This Privacy Policy explains how [Company legal name] (“LeadForge”, “we”, “us”) handles personal data. It covers visitors to this website, people who contact us, our customers and their users, people whose professional details are in LeadForge’s own lead database, and people who receive emails sent by our customers through LeadForge.
1. Who we are
LeadForge is operated by [Company legal name], [Registered address], registration number [Company registration number].
- Privacy contact: [Privacy contact email]
- Data Protection Officer: [DPO name and contact, if appointed]
- EU representative (Article 27 GDPR): [EU representative, if required]
- UK representative: [UK representative, if required]
2. Our two roles
As a controller, we decide how and why personal data is used for this website, enquiries, customer accounts and billing, security, and LeadForge’s own lead database.
As a processor, we handle personal data on our customers’ behalf when they use LeadForge to find leads with their own data-provider keys, upload leads, write and send emails, and manage replies. Each customer is the controller of that data and decides whom to contact. This policy describes our practices, but the customer’s own privacy notice governs how it uses your data.
Received an email from one of our customers?
The sender, our customer, is responsible for that email. Use the unsubscribe link in the email to stop that sender’s emails through LeadForge. For other requests about how the sender uses your data, contact the sender directly. If you contact us instead, we will pass your request on to the customer where we can identify them, and help them respond.
3. The personal data we collect
3.1 Website visitors
This website uses no advertising or social media pixels, and no third-party scripts or fonts other than the two analytics services below, where they are enabled (both are on leadforge.dewelope.com; without them, no analytics script is loaded). The unsubscribe, privacy request confirmation and “page not found” pages never load either of them. Our Cookie Policy lists the cookies and storage involved.
- Cloudflare Web Analytics, loaded from static.cloudflareinsights.com, sets no cookies, does not use local storage, and collects aggregated, non-identifying data (pages viewed, referring page, country, device and browser type, page performance) so we can understand how the site is used; Cloudflare acts as our processor. [Product and counsel: confirm the legal basis for this analytics and Cloudflare’s processor terms.]
- Google Analytics 4 loads, and sets cookies, only if you select “Accept analytics” in the cookie banner. Before you choose, or if you reject, no Google script is loaded and nothing is sent to Google. If you accept, it collects, under a random identifier stored in its cookies, the pages you view, how you interact with them, the referring page, approximate location (Google Analytics 4 does not log or store IP addresses), and device and browser details. Advertising features and Google signals are off. Google acts as our processor. You can change your choice at any time with “Cookie settings” at the bottom of this website’s pages. [Product and counsel: confirm Google’s data processing terms, transfer safeguards and retention setting.]
Our hosting provider processes technical data, such as IP address, browser type and the pages requested, in server logs to deliver the site and keep it secure. These logs are kept for [Log retention period].
3.2 People who contact us
When you use our contact form, we collect your name, email address, company (if you give it), topic and message.
3.3 Customers and their users
Account details (such as name, work email address, organisation and role), sign-in and security data, billing details, settings, product usage and support correspondence. Customer-Provided Keys for AI and data providers are stored encrypted and used only to provide the Service.
3.4 People in LeadForge’s lead database
[Counsel and product: this section describes the planned LeadForge lead database. Confirm its scope, sources and lawful basis before launch.]
- What we hold: professional contact and company information, such as name, job title, employer, business email address, work location and professional profile details.
- Where it comes from: [List of sources, for example public professional sources and licensed data providers]. We record where and when each record was obtained.
- Why: to make business contact data available to our customers for relevant business-to-business outreach.
- Lawful basis: legitimate interests (Article 6(1)(f) GDPR), supported by a documented legitimate interests assessment. [Counsel: confirm, including the ePrivacy position for customers’ onward use.]
- Your choices: you can opt out, object or make any other request at any time on our privacy request page. When you opt out, we keep a minimal suppression record so your details are not added again.
- How you are told: [Counsel: confirm how people in the database receive the information required by Article 14 GDPR.]
3.5 Recipients of our customers’ emails
As a processor, we handle recipients’ email addresses and names, other lead details the customer provides, the content of emails sent and replies received, delivery events such as bounces, and unsubscribe status. We do this only on our customers’ instructions, under our Data Processing Addendum.
