Privacy Notice
Last updated: 5 November 2026. Effective from publication.
1. Who we are
Leadistry is operated by Leadistry Ltd, a company registered in England and Wales (company number 17340225), whose registered office is 195 Wood Street, London, E17 3NU, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC200538. We act as the controller for the personal data described in this notice.
For privacy-related queries, contact support@leadistry.co.uk.
2. What data we hold
We hold company-attached records on UK incorporated entities:
- Company name, registered number, registered office address, SIC codes, incorporation date, status, and other fields from the Companies House register.
- Details of company officers (directors, members) as recorded in the Companies House register: name, role, appointment date, nationality, and stated occupation.
- Where available from the company's own publicly accessible business website: the website URL, a business email address, a business phone number, and the company's social profiles.
- Where available from the company's own website, from public search engines or, for some older records, from public professional profiles (for example a LinkedIn profile): a director's public LinkedIn profile URL (the link alone, never the contents of the profile), and, where a company publishes a named business contact, that person's name and business email address.
We do not collect or hold special-category data. We do not profile or score individuals; any scoring we apply (for example, our internal “website match” confidence score) describes the quality of a company-to-website match, not the individual.
3. Where the data comes from
We build each record from publicly accessible sources:
- The open Companies House register, made available by Companies House under the Open Government Licence (company details and officer information).
- The company's own publicly accessible business website (we read only pages anyone can open without signing in).
- Public search engines. We use these to locate a company's website and its social profiles, to identify the correct named business contact, and to record the link to a director's public LinkedIn profile where a search returns one. We keep the link alone. To build these records we do not read LinkedIn or any other social network, and we never sign in to one. Some older links were recorded from public profile pages before we stopped.
- Lists the government publishes, for the dated reason on a lead only: Companies House's daily file of filed accounts, the Home Office's register of licensed sponsors, HMRC's list of importers, the Food Standards Agency's food hygiene ratings, the Care Quality Commission's directory of registered care services and their ratings, Contracts Finder, Find a Tender, the ICO's register of data protection fee payers and UKRI's list of Innovate UK projects, under the Open Government Licence or the publisher's own terms. We keep the company and the day from them, never a person's details.
- Companies House's record of filings, as they are made, for the dated reason on a lead only: statements of capital, notifications of people with significant control, auditors' resignations, and strike-off and Gazette notices. From a filing we keep the company, the kind of filing and the day, never a person's details, even when the filing names one.
We do not purchase marketing contact lists, and we do not buy personal data from third-party data brokers. Our enrichment uses only sources that are already publicly accessible.
For a limited company, LLP or PLC we also keep the switchboard or main-line telephone number the company publishes on its own website, with the page it was seen on and the day. We show a mobile number only where the company publishes it as its own business contact, and never the direct line of a named person. Before a number is shown to a customer, and again at least every 28 days, we check it against the TPS and Corporate TPS registers through Provero, our screening supplier. Only the number is sent, never the company or the customer. A number on either register is never shown. If you would rather not appear, you can object or ask us to remove a record at any time (see “Your rights” below).
4. The browser extension
The optional Leadistry browser extension is a companion to your account. It matches UK company websites you choose to visit against the Companies House register and your Leadistry account, and lets you save a matched company to that account in one click. That is its single purpose.
While you browse, the extension looks for UK company signals in the visible text of the page you are on (a Companies House number, a UK postcode, a VAT number, or a “Registered in” mention). This detection happens inside your browser. If no UK signal is found, nothing about the page leaves your browser: non-UK browsing is never sent to us.
There are sites the extension keeps away from. They are social networks, including LinkedIn, Facebook, Messenger, Instagram, Threads, X, TikTok, YouTube, WhatsApp, Snapchat, Pinterest and Reddit; search engines, including Google and its services, Bing, DuckDuckGo, Yahoo, Brave Search, Ecosia, Startpage, Yandex and Baidu; webmail, including Gmail, Outlook and Office on the web, Proton, iCloud and any address that starts with “webmail.” or “mail.”; and private workspaces, including Slack, Microsoft Teams and Notion. From version 1.2.9 the extension reads nothing on those sites and sends us nothing from them. Chrome updates the extension by itself. Until your copy is updated, our servers refuse anything an older version sends from one of those sites and keep none of it. On leadistry.co.uk the extension only completes the sign-in that connects it to your account.
