Leadity security and data handling. How accounts, payments and lead data are handled.
Leadity keeps your account details, credit balance and purchase history, and hosts them in the United States on Railway. Payments run through Whop, so Leadity never stores card numbers, and passwords are hashed with Argon2id. The leads Leadity delivers come from public business listings. The Privacy Policy and the Data Processing Addendum give the full terms.
On this page
- What data does Leadity collect about you?
- What does Leadity scrape, and is it personal data?
- Where is Leadity data hosted?
- How does Leadity handle payments?
- How is your Leadity account protected?
- Who at Leadity can see your account?
- Which providers does Leadity use?
- How long does Leadity keep data, and can you delete it?
- What privacy rights do you have?
- Does Leadity offer a Data Processing Addendum?
- How should you use lead data responsibly?
- How do you report a security issue?
What data does Leadity collect about you?
Leadity collects your account details, credit balance, purchase history and usage, plus device signals used to catch duplicate and fraudulent accounts. Card numbers and your password are never stored: Leadity keeps a hash of the password, and Whop takes the payment.
| Data | What Leadity keeps |
|---|---|
| Account | Username, email address and a hash of your password. |
| Billing | Credit balance, purchase history and lifetime spend. No card numbers. |
| Usage | Leads delivered to you, scrape and validation jobs, areas you have covered, referral activity and support conversations. |
| Device and security signals | IP address, browser user-agent, browser time zone and language, a device cookie and a browser fingerprint made at sign-up. Leadity uses them to detect duplicate and fraudulent accounts. |
| Approximate location | A country or region from your IP address at sign-up, and the approximate location of each signed-in session, shown in Settings so you can spot a session you do not recognise. No GPS and no precise location. |
| Your agreement to the terms | Which version you accepted, when, and from which IP address and browser. |
| Browser extension | A sign-in token in your browser, the browser and operating system it runs on, and the business listings on the Google Maps page it opens, which are sent to your account as your lead lists. |
Leadity does not sell your customer account data and does not share it for advertising. Part A of the Privacy Policy has the full list.
The legal documents control: if this page differs from the Terms of Service, the Privacy Policy or the Data Processing Addendum, those documents apply.
What does Leadity scrape, and is it personal data?
Leadity scrapes business listings from public sources, mainly Google Maps, and treats a record as personal data when it identifies a person, such as a sole proprietor or a named owner.
The sources are Google Maps, Google Search, business directories and similar public listings in the United States, Canada, the United Kingdom and Australia. A record can hold the business name, a contact name, a business phone number, a business email address, a postal address, a website, and public ratings and review counts.
Owner names are delivered only when independent sources agree, and a name Leadity cannot confirm is never delivered or billed.
Leadity does not sell consumer personal information and is not a consumer reporting agency, so the data may not be used for credit, employment, insurance or housing decisions. When you export leads you receive your own copy and become an independent controller of it: the copy is yours, and so are the privacy duties for it, under the Terms of Service.
Where is Leadity data hosted?
Leadity and its databases are hosted in the United States on Railway.
Information about businesses and people in Canada, the United Kingdom and Australia is transferred to and processed in the United States.
Files you upload, such as support attachments, are stored with Cloudflare R2. Support images sit in a private bucket, open only through signed links, and are deleted after 30 days.
How does Leadity handle payments?
Payments are handled by Whop, a payment provider, on a hosted checkout page, and Leadity does not store card numbers.
The checkout opens from your signed-in account, is tied to that account and is charged in US dollars. Credits from a purchase are added only after Whop sends Leadity a payment confirmation that passes a signature check, and a repeated confirmation never adds credits twice.
A refund or dispute through Whop removes the matching credits. Your billing history shows only how you paid, such as a card brand and its last four digits.
Credits, expiry and refunds are set out in section 5 of the Terms of Service, and current rates are on the pricing page.
How is your Leadity account protected?
