Privacy policy

Last updated 29 October 2026

Who we are

Leadaby (leadaby.com and app.leadaby.com) is a service of SCA Systems Ltd, a company registered in England and Wales, company number 17459287, registered office Piccadilly Business Centre, Aldow Enterprise Park, Manchester, M12 6AE, United Kingdom.

For anything about privacy, email privacy@leadaby.com.

Our registration with the Information Commissioner's Office (ICO) is being processed. Its number will be shown here once it is issued.

Two kinds of people this covers

  • Our customers: web designers, agencies and freelancers who sign up and use Leadaby, plus partners in our partner programme.
  • The businesses in the leads: local businesses that Leadaby finds. Most are companies, but a sole trader's name, work phone number or address is personal data, so we treat it with the same care.

What we collect from customers

AccountYour email address, and your name if your sign-in provider (Google or Apple) shares it.To sign you in and contact you about your account.
ProfileYour business name, country, time zone and the details you put in your profile and settings.To set up your workspace, prices in your currency, and your days and months in your own time zone.
Your workLead Packs, call logs, notes, tags, bookmarks, goals, and your questions to Aby AI with its answers.This is the product. It stays in your workspace and only your workspace members can see it.
BillingYour plan, its status, and the history of changes. Stripe keeps your payment details, billing address and any tax ID.To charge you and give you the plan you paid for.
UsageHow many new leads, searches, website checks and Aby questions you have used, and what each cost us.To apply your plan's limits and keep the service affordable.
Product eventsWhich pages you open and which features you use (for example 'logged a call'), with a random id for each visit. Never the details of a business.To see what works and what to improve.
Where you came fromThe first link that brought you to us: a campaign tag, the website that linked to us, or a partner link. Sent once, after you sign up.To know which channels bring customers, and to pay partners.
FeedbackWhat you write in 'Send feedback', with the page you were on.To read it and reply.
WaitlistYour email address if you join the waitlist, and which button you pressed to join.To email you when Leadaby opens. Nothing else.
Security recordsSign-in attempts and unusual activity. IP addresses are kept only as a one-way code plus a shortened label (for example 81.2.69.x).To protect your account and the service.

Partners also give us the name for their partner card and their link code. To pay them we need bank or Wise details, which they send us directly and which we keep only for paying them.

What we hold about the businesses in leads

When a customer searches an area, Leadaby looks for local businesses and checks whether they have a working website. Here is what we keep and where it comes from.

  • Google Maps. Searches use Google Maps Platform. Google's terms only let us store a business's place ID. Names, phone numbers, addresses and ratings from Google are shown live and are not stored by us.
  • Open data. Business name, phone, address and category from the Overture Maps Foundation's open places data, which may be stored.
  • Our website check. We visit the business's own website (its home page, contact page, robots.txt and sitemap) and may use Brave Search to find it. We keep what we found, as plain facts: for example "no website found" or "page title is just 'Home'".
  • Companies House. For some UK leads, the company's registered type and status, from the public register.
  • Our customers' own work: the notes and call logs a customer writes about a business stay in that customer's workspace.

We do not collect home addresses, personal social media or anything about a business owner's private life, and we never send automated calls, texts or emails. Every call or message is made by a person at one of our customers.

Who decides what. We are the controller for the business data Leadaby finds and checks. For the notes and call logs a customer writes, and for the outreach they do, the customer is responsible for using them lawfully, and we hold them on the customer's behalf.

If your business is in Leadaby and you want it removed

Use the form at leadaby.com/remove, or email privacy@leadaby.com, with your business name and its phone number or website. We check every request by hand, usually within a day, so nobody can remove a business that is not theirs. Once approved, Leadaby searches leave your business out, matched by that phone number or website, so it is not found again. We reply within one month, usually much sooner, and delete what we hold about your business, keeping only what we need to keep it removed.

You can also object at any time to us holding your details for direct marketing. When you do, we stop: we do not weigh it against our interests.

In the UK you can also register your number with the Telephone Preference Service (TPS) or Corporate TPS (CTPS). Our customers are responsible for screening against those lists before they call.

Our lawful bases (UK GDPR)

Running your account and the service you pay forContract
Billing records and taxLegal obligation (we keep accounts for HMRC)
Finding, checking and listing local businesses for our customersLegitimate interests: helping businesses that sell websites find businesses that may want one. We keep this to business contact details and public facts, and anyone can opt out.
Product events, where you came from, security recordsLegitimate interests: improving and protecting the service
Paying partnersContract (the partner terms)
Emailing you when Leadaby opens (the waitlist)Consent: you asked us to. Ask us to take you off the list at any time.