When a UK signal is found, the extension sends us four things about the page and no more: the site's host name, a postcode when the page shows one, a company number when the page labels it as one, and the name the page declares for itself. They go to leadistry.co.uk over HTTPS, solely to check the company against the public record and tell you whether it is already in your account. It does not send the page's title, its text or its full address. This is so from version 1.2.9. Older versions also sent the page's title and a VAT number, which our servers discard, and could send any eight-digit number on the page as the company number.
- Saving is always an explicit click. If you click “Save to Leadistry”, we record the company's Companies House number and the source URL against your account and queue a server-side enrichment job (website, business email, phone, director LinkedIn) using the same pipeline as platform searches. Enrichment runs from our servers, never from your browser session.
- Authentication. The extension stores a scoped, revocable session token locally (the Chrome storage permission) so you do not have to sign in repeatedly. Your full website session is never stored in the extension, and you can sign out from the popup at any time.
- Manual scan. The optional “Scan this site” button checks the current page only when you click it. It sends the same four things and the page's address (and, before version 1.2.9, its title), so that we can look the site up. If the page is not a UK company, you can still save it to your own account as a basic capture.
- What it never does. It does not read passwords or payment fields, does not read LinkedIn or the other social networks, search engines, webmail and private workspaces named above, does not sell or share browsing data with anyone, and does not collect anything beyond the detection and explicit actions described here. Saving a company has no limit. Scanning a site that is not on Companies House has a daily allowance.
You can remove the extension at any time from your browser's extensions page. Removing it does not delete companies you already saved to your Leadistry account; you can see or remove those on the “From your browser” page inside your account, or by contacting us at support@leadistry.co.uk.
5. Connecting your own mailbox
Leadistry can send your outreach from your own mailbox, so replies arrive in your real inbox and your emails look like they came from you, because they did. Connecting a mailbox is optional, and you can disconnect it at any time. There are two ways to connect it.
With Google (Gmail and Google Workspace) and Microsoft (Outlook and Microsoft 365), you sign in on their own screen. We never see, receive or store your email password. What we receive is an access token, which we hold encrypted at rest and use only for the purposes below.
With any other email host, for example IONOS, GoDaddy, 123 Reg, Hostinger, Zoho or Fasthosts, and with Gmail if you would rather use an app password, you give us the mailbox's address and its password. We check them with your host once, then hold that password encrypted at rest, with the same protection as the access tokens above, and use it only to send the emails you have approved and to read the replies to them, in the ways set out below. Where your host offers an app password, we ask for that instead, because you can withdraw it on its own without changing the password you use yourself.
What we access, and why. With your permission we use the following, and nothing else:
- Your email address, to confirm which mailbox you connected and show it in your account.
- Permission to send mail as you, used only to send the outreach messages you have set up and switched on. We never send anything you have not configured.
- Read access to your messages, used only on the threads we sent for you, and for three things. First, to spot a reply, so we can stop emailing that person. Second, to spot a bounce notice, so we can suppress an address that does not exist. Third, when the reply is to a message you sent from your Feed, to fetch that reply itself: we store its sender, subject and the first 8,000 characters of its text, show it to you on your Desk, and use it to draft your answer when you ask us to. Drafting your answer sends that text to Anthropic, as described in section 8. For every other message we sent, we read only the headers we need (sender, subject, and the flags that mark an automatic reply or a delivery failure). We match every read against the threads we sent on your behalf. We do not read, index, store or display any message that is not a reply to one of them, and we never touch the rest of your mailbox.
What we never do. We do not sell mailbox data. We do not use it for advertising or to build profiles. We do not use it to train generalised artificial intelligence or machine learning models. We do not let humans read your mail, except in the narrow cases the Limited Use policy allows: with your explicit consent, where it is necessary for security purposes such as investigating abuse, or where we are required to by law.
Leadistry's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting. You can disconnect a mailbox at any time from your Leadistry account, which deletes the stored tokens or password and stops all access immediately. You can also revoke our access directly from your Google account's security settings or your Microsoft account, and we will keep no usable access after you do.
6. What we use it for
We make these records available to our customers, who are UK businesses, for the sole purpose of identifying and contacting other UK corporate businesses for legitimate B2B marketing (for example: a UK accountant identifying other UK businesses that might wish to engage their services).