Leadity hashes passwords with Argon2id, keeps you signed in with a random token in an httpOnly cookie, and blocks sign-in until your email is verified.
| Control | How it works |
|---|---|
| Passwords | At least 8 characters with a letter, a number and a symbol. Only an Argon2id hash is stored, never the password. |
| Email verification | Verification and password-reset links work once and expire after 24 hours. An account that never verifies is removed after 24 hours. |
| Sessions | A random token in an httpOnly, SameSite Lax cookie, marked Secure on HTTPS. Leadity stores only a hash of the token, and a session ends after 30 days without use. |
| Signing out everywhere | A password reset signs you out everywhere. Changing your password signs out every other device. Deleting your account or changing your sign-in email ends every session. Settings show where your account is signed in, so you can end a session you do not recognise. |
| Rate limits | Sign-up, sign-in, password-reset, password-change and email-change requests are rate limited. A password-reset request gets the same answer whether or not an account exists. |
| Changing your email | Needs your session and your password. The new address gets a link to confirm and the old address gets a link to cancel, and the request expires after one hour. |
| Deleting your account | Needs your password and ends every session at once. |
| Connection | The app at app.leadity.io is served over HTTPS. |
Email from Leadity is protected with SPF, DKIM and DMARC.
Who at Leadity can see your account?
Access to production data is restricted and audited, and administrative access to a customer account is logged.
When support needs to see what you see, staff open your account through a link that works once and expires after five minutes. The link starts a session that ends after 15 minutes, and the session is recorded with the staff member's email address.
Which providers does Leadity use?
Leadity names its service providers, the outside companies that handle data for it, in Section 5 of the Privacy Policy. The Data Processing Addendum treats that list as the sub-processor list.
| Provider | What it does |
|---|---|
| Railway | Hosts the service and its databases, in the United States. |
| Whop | Processes payments and provides an analytics pixel. |
| Provides the analytics and advertising tags on the marketing site. | |
| Resend | Delivers transactional email. |
| Cloudflare R2 | Stores files you upload, such as support attachments. |
| Wistia | Serves video shown inside the app. |
| Evomi | Provides the proxy network used to collect public listings. |
| Serper, BrightData, BulkVS, BounceBan and OpenRouter | Help find, classify and verify business records. They receive lead data, not your account data. |
| Discord and Telegram | Receive internal operational notifications, which can name a customer account. |
Leadity binds each sub-processor to data protection duties no less protective than those in the Data Processing Addendum. A material change to the list comes as a new Privacy Policy version that you are asked to accept. To object to a new sub-processor, email support@leadity.io.
How long does Leadity keep data, and can you delete it?
You can delete your account at any time from Settings, and Leadity keeps the related records for at least 12 months afterward, and longer where the law or security requires. Leadity does not guarantee that every record is deleted at a fixed point in time.
| Data | How long |
|---|---|
| Account and billing records | While the account is open, then at least 12 months after deletion, and longer where the law or security requires. |
| Agreement records, security and audit logs | Kept to evidence your agreement and to protect the service. |
| Lead records | While they remain part of the product, subject to deletion and opt-out requests. |
| Support images | 30 days. |
| Accounts that never verify | Removed after 24 hours. |
| Device and support cookies | Up to 400 days. |
Deleting an account is permanent and forfeits unused credits, as section 12 of the Terms of Service says. Before you close it, export the results of any validation run and download any file you uploaded.
What privacy rights do you have?
Depending on where you live, you can ask Leadity to show, correct or delete your personal information, or to remove it from the product, by emailing support@leadity.io with the subject Privacy request.
| Right | What you can ask |
|---|---|
| Know or access | The categories and specific pieces of personal information Leadity holds about you. |
| Delete | Delete your personal information, subject to legal exceptions. |
| Correct | Correct inaccurate personal information. |
| Object to direct marketing | Stop the use of your information for direct marketing, including having it removed from the product. |
| Non-discrimination | No penalty for exercising any of these rights. |
The Privacy Policy names the CCPA and CPRA in California, PIPEDA in Canada, the UK GDPR in the United Kingdom and the Privacy Act 1988 in Australia. Leadity answers within the time the law requires: one month under the UK GDPR.
