for 90 days and then deleted automatically. We keep them so that a conversation carries across pages and devices, so that we can help if something goes wrong, and so that our team can see where the assistant answered badly and make it better. They are deleted sooner if you close your account or ask us to delete your data.

10. Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to ask us to correct inaccurate data, to ask us to erase data in certain circumstances, to object to processing for direct marketing under Article 21, to restrict our processing, and to data portability where the data was provided by you directly. These are described in more detail at leadistry.co.uk/gdpr.

11. How to exercise your rights

The fastest route for whole-company removal is the public form at leadistry.co.uk/remove-company: no account is needed and suppression is applied automatically within seconds. For director-level removal and other requests (access, correction, objection to processing, erasure), use the form at leadistry.co.uk/data-removal; those requests are reviewed manually. We aim to acknowledge them within 72 hours and to action them within 30 days where applicable.

Alternatively, email hello@leadistry.co.uk. We may need to verify your identity before responding to requests concerning personal data.

12. Complaints

If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner's Office. You can do so at ico.org.uk/make-a-complaint or by calling the ICO helpline on 0303 123 1113. We would, however, appreciate the opportunity to address your concerns directly first.

13. Changes to this notice

We may update this notice from time to time. Material changes will be communicated on this page with the “Last updated” date above. Previous versions are available on request.