Legal
Privacy policy
What personal data VectorLeads handles, where it comes from, why we use it, how long we keep it, and how to object or ask for removal.
Last updated
On this page
1.Who we are
We handle two kinds of personal data: data about our customers and the people who visit our site, and data about the local businesses our customers research and the people who run them. For our customers’ accounts and for the business information we compile, we are the controller. For lists that customers upload, we process the data on the customer’s behalf.
2.Data about customers and visitors
- Account. Your name, email address and sign-in method (and your profile picture if you sign in with Google), your workspace and the teammates in it.
- Workspace settings and branding. The services you sell, your home city and niches, and the agency name, logo, call to action and colour shown on your audit reports.
- What you do in the app. Searches (a niche and a place), opportunities and their status and outcome tags, exports, pushes, uploaded lists, tracked social accounts, and your credit balance and history.
- Billing. Paddle takes payment details as our merchant of record. We receive your billing name, email, country, plan, amounts, tax status and transaction ids, never full card numbers.
- Connected tools. The API keys and access tokens for tools you connect (Instantly, Smartlead, HubSpot, GoHighLevel, Google Sheets), encrypted before they are stored.
- Messages. What you send us when you ask for help.
- Free audit visitors. The website address you enter, an email address if you give one, and a one-way hash of your IP address with a salt that changes daily, used only for rate limits (we don’t store the address itself). Cloudflare Turnstile checks that the form is used by a person.
- Audit report viewers. A view is counted once per browser session using your browser’s session storage. No cookie is set, no IP address is stored, and no analytics or recordings run on report pages.
- Technical data. Our hosting, network and sign-in providers process IP addresses and device details to run the service securely. Cloudflare, which serves our website, tells us which country a visit comes from so we can apply the privacy choices that fit where you are.
- Error reports. When something breaks, Sentry receives the error, where it happened in our code, the page or background job, your browser and device type, and your user and workspace ids. Email addresses and phone numbers are removed first, and no IP address is stored.
- Usage events on our servers. Events such as “search run” or “contact found”, with your user and workspace ids and details such as result counts, plan and credits used. We store them in our database and send them to PostHog. They never include names, email addresses or phone numbers.
- Analytics in your browser. Depending on where you are and the choices you make (see cookies and similar technology), PostHog records the pages you visit, what you click, how far you scroll, how fast pages load, your browser, device and screen size, the page that sent you to us, and an approximate location (country and city) worked out from your IP address, which PostHog then discards.
- Session recordings. While you are signed in to the app, PostHog records your sessions so we can see where the app is confusing or broken: a replay of the pages you see, your clicks and your scrolling. Everything you type is hidden, as are email addresses and phone numbers shown on screen. Sign-in pages and our admin console are never recorded, and payment forms are run by Paddle outside our pages. Outside the UK, the EEA and Switzerland, recordings are part of the service you agree to when you sign up and you can turn them off at any time; in the UK, the EEA and Switzerland we record only if you turn recordings on. Visitors who are not signed in are never recorded.
3.Data about businesses and the people behind them
VectorLeads helps agencies find local businesses that could use their services. To do that we compile information that businesses publish about themselves or that is otherwise public:
- Business listings. Name, address, phone number, website, category, opening hours, rating and review count, and whether the Google Business Profile is claimed. Sources: Overture Maps open data, and Google Maps and Google Search results we obtain through DataForSEO and Apify, plus directories such as Yellow Pages, Justdial and IndiaMART.
- The business’s own website. Pages any visitor can load, including contact details published there, the software the site runs on, speed and mobile measurements, and public records about the domain (DNS, certificate and registration dates).
- Public social profiles of businesses. Handle, follower and post counts, and statistics of recent posts on Instagram, TikTok, X, YouTube and Facebook.
- Search, ads and AI answers. Whether the business appears in Google results and Maps, runs Google or Meta ads, and is named in answers from AI assistants (ChatGPT, Gemini, Google AI Overviews, Perplexity) for searches such as “best dentist in Austin”.
- Owner and manager work emails. When a customer asks, we look for the work email address of a business owner or manager from the person’s name and the business’s domain, using email-finding services, and check it with email verification services. We store the address, the person’s name and role if found, how it was found and the verification result.
- Reviews. Counts, ratings, the date of the newest review and how often the owner replies. Not reviewers’ names or review text.
- Follower exports. When a customer asks for the followers of a public business account, we fetch the public list and deliver it as a file that is deleted after 24 hours. We don’t keep follower identities.
Most of this describes a company, not a person. For sole traders and partnerships, and for owners’ names and work email addresses, it is personal data, and this policy applies to it.
Our website checks are passive: we load public pages the way a browser does and read public records. We never test logins, submit forms, look for hidden files or scan ports.
4.Why we use it and our legal bases
Under the UK GDPR and the EU GDPR we rely on:
- Contract, to provide the service you signed up for: accounts, workspaces, searches, reports, exports, pushes and billing.
- Legitimate interests, to compile public business information and business contact details so that agencies can offer relevant services to businesses; to keep the service secure and prevent abuse; to find and fix errors (error reports); and to understand how the product is used so we can improve it (usage events on our servers, and analytics in your browser where the law allows it without asking first). We have weighed these interests against the rights of the people involved: business data is limited to people’s business role, comes from public sources, is shown with where and when it was found, and anyone can object and have it removed; usage data carries ids, never names or email addresses, and you can object at any time.