Under US state laws the usual deadline is 45 days, extendable where permitted. The rights cover customers and the people and businesses whose details appear in the lead data. An authorized agent can submit a request with proof of authorization. As independent controllers of the leads they export, customers must honor requests they receive directly.
Does Leadity offer a Data Processing Addendum?
Leadity publishes a Data Processing Addendum, version 2026-09-16, that forms part of the Terms of Service and applies where Leadity processes personal data on your behalf.
| Topic | What the addendum says |
|---|---|
| Roles | Leadity controls your account data and its own business records. For the phone and email lists you submit to Validations, and for files and messages you send, Leadity is a processor acting on your instructions. |
| Sub-processors | Listed in Section 5 of the Privacy Policy. |
| Security | Argon2id password hashing, httpOnly cookies, restricted and audited production access, logged administrative access, and SPF, DKIM and DMARC on outbound mail. |
| Breach notice | Leadity notifies you without undue delay and gives the details in stages as they become available. |
| Transfers | Data is hosted in the United States. For customers in the EEA, the UK or Switzerland, the Standard Contractual Clauses and the UK International Data Transfer Addendum are incorporated. A signed counterpart is available on request. |
| Assistance and audit | Leadity answers reasonable written requests for compliance information, once in any twelve month period unless a regulator or law requires otherwise. |
| Deletion | Results and uploads can be exported while the account is open. Afterward Leadity deletes or returns them as the retention section of the Privacy Policy describes. |
Read the full Data Processing Addendum for the exact terms.
How should you use lead data responsibly?
Leadity is a data tool, not a compliance service, so you are responsible for making sure each call, text and email to a business is lawful.
Leadity does not scrub leads against the National Do Not Call Registry, state lists, Canada's National Do Not Call List, the UK's Telephone Preference Service or Corporate TPS, or Australia's Do Not Call Register, and it does not obtain or check consent. Scrub and suppress before you contact anyone. In the United Kingdom a sole trader's line counts as an individual's.
Phone line types are a best-effort signal, not a guarantee. A number can be reassigned, ported or disconnected, and a number that cannot be classified is labelled unknown instead of guessed.
Start with the TCPA risk checker, then read the guides on whether cold calling is legal and whether scraping Google Maps is legal. The guides are general information, not legal advice.
Your duties are set out in the Terms of Service, sections 3 and 4.
How do you report a security issue?
Email support@leadity.io with the subject Security report, and describe what you found, how to reproduce it and which page or account it affects.
If a personal data breach affects data Leadity processes for you, Leadity tells you without undue delay, as section 6 of the Data Processing Addendum sets out. Questions about this page go to the same address.
Questions about Leadity security
Leadity does not store card numbers. Payments run through Whop's hosted checkout, and Leadity receives only a signed payment confirmation. Your billing history keeps a label such as a card brand and its last four digits, so you can tell which payment method you used.
Leadity hosts the service and its databases in the United States, on Railway. Information about businesses and people in Canada, the United Kingdom and Australia is transferred to and processed in the United States. Files you upload, such as support attachments, are stored with Cloudflare R2.
Leadity does not sell your customer account data, and it does not share it for advertising. Providers receive only what they need to run the service, and each is named in the Privacy Policy. The marketing site loads analytics and advertising tags, which Section 9 of the Privacy Policy describes.
Leadity protects passwords by storing only a scrambled hash of each one, made with Argon2id, never the password itself. Each session is a random sign-in token in an httpOnly cookie, and Leadity keeps only a hash of that token. A password reset signs you out everywhere, and changing your password signs out every other device.
You can delete your account at any time from Settings by entering your password. Deleting signs you out everywhere and forfeits unused credits. Leadity keeps the related records for at least 12 months, and longer where the law or security requires, so deletion is not instant erasure of every record.
The Data Processing Addendum is published on this site and forms part of the Terms of Service. The Standard Contractual Clauses are incorporated into it for customers in the EEA, the UK or Switzerland. If you need a signed counterpart, email support@leadity.io.
Legal documents and related pages
Questions from your security team?
Email support@leadity.io. Every new account gets 300 free credits at sign-up, with no card needed, so you can test a live scrape first.