4. How we use personal data as a controller
| Purpose | Personal data | Lawful basis (GDPR) |
|---|---|---|
| Deliver and secure this website | Server logs | Legitimate interests in running a secure website |
| Understand how this website is used (Google Analytics) | Analytics cookies and usage data | Consent, which you can withdraw at any time with “Cookie settings” |
| Reply to enquiries | Contact form data | Legitimate interests; steps before entering a contract |
| Provide the Service and manage accounts | Account data | Contract |
| Billing and accounting | Billing data | Contract; legal obligation |
| Security, abuse prevention and enforcing our Acceptable Use Policy | Account and usage data | Legitimate interests; legal obligation |
| Operate LeadForge’s lead database | Lead database records | Legitimate interests [confirm] |
| Honour opt-outs | Suppression records | Legal obligation; legitimate interests |
| Tell customers about product changes | Account contact details | Legitimate interests, or consent where the law requires it |
5. AI processing
- With the LeadForge AI add-on, the content needed to write emails or classify replies, such as lead facts, Approved Claims, drafts and replies, is sent to the AI subprocessors listed on our Subprocessors page. [Counsel: describe the provider’s retention and model-training commitments.]
- With a customer’s own AI key for Anthropic, OpenAI or Google Gemini, that content is sent to the customer’s chosen provider under the customer’s own agreement with it.
- We do not use AI to make decisions about you that have legal or similarly significant effects.
- [Placeholder: whether LeadForge uses any personal data to train or improve its own models. Pending owner decision and counsel review.]
6. Who we share personal data with
We share personal data only with:
- our subprocessors and service providers, listed on our Subprocessors page;
- our customers, for data we process on their behalf and, [if applicable, lead database records made available to them];
- professional advisers, such as lawyers and auditors;
- authorities, where the law requires it; and
- a successor organisation in a merger, acquisition or sale of assets, subject to this policy.
We do not sell personal data for money. [Counsel: assess whether making lead database records available to customers is a “sale” or “sharing” under the CCPA/CPRA or similar US state laws. If so, add the required notices and a “Do Not Sell or Share” link.]
7. International transfers
Our systems are hosted in [Hosting region]. Where personal data is transferred outside the UK, EEA or Switzerland to a country without an adequacy decision, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. [Counsel: confirm.]
8. How long we keep personal data
| Data | Retention |
|---|---|
| Contact form enquiries | [Retention period] |
| Customer account data | For the life of the account, then [Retention period] |
| Customer Data we process for customers | As instructed by the customer, and deleted within [Deletion period] after the account ends |
| Lead database records | [Retention period], with regular review for accuracy |
| Suppression records | For as long as needed to honour the opt-out, keeping only the minimum needed, such as a one-way hash of the email address [confirm] |
| Server logs | [Log retention period] |
| Google Analytics data | [GA4 data retention period: 2 or 14 months] |
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, to object to its processing (including an absolute right to object to direct marketing), and to withdraw consent where we rely on it. US state privacy laws such as the CCPA/CPRA may give you rights to know, delete and correct your data, to opt out of its sale or sharing, and not to be discriminated against for using these rights.
To exercise your rights, use our privacy request page or email [Privacy contact email]. We respond within the time the law requires (under the GDPR, normally one month). We may need to confirm your identity before acting on an access, correction or deletion request. You do not need to prove your identity to opt out. Where the law allows, you can use an authorised agent.
You can also complain to a data protection authority, such as [Lead supervisory authority] or the UK Information Commissioner’s Office. We would appreciate the chance to address your concern first.
10. Security
We protect personal data with measures including encryption in transit, encrypted storage of Customer-Provided Keys and mailbox credentials, access controls and logging. [Engineering: complete and link to the security overview when available.]
11. Children
LeadForge is a business service and is not directed at children. We do not knowingly collect personal data about children.
12. Changes to this policy
We will post any changes on this page and update the “Last updated” date. For material changes we will also notify customers [by email or in the Service].
13. Contact
[Company legal name], [Registered address]. Email: [Privacy contact email].