- Legal obligation, for tax and accounting records and lawful requests.
- Consent, where we ask for it: analytics cookies and session recordings in the EEA and Switzerland, session recordings in the UK, and connecting your Google account.
We don’t make decisions about people that have legal or similarly significant effects by automated means. Opportunity scores rate a business’s online presence, not a person. We don’t use personal data for advertising and don’t share it with advertisers.
Other countries
- United States. Depending on your state, you may have the right to know, correct and delete personal data and to opt out of certain uses. We honour these requests from anyone, wherever they live. We don’t sell personal data or share it for cross-context behavioural advertising; PostHog and Sentry process it only for us, as our service providers. We still honour Global Privacy Control: when your browser sends it, analytics cookies and session recordings stay off unless you turn them on.
- Canada. Business contact information used to communicate with someone about their work is handled under PIPEDA’s business contact rules; the rights below still apply.
- Australia. We handle personal information in line with the Australian Privacy Principles.
- India. We process personal data in line with the Digital Personal Data Protection Act, 2023. The business contact details we collect are ones made public; where the Act applies, you can use the rights below.
5.Our customers’ outreach
Our customers decide whom to contact and how. They are responsible for contacting businesses lawfully, including under the UK’s PECR, EU ePrivacy rules, the US CAN-SPAM Act, Canada’s CASL, Australia’s Spam Act 2003 and the rules that apply in India. Our acceptable use policy sets out what we require.
When a customer pushes opportunities to their own tools (Instantly, Smartlead, HubSpot, GoHighLevel or Google Sheets), those tools handle the data under the customer’s own account and terms.
6.If your business is in VectorLeads
You can object to our use of your details, or ask us to remove them, at any time. You don’t need to give a reason.
A customer who exported your details before you objected keeps their own copy and must honour your opt-out under our acceptable use policy.
8.Google user data
If you connect Google Sheets, we ask for Google’s drive.file permission. It lets VectorLeads create spreadsheets and add rows to spreadsheets it created or that you choose. It does not let us see your other files. We use it only to write the opportunities you choose to push, and we keep an encrypted refresh token so pushes keep working until you disconnect.
VectorLeads’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Google user data for advertising, don’t sell it, don’t let people read it except with your permission, for security or where the law requires, and don’t use it to train AI models.
You can disconnect Google Sheets on the Integrations page, or remove VectorLeads’s access at any time in your Google security settings.
We also use Google services that don’t involve your Google account: PageSpeed Insights and Web Risk receive the website addresses we check, and the Gemini API receives search requests and business details to sort businesses by type and to check AI answers.
9.YouTube
The social tracker and the viral content finder use YouTube API Services to read public channel and video statistics. We use an API key and never ask for access to your YouTube account. By using these features you agree to be bound by the YouTube Terms of Service. Google’s handling of data is described in the Google Privacy Policy.
We store the public statistics of the channels you track so we can show their growth. If you have given VectorLeads access to your Google account, you can revoke it at any time in your Google security settings.
11.International transfers
We and our providers process data in the UK, the European Economic Area, the United States and the other countries listed on our subprocessors page. When personal data leaves the UK or the EEA for a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses with the UK Addendum, or on the provider’s certification under the EU-US Data Privacy Framework and its UK Extension.
12.How long we keep data
- Account and workspace data
- While your account is open. Deleted when you delete your account or ask us to delete the workspace; a sole owner’s workspace is deleted with their account.
- Owner and manager work emails
- While the customer’s workspace keeps them. Deleted with the workspace, or sooner on request.
- Email addresses published on a business’s own website
- While the business is listed, refreshed when its site is checked again. Removed on a valid request.
- Uploaded list rows
- 90 days
- Free website audits
- 90 days
- Follower export files
- 24 hours
- Records of calls to data providers
- 180 days
- Usage events in our database
- 400 days
- Usage and analytics events in PostHog
- 1 year
- Session recordings
- 30 days
- Privacy choices you make while signed in
- While your account is open
- Webhook records from Paddle and Clerk
- 90 days
- Error reports
- Up to 90 days
- Database backups
- Up to 45 days. Data deleted from VectorLeads leaves our encrypted backups within this time.
- Billing records
- As long as tax and accounting law requires.
- Business listings and measurements
- While they are useful to customers’ workspaces, refreshed when a business is rescanned. Removed on a valid request.
13.Security
Data travels encrypted (TLS). Integration tokens are encrypted before they are stored. Every workspace’s data is kept apart from every other’s, and only people who need access to run the service have it. Passwords and sign-in are handled by Clerk; we never see your password.
14.Your rights
You can also complain to a regulator: the Information Commissioner’s Office in the UK, your local data protection authority in the EU, the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, or the Data Protection Board of India. We’d appreciate the chance to fix things first.
15.Children
VectorLeads is a tool for businesses and is not meant for anyone under 18. We don’t knowingly collect data about children.
16.Changes to this policy
When we change this policy we update the date at the top. If a change matters to how we use your data, we email customers at least 30 days before it takes effect.