Privacy policy
Last updated 29 October 2026
Who we are
Leadaby (leadaby.com and app.leadaby.com) is a service of SCA Systems Ltd, a company registered in England and Wales, company number 17459287, registered office Piccadilly Business Centre, Aldow Enterprise Park, Manchester, M12 6AE, United Kingdom.
For anything about privacy, email privacy@leadaby.com.
Our registration with the Information Commissioner's Office (ICO) is being processed. Its number will be shown here once it is issued.
Two kinds of people this covers
- Our customers: web designers, agencies and freelancers who sign up and use Leadaby, plus partners in our partner programme.
- The businesses in the leads: local businesses that Leadaby finds. Most are companies, but a sole trader's name, work phone number or address is personal data, so we treat it with the same care.
What we collect from customers
| What | Details | Why |
|---|---|---|
| Account | Your email address, and your name if your sign-in provider (Google or Apple) shares it. | To sign you in and contact you about your account. |
| Profile | Your business name, country, time zone and the details you put in your profile and settings. | To set up your workspace, prices in your currency, and your days and months in your own time zone. |
| Your work | Lead Packs, call logs, notes, tags, bookmarks, goals, and your questions to Aby AI with its answers. | This is the product. It stays in your workspace and only your workspace members can see it. |
| Billing | Your plan, its status, and the history of changes. Stripe keeps your payment details, billing address and any tax ID. | To charge you and give you the plan you paid for. |
| Usage | How many new leads, searches, website checks and Aby questions you have used, and what each cost us. | To apply your plan's limits and keep the service affordable. |
| Product events | Which pages you open and which features you use (for example 'logged a call'), with a random id for each visit. Never the details of a business. | To see what works and what to improve. |
| Where you came from | The first link that brought you to us: a campaign tag, the website that linked to us, or a partner link. Sent once, after you sign up. | To know which channels bring customers, and to pay partners. |
| Feedback | What you write in 'Send feedback', with the page you were on. | To read it and reply. |
| Waitlist | Your email address if you join the waitlist, and which button you pressed to join. | To email you when Leadaby opens. Nothing else. |
| Security records | Sign-in attempts and unusual activity. IP addresses are kept only as a one-way code plus a shortened label (for example 81.2.69.x). | To protect your account and the service. |
Partners also give us the name for their partner card and their link code. To pay them we need bank or Wise details, which they send us directly and which we keep only for paying them.
What we hold about the businesses in leads
When a customer searches an area, Leadaby looks for local businesses and checks whether they have a working website. Here is what we keep and where it comes from.
- Google Maps. Searches use Google Maps Platform. Google's terms only let us store a business's place ID. Names, phone numbers, addresses and ratings from Google are shown live and are not stored by us.
- Open data. Business name, phone, address and category from the Overture Maps Foundation's open places data, which may be stored.
- Our website check. We visit the business's own website (its home page, contact page, robots.txt and sitemap) and may use Brave Search to find it. We keep what we found, as plain facts: for example "no website found" or "page title is just 'Home'".
- Companies House. For some UK leads, the company's registered type and status, from the public register.
- Our customers' own work: the notes and call logs a customer writes about a business stay in that customer's workspace.
We do not collect home addresses, personal social media or anything about a business owner's private life, and we never send automated calls, texts or emails. Every call or message is made by a person at one of our customers.
Who decides what. We are the controller for the business data Leadaby finds and checks. For the notes and call logs a customer writes, and for the outreach they do, the customer is responsible for using them lawfully, and we hold them on the customer's behalf.
If your business is in Leadaby and you want it removed
Use the form at leadaby.com/remove, or email privacy@leadaby.com, with your business name and its phone number or website. We check every request by hand, usually within a day, so nobody can remove a business that is not theirs. Once approved, Leadaby searches leave your business out, matched by that phone number or website, so it is not found again. We reply within one month, usually much sooner, and delete what we hold about your business, keeping only what we need to keep it removed.
You can also object at any time to us holding your details for direct marketing. When you do, we stop: we do not weigh it against our interests.
In the UK you can also register your number with the Telephone Preference Service (TPS) or Corporate TPS (CTPS). Our customers are responsible for screening against those lists before they call.
Our lawful bases (UK GDPR)
| Purpose | Lawful basis |
|---|---|
| Running your account and the service you pay for | Contract |
| Billing records and tax | Legal obligation (we keep accounts for HMRC) |
| Finding, checking and listing local businesses for our customers | Legitimate interests: helping businesses that sell websites find businesses that may want one. We keep this to business contact details and public facts, and anyone can opt out. |
| Product events, where you came from, security records | Legitimate interests: improving and protecting the service |
| Paying partners | Contract (the partner terms) |
| Emailing you when Leadaby opens (the waitlist) | Consent: you asked us to. Ask us to take you off the list at any time. |
We have weighed these interests against the rights of the people involved.
Because business data comes from public and open sources, not from the business itself, this page is how we tell those businesses what we hold. We do not write to every business individually; that would mean contacting thousands of businesses who may never be called.
Who helps us run Leadaby
These services process data for us. Each one only gets what it needs for its job.
| Service | What it does for us | Where |
|---|---|---|
| Supabase | Our database and sign-in (including sign-in emails) | Ireland (EU) |
| Vercel | Hosts the website and app | Ireland (EU) for the app's server; pages are served from Vercel's global network |
| Stripe | Payments, invoices, tax and the billing portal | USA, Ireland |
| Google Maps Platform | Business search, place details and the map card in the app | USA |
| Brave Search | Web search during a website check | USA |
| Anthropic | The AI model behind Aby AI and enhanced search. Aby's working transcript is deleted when each question finishes; what you type in enhanced search is not stored by Leadaby. | USA |
| Resend | Emails we send ourselves (alerts and service emails) | USA |
| Cloudflare Turnstile | The check on the waitlist form that stops bots. It sees your browser and IP address when it loads. | USA |
| Companies House | Company type and status for UK leads (a public UK government register) | UK |
| Google Fonts, OpenFreeMap | The website's font and the app's map tiles. They see your IP address when your browser loads them. | USA / EU |
We never sell personal data and we do not use it to train AI models. Anthropic does not train on data sent through its commercial API.
Data sent outside the UK
Some of these services are in the USA. When personal data leaves the UK we rely on the UK–US data bridge where the service is certified, or on the UK International Data Transfer Addendum to the EU standard contractual clauses in its terms.
How long we keep things
| Data | How long |
|---|---|
| Your account, profile and work | While your account is open, then deleted within 30 days of closing it |
| Billing and tax records | 6 years, as UK tax law requires |
| Product events and where you came from | 24 months |
| Security records | 90 days |
| Aby AI's working transcript | Deleted as soon as the question is answered. Your chats stay until you delete them. |
| What you describe in enhanced search | Not stored: sent to the AI model only to suggest business types, each time you ask for them. |
| Google place IDs | As long as the lead is in a workspace (Google allows this) |
| Website check results | Re-checked after 90 days; replaced by the newer result |
| A business that asked to be removed | Only what we need to keep it removed |
| Waitlist emails | Until we have told you Leadaby is open, or sooner if you ask us to take you off the list |
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct it, or delete it;
- limit how we use it, or object to how we use it (always, for direct marketing);
- give you your data in a format you can move to another service.
Email privacy@leadaby.com. We reply within one month. It is free. If you are not happy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put it right first.
In the US, you have the same requests available to you, whichever state you live in. We do not sell or share personal information for targeted advertising.
Children
Leadaby is a business tool. It is not for anyone under 18.
Changes to this policy
When we change this page we update the date at the top. If a change matters to how we use your data, we will tell customers by email first.