When a customer emails you through Leadistry, the message carries no open-tracking pixel: we do not record whether you opened it, or when. The links in a first email go straight to where they point. In a follow-up email the links go through our click counter, so if you click one we record which link it was and when, for the customer who sent it, and that email says so at the bottom.
The unsubscribe link and the link to remove your details are never counted. The counter stores nothing on your device and keeps no IP address. We also record whether you replied, whether the address bounced, and whether you used the unsubscribe link, which is what stops anything further reaching you. If you would rather not be contacted through the platform at all, you can ask us to remove your company's record at /remove-company (see “Your rights” below).
We also use a limited set of business contact details (a company name, its business email address, and SIC sector) to contact relevant UK businesses about Leadistry itself, our own B2B service. We only do this for incorporated entities at their business email address, never consumer webmail or individual subscribers, and every message identifies us and carries a one-click unsubscribe.
You can opt out at any time (see “Your rights” below, or the unsubscribe link in any message); we then add you to a permanent suppression list and will not contact you again.
If you hold a Leadistry account, we may send you product updates and prospecting tips by email. When you sign up with an email and password we offer an optional checkbox for this; where you sign up another way (for example with Google) we rely on the PECR “soft opt-in”, because you are an existing customer and the messages are about our own similar B2B service.
Either way you can switch these marketing emails off at any time in Settings → Email preferences, and every marketing email includes a one-click unsubscribe (RFC 8058) that takes effect immediately. Service emails about your account (receipts, security notices, search results) are not marketing and are sent regardless of this preference.
Emails we send to account holders, whether service or marketing, carry no open-tracking pixel. The links in them may go through a click counter, ours or our email provider's, so we can see which links are used and whether a message arrived. We use this only to measure and improve our own emails, never to profile you.
How we count visits to our website. When you arrive at our website, our own visit counter records the date and time, the site you came from (for example Google or ChatGPT), the page you landed on, and any campaign tags in the link you followed (such as utm_source). It also records each page of our public website that you open during the same visit, and the order you open them in.
If you then open the sign-up page or press a sign-up button, it records that too, and if you create an account in the same visit, the record is linked to your account. If you use the box that shows example companies, it records that the box was shown, that a choice was made in it and whether you closed it, but not what you chose. If you go on to create an account, the choice goes into your set-up and is kept on your account.
To tie these steps together, the page makes a random number when it opens and sends it with each step; your browser forgets it when you close the page.
The visit counter sets no cookie, stores nothing on your device, and does not keep your IP address or any details of your browser or device. Visits from search engine robots are left out. We rely on our legitimate interests for this: knowing which pages, and which sites, bring people to us and lead them to sign up. We keep these records for 400 days.
If you accept analytics cookies, and only then, we also keep a record on your own device of where you first came from: a cookie called ld_attr, kept for 90 days from your last visit, and the same record in your browser's local storage, called ld_first_touch_v2. It holds the page you first landed on, the site you came from and any campaign tags in the link. If you create an account, we save it to your account as where you came from. Until you accept, neither is set, and if you reject analytics cookies both are removed. If you create an account without accepting, your account can still record where that visit came from. That comes from the link you followed and the page you arrived on in the same visit, not from anything stored on your device.
If you arrive through a partner's or a friend's referral link, the referral code in that link is kept in your browser for 60 days (in local storage and in a first-party cookie called ld_ref) so that, if you create an account in that time, the referral can be credited to the person who sent you. It holds nothing about you, is not read by anyone else, and is cleared once an account is made or when the 60 days pass.
We do not use the data for credit decisions, fraud assessment, employment screening, insurance pricing, or any automated decision-making that produces legal or similarly significant effects on individuals.
7. Lawful basis
Our lawful basis for processing under UK GDPR Article 6(1)(f) is legitimate interests. The legitimate interest is enabling UK businesses to identify and contact other UK businesses for B2B marketing, which we believe is a recognised commercial interest. We have conducted a written Legitimate Interests Assessment (LIA) recording the purpose, necessity, and balancing tests.
