Privacy Policy

Leadley.io ("Leadley", "we", "us") operates a B2B lead generation platform. For the purposes of the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA), the data controller / business responsible for your personal information is:

• Legal entity: PAİ LABS TEKNOLOJİ VE UYGULAMA GELİŞTİRME TİCARET LİMİTED ŞİRKETİ (Türkiye, MERSİS 0719059740800001)
• Registered address: Karayolları Mah. Abdi İpekçi Cad. TOKİ Avrupa Konutları D11 Blok No:34A İç Kapı No:115 Gaziosmanpaşa / İstanbul
• Contact email: hello@leadley.io
• EU representative: not appointed. Leadley does not operate in the European Union; searching for businesses located in EU/EEA countries is disabled in the product.

• Account data: name, email address, password hash.
• Usage data: searches you run, leads you save, sites you generate, number of messages sent, feature interactions.
• Payment status: subscription tier and billing status (we do not store card numbers; those are held by our payment processor, LemonSqueezy).
• Technical data: IP address, browser/device type, session cookie identifiers.
• Support data: the content of any messages you send us.

Under the GDPR we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): to create and operate your account, run searches, generate sites, and deliver the service you signed up for.
• Legal obligation (Art. 6(1)(c)): to meet tax, accounting, and other statutory record-keeping duties.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure, prevent abuse and fraud, maintain and improve the product, and communicate about service changes. We balance these interests against your rights and freedoms.
• Consent (Art. 6(1)(a)): where we ask for it, for example any optional analytics or marketing communications; you may withdraw consent at any time.

• Account and usage data: kept for as long as your account is active, and deleted or anonymized within a reasonable period after account closure, subject to legal retention duties.
• Search cache (business/lead data surfaced from Google Maps): retained for up to 7 days for performance, then refreshed or discarded.
• Sales Pipeline (CRM) leads: automatically deleted 90 days after your last action on them. The timer resets whenever you touch the record (add it, or update its stage or notes), so leads you actively work on keep running, while ones you forget are removed on their own. You can also delete them yourself at any time.
• Generated sites: automatically deleted 60 days after you last edit or publish them. For sites you mark as sold this window is 12 months, since you may need to reopen and edit the record after delivery; the clock still runs from your last action. Deleting the record does not take down the customer's site on their own domain, only the editable copy here. Editing or re-publishing a site resets the timer; a visitor merely viewing the site does not extend it. You can also delete them yourself at any time.
• Billing records: retained for the period required by applicable tax and accounting law.
• Support correspondence: retained only as long as needed to handle your request and any follow-up.

If you are in the EU/EEA or UK, you have the right to: access your personal data; request rectification of inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; data portability (receive your data in a machine-readable format); and withdraw consent where processing is based on consent. You may also lodge a complaint with your local data protection authority. To exercise any of these rights, email hello@leadley.io, or delete your account directly from the dashboard.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to and deletion of that information, to correct inaccurate information, and to be free from discrimination for exercising these rights.

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. To exercise your California rights, email hello@leadley.io. We will not discriminate against you for doing so. You may use an authorized agent to submit a request on your behalf.

We share personal data only with service providers who process it on our behalf under appropriate agreements, including:

• Hosting and infrastructure: Railway Corporation (application and database); Cloudflare, Inc. (file/image storage and domain management).
• Payment processing: LemonSqueezy, Inc. (Merchant of Record) for international payments; iyzico Ödeme Hizmetleri A.Ş. (Türkiye) for Turkish Lira payments.
• AI providers used to generate websites: Google LLC (Gemini) and Anthropic PBC (Claude). We do not use OpenAI.
• Email delivery: Resend (transactional email only).
• Product analytics: PostHog, Inc. — loaded only if you accept analytics cookies.
• Error and performance monitoring: Functional Software, Inc. (Sentry), processed in the European Union (Germany).
• Stock imagery for generated sites: Unsplash Inc. (only a search term is sent; no personal data).

We do not sell your personal data or share it with advertising networks.

Some of our providers are located outside the EU/EEA and the UK, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, where applicable. The mechanism that applies to each provider is set out in that provider's own data processing terms.

• Passwords are stored as one-way hashes; we cannot see your plaintext password.
• All traffic is encrypted in transit via HTTPS.
• Card details never reach our servers; payment is processed by LemonSqueezy's PCI-DSS compliant infrastructure.
• Internal access is limited to what is needed to operate the service.

Leadley.io is a B2B business tool and is not directed at anyone under 18 (or under 16 in the EU/EEA). We do not knowingly collect personal data from minors.

We may update this policy from time to time. We will notify you by email of material changes.

For any privacy question or to exercise your rights: hello@leadley.io