This Privacy Policy explains what personal data Leads.Garden processes, why we process it, on what legal basis, how long we keep it, with whom we share it, and how you can exercise your rights. It applies to visitors of leads.garden, to users who create an account or purchase a Bundle, and to individuals whose business contact information appears in our Bundles. Capitalised terms not defined here have the meaning given in our Terms of Service.
Last updated July 10, 2026
1. Who we are
Leads.Garden operates the marketplace at leads.garden. For the purposes of the EU/UK GDPR, we act as the Controller of the personal data described in this Policy. You can contact us at privacy@leads.garden, or reach our Data Protection Officer at dpo@leads.garden.
2. Personal data we collect
Depending on how you interact with us, we may collect:
Account data: name, email address, hashed password or federated identifier (e.g. Google sub), account preferences, and role or seniority you optionally provide.
Transaction data: Order history, invoice metadata, currency, payment method identifier and last-four digits (payment processors handle card details; we do not store full card numbers).
Usage data: pages viewed, features used, referrer, device and browser type, operating system, coarse language and locale, approximate country derived from IP address, and interaction events used to operate and improve the Service.
Support data: messages, attachments and screenshots you send when you contact support.
Cookie and similar technology data: as described in our Cookie Policy.
B2B contact data included in Bundles: business name, professional email address, job title, seniority, employer, LinkedIn URL, work location and public firmographic attributes. We do not process special categories of personal data (Article 9 GDPR) about Data Subjects in Bundles.
3. How we use personal data
We use personal data to:
Create and administer your account, authenticate you, and provide the Service;
Process Orders, deliver Bundles, and provide customer support and dispute resolution;
Send limited product communications, from which you may unsubscribe at any time;
Maintain the integrity and security of the Service, prevent and detect fraud and abuse, and enforce our Terms;
Comply with legal obligations, including tax, accounting and lawful requests from public authorities;
Improve the Service, including verification pipelines, search relevance and Bundle curation, using aggregated and, where feasible, de-identified data.
4. Legal bases (EU/UK/EEA)
Where GDPR or UK GDPR applies, we rely on the following legal bases:
Performance of a contract (Art. 6(1)(b)) — to provide the Service you have requested and process Orders;
Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent fraud, provide B2B contact data in Bundles for lawful business-to-business outreach, and to develop and improve our products, having balanced our interests against your rights;
Legal obligation (Art. 6(1)(c)) — to keep tax, invoicing and other statutory records;
Consent (Art. 6(1)(a)) — where required, for example for non-essential cookies or optional marketing emails; you may withdraw consent at any time.
5. Sources of Bundle data
Business contact records included in Bundles are compiled from public professional profiles (for example, company websites and public directory pages), publicly filed business registrations, our own verification pipeline, and contributor-supplied datasets that we curate and verify. We do not purchase consumer marketing lists and we do not include data obtained from breaches or leaks.
6. Disclosure of personal data
We share personal data only as necessary and always subject to appropriate contractual safeguards.
Service providers (sub-processors): managed database, authentication, transactional email, object storage, payment processing (PayPal and Razorpay), analytics and customer-support tooling. A current list is available on request to privacy@leads.garden.
Buyers of a Bundle receive the business contact data contained in that Bundle under the licence set out in our Terms of Service.
Legal, regulatory and safety disclosures where required by law or to protect the rights, property or safety of Leads.Garden, our users or others.
Corporate transactions: in connection with a merger, acquisition, financing or sale of assets, subject to standard confidentiality and continuity-of-protection commitments.
We do not sell personal information as that term is defined under the CCPA/CPRA (see our CCPA Notice) and we do not share personal data for cross-context behavioural advertising.
7. International transfers
We operate globally and may transfer personal data to countries other than your own, including the United States and India. Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on adequacy decisions where available and, otherwise, on Standard Contractual Clauses and additional safeguards required by applicable law.
8. Retention
We retain personal data for as long as necessary for the purposes described in this Policy.
Account and Order data: for the life of your account plus a period required to meet legal, tax and accounting obligations (typically up to 7 years for invoices).
Usage and log data: typically up to 12 months, longer where needed for security investigations.
Support records: up to 24 months from the last interaction.
B2B contact data in Bundles: retained until the record is removed on request, superseded by a fresh verification pass, or determined to be materially outdated.
9. Your rights
Subject to applicable law, you may have the right to:
Access the personal data we hold about you;
Request correction of inaccurate or incomplete data;
Request erasure of your data ('right to be forgotten');
Restrict or object to certain processing, including a right to opt out of processing based on legitimate interests;
Request portability of data you provided under a contract or with consent;
Withdraw consent where processing is based on consent;
Lodge a complaint with your local data protection authority.
10. Exercising your rights and Bundle opt-out
To exercise any right, email privacy@leads.garden from the email address associated with the request. We will verify identity through the requesting email address and any other reasonable means, and will respond within 30 days (or 45 days for CCPA requests), extendable where permitted by law. Individuals whose business contact information appears in a Bundle may request suppression or deletion at any time by emailing privacy@leads.garden; suppression is applied within one business day and propagated to all future exports.
11. Security
We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Controls include TLS 1.2+ in transit, encryption at rest for managed data stores, short-lived signed URLs for downloads, row-level security scoping database access to the authenticated user, principle-of-least-privilege for administrative access, and audit logging. No security measure is perfect; you are responsible for protecting your account credentials.
12. Children
The Service is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe we have collected data from a child, contact privacy@leads.garden and we will promptly delete it.
13. Automated decision-making
We do not make decisions with legal or similarly significant effects about you based solely on automated processing, including profiling.
14. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will provide reasonable prior notice through the Service or by email. The 'last updated' date at the top of this page reflects the most recent revision.
15. Contact
Questions, requests or complaints regarding this Policy should be directed to privacy@leads.garden. Our Data Protection Officer can be reached at dpo@leads.garden.
