Privacy Policy

Leadlogr is operated by [TO FILL IN — registered company name], registered in Netherlands under [TO FILL IN — KvK number], at [TO FILL IN — registered address].

There are two different relationships, and they matter for your rights:

• For our customers' account data — the people who sign in to Leadlogr — we are the controller. We decide what we hold and why.
• For lead data — the people who filled in a form on our customer's website — we are a processor. Our customer decides what is collected and why; we hold it on their instructions. If you submitted a form and want your data removed, contact the business whose site you used, or write to us and we will route it.

When someone submits a form on a customer's website, our tracking script sends us the fields that form contained. Typically that is:

• Name, email address, telephone number and company name, where the form asks for them
• The message or enquiry text, and any other fields the form contains, stored as submitted
• The page the form was on, the landing page, the referring page, and the browser's user-agent string
• Advertising identifiers that arrived with the visit — Google, Meta, Microsoft and LinkedIn click identifiers, campaign parameters, and analytics cookie identifiers
• The consent state detected on the page at the moment of submission

We do not store IP addresses. No field in our database holds one, and our collection endpoint does not record one.

Because forms differ, anything a form contains that we do not recognise is kept verbatim alongside the recognised fields. Our customers control what their forms ask for, so they control what reaches us.

For people with a Leadlogr account: name, email address, the workspace they belong to and their role in it, and a record of invitations sent and accepted. Passwords are stored only as a hash by our authentication provider and are never visible to us.

A form submission is recorded in full. Someone who fills in a contact form is giving that business their details in order to be contacted, and the record we keep is that enquiry — the same information the business would hold if the form had arrived as an email. Recording it does not depend on a cookie banner, and the absence of one does not reduce what the business receives.

Passing those details to an advertising platform is a different matter, and consent governs it. Our tracking script detects the consent management platform on the page and records what it found at the moment of submission. Where nothing can be found, we treat that as permission not given.

Personal identifiers are only sent to an advertising platform when consent was given. When it was not, the conversion is still reported, but the email address and telephone number are not included in anything we send onward.

Where personal identifiers are sent, they are hashed before transmission, and a lead is only reported to the advertising network the visit originated from. A visitor who did not arrive from a Google advertisement is not reported to Google.

• To provide the service — recording leads, showing them to our customer, and reporting outcomes back to advertising platforms, on our customer's instructions and under their lawful basis.
• To run accounts — signing people in, sending invitations, and keeping workspaces separate. This is necessary to perform our contract with the customer.
• To keep the service working and secure — diagnosing errors and preventing misuse, which is our legitimate interest in operating a reliable service.

We use the following providers. Each has access only to what their function requires, and each is bound by a data processing agreement.

Our database and application are hosted in the European Union. Google and Meta receive conversion data in the United States, and only where a workspace has connected them. We do not sell personal data, and we do not use lead data to train anything.

Lead data is kept for as long as the customer's workspace exists, because it is their record of their own enquiries. When a workspace is deleted, its leads, activity history and settings are deleted with it.

Customers can delete individual leads at any time, and deletion is immediate rather than marked. Account records are removed when the account is closed.

Under the GDPR you can ask for access to your data, correction, erasure, restriction, a portable copy, or object to processing. You can also complain to a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

If your data reached us through a form on someone else's website, that business decides what happens to it. Write to us at hello@leadlogr.com and we will pass the request on and tell you who it went to.

When this policy changes materially we will tell account holders by email before the change takes effect. The date at the top shows when the wording last changed.

[TO FILL IN — registered company name], [TO FILL IN — registered address], Netherlands. For anything in this policy, including a request about your own data, write to hello@leadlogr.com.