We have weighed these interests against the rights of the people involved.

Because business data comes from public and open sources, not from the business itself, this page is how we tell those businesses what we hold. We do not write to every business individually; that would mean contacting thousands of businesses who may never be called.

Who helps us run Leadaby

These services process data for us. Each one only gets what it needs for its job.

SupabaseOur database and sign-in (including sign-in emails)Ireland (EU)
VercelHosts the website and appIreland (EU) for the app's server; pages are served from Vercel's global network
StripePayments, invoices, tax and the billing portalUSA, Ireland
Google Maps PlatformBusiness search, place details and the map card in the appUSA
Brave SearchWeb search during a website checkUSA
AnthropicThe AI model behind Aby AI and enhanced search. Aby's working transcript is deleted when each question finishes; what you type in enhanced search is not stored by Leadaby.USA
ResendEmails we send ourselves (alerts and service emails)USA
Cloudflare TurnstileThe check on the waitlist form that stops bots. It sees your browser and IP address when it loads.USA
Companies HouseCompany type and status for UK leads (a public UK government register)UK
Google Fonts, OpenFreeMapThe website's font and the app's map tiles. They see your IP address when your browser loads them.USA / EU

We never sell personal data and we do not use it to train AI models. Anthropic does not train on data sent through its commercial API.

Data sent outside the UK

Some of these services are in the USA. When personal data leaves the UK we rely on the UK–US data bridge where the service is certified, or on the UK International Data Transfer Addendum to the EU standard contractual clauses in its terms.

How long we keep things

Your account, profile and workWhile your account is open, then deleted within 30 days of closing it
Billing and tax records6 years, as UK tax law requires
Product events and where you came from24 months
Security records90 days
Aby AI's working transcriptDeleted as soon as the question is answered. Your chats stay until you delete them.
What you describe in enhanced searchNot stored: sent to the AI model only to suggest business types, each time you ask for them.
Google place IDsAs long as the lead is in a workspace (Google allows this)
Website check resultsRe-checked after 90 days; replaced by the newer result
A business that asked to be removedOnly what we need to keep it removed
Waitlist emailsUntil we have told you Leadaby is open, or sooner if you ask us to take you off the list

Your rights

Under UK data protection law you can ask us to:

  • give you a copy of your personal data;
  • correct it, or delete it;
  • limit how we use it, or object to how we use it (always, for direct marketing);
  • give you your data in a format you can move to another service.

Email privacy@leadaby.com. We reply within one month. It is free. If you are not happy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put it right first.

In the US, you have the same requests available to you, whichever state you live in. We do not sell or share personal information for targeted advertising.

Cookies and browser storage

We set two cookies, both only to keep you signed in to the app. We use no advertising or third-party tracking cookies, and no outside analytics service. Some small records live in your browser's storage instead of cookies. All of them are listed here.

le_session (cookie, app)Keeps you signed in. Strictly necessary.12 hours
lb_sb (cookie, app)Lets the app read your own workspace data as you. Strictly necessary.Up to 1 hour, renewed while you use the app
sb-…-auth-token (storage, app)Supabase's sign-in record. Strictly necessary.Until you sign out
ui-theme, sidebar-collapsed, today-sort and other settings (storage, app)Remembers choices you made, like dark mode. Never leaves your browser.Until you clear them
leadaby-sample, aby-conversation (storage, app)Sample mode and the Aby chat open in this tab.Until you close the tab
leadaby-session (storage, app)A random id that groups one visit's product events.Until you close the tab
leadaby-first-touch (storage, website and app)Where you first came from (see above). Sent once after sign-up.Until you clear it
leadaby-ref, leadaby-visitor (storage)Only after you click a partner's link: which partner sent you, and a random id, so they can be paid.60 days

Do we need a cookie banner? No. The cookies are strictly necessary. The attribution and visit records are first-party, hold no personal details, and you can switch the website's off below or ask us by email to stop them. This follows the exemption for statistics about a service that the Data (Use and Access) Act 2025 added to PECR.

Attribution records are on for this browser. This switch covers leadaby.com. For the app, email us and we will stop them for your account.

Paying happens on Stripe's own checkout page, and Stripe sets its own cookies there for fraud prevention under its own policy.

Children

Leadaby is a business tool. It is not for anyone under 18.

Changes to this policy

When we change this page we update the date at the top. If a change matters to how we use your data, we will tell customers by email first.