We rely on the same basis, Article 6(1)(f) legitimate interests, for our own direct marketing of Leadistry to UK businesses, together with the business-to-business exemption in PECR Regulation 22(3) for marketing email to corporate subscribers. A separate Legitimate Interests Assessment records that purpose, necessity, and balancing test. We send only to business email addresses of incorporated entities, never to individual subscribers, and we honour opt-outs immediately and permanently.
Where personal data is delivered to a customer (for example, a director’s email address), we additionally apply the following safeguards on top of Article 6(1)(f):
- Named personal email addresses are only ever delivered for incorporated entities (private limited, public limited, LLP, and similar). They are never delivered for sole traders or general partnerships.
- Named personal email addresses on freemail domains (gmail, outlook, proton, UK ISP webmail, and similar) are never delivered, regardless of the company type, because such addresses are individual subscriber addresses under PECR.
- Email addresses are MX-validated before being classified for delivery. Addresses on domains that do not accept email are not delivered.
- The public objection mechanism at /remove-company applies globally across every customer's subsequent searches.
Telling you that we hold your details (Article 14). When we find a named person's business email address on their company's website, we email that person to say what we hold, where it came from, why we hold it, who may be given it, how long we keep it, and how to have it removed. We send it within one month of finding the address, and at the latest when it first reaches a customer, and never twice to the same address.
Addresses we already held on 1 November 2026 are being told in turn during November 2026. Before each email we check that the mailbox still exists; if it does not, nothing is sent, because nobody is there to tell. If a customer has already written to the person, their email carried the same notice in its footer, so ours is not sent. The notice comes from hello@leadistry.co.uk, an address of ours, and replies go tosupport@leadistry.co.uk, where we read them. Asking there to be removed works as well as the removal page.
Company officers' names and companies' general addresses (such as info@) come from the public register and from the companies' own websites. We do not write to each of those individually: it would mean writing to every company in the UK about details they published themselves. For those we rely on Article 14(5)(b) (disproportionate effort), supported by this notice and the removal routes at /remove-company and /data-removal. We are happy to discuss this with the ICO on request.
9. How long we keep it
Company-level records are retained for as long as the company remains active on the Companies House register or until you successfully exercise an objection right via the suppression mechanism described below. Suppression entries are kept indefinitely so that objections are honoured across all future data refreshes. A telephone number is kept while we hold the company's record and the number is still on its website. While we do not screen numbers, no register result is kept.
Account-level data we hold about you as a customer (sign-up email, billing records) is retained for the duration of your account plus a maximum of 7 years after account closure to meet UK statutory record-keeping requirements.
Your conversations with our AI assistants, the setup chat when you sign up included (what you type, their replies, and what they proposed or changed on your account), are kept for 90 days and then deleted automatically. We keep them so that a conversation carries across pages and devices, so that we can help if something goes wrong, and so that our team can see where the assistant answered badly and make it better. They are deleted sooner if you close your account or ask us to delete your data.
10. Your rights
Under UK GDPR you have the right to access the personal data we hold about you, to ask us to correct inaccurate data, to ask us to erase data in certain circumstances, to object to processing for direct marketing under Article 21, to restrict our processing, and to data portability where the data was provided by you directly. These are described in more detail at leadistry.co.uk/gdpr.
11. How to exercise your rights
The fastest route for whole-company removal is the public form at leadistry.co.uk/remove-company: no account is needed and suppression is applied automatically within seconds. For director-level removal and other requests (access, correction, objection to processing, erasure), use the form at leadistry.co.uk/data-removal; those requests are reviewed manually. We aim to acknowledge them within 72 hours and to action them within 30 days where applicable. To stop a company's telephone number being shown to our customers, use Remove my number at leadistry.co.uk/opt-out. We act on it straight away, and at the latest within one month, for every customer.
To have a phone number taken off, use Remove my number. Give us the number. We act on it straight away, and at most within one month.
To have a phone number taken off, use Remove my number. Give us the number. We act on it straight away, and at most within one month.
Alternatively, email support@leadistry.co.uk. We may need to verify your identity before responding to requests concerning personal data.
12. Complaints
If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner's Office. You can do so at ico.org.uk/make-a-complaint or by calling the ICO helpline on 0303 123 1113. We would, however, appreciate the opportunity to address your concerns directly first.
13. Changes to this notice
We may update this notice from time to time. Material changes will be communicated on this page with the “Last updated” date above. Previous versions are available on request.