Privacy Policy

This Privacy Policy explains how Leadey Technologies CO L.L.C, a company incorporated in Dubai, United Arab Emirates ("Leadey", "we", "us", or "our"), collects, uses, discloses, and protects personal data in connection with the Leadey platform, our website at leadey.ai (the "Website"), applications, APIs, and related services (collectively, the "Service").

We are committed to handling personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where applicable, other data-protection laws including the EU/UK General Data Protection Regulation ("GDPR").

This Privacy Policy should be read together with our Terms and Conditions and our Cookie Policy.

1. Our Role: Controller and Processor

Leadey is a business-to-business lead-generation and sales-engagement platform. Our role in relation to personal data depends on the context:

As a controller, we determine the purposes and means of processing for: account registration and administration, billing and payments, platform security, product analytics, and our own marketing and communications.
As a processor, we process personal data contained in Customer Data and Lead Data (for example, the contact records, leads, notes, and campaign data that our customers upload, discover, or generate) on behalf of and under the instructions of our customers, who are the controllers of that data.

If you are an individual whose data has been uploaded to or processed through the Service by one of our customers, that customer is the controller of your data, and you should direct privacy requests to them in the first instance. We will assist our customers in responding to such requests as required by law.

2. Personal Data We Collect

2.1 Account and profile data

Name, email address, telephone number, job title, organisation name, authentication identifiers, profile settings, and team-membership information of users who register for and use the Service.

2.2 Billing and transaction data

Billing contact details, subscription and Credit purchase history, and limited payment metadata. Card and payment details are handled by our third-party payment processor; we do not store full card numbers.

2.3 Usage and device data

Log data, IP address, browser and device information, pages and features accessed, actions taken, timestamps, and diagnostic information collected automatically when you use the Service.

2.4 Communications data

Records of your communications with us (such as support requests), and content you create within the Service such as notes, templates, and messages.

2.5 Telephony and call data

When you use calling features, we and our telephony provider process call metadata (such as caller and recipient numbers, duration, direction, and disposition) and, where enabled, call recordings and transcripts.

2.6 Website data

When you visit or interact with the Website, we collect the information you choose to give us and limited technical data, including:

free-trial requests: your name, work email, phone number, company and current CRM when you start a free trial on leadey.ai/try, and the call you book with our team. This creates a lead and a meeting in our own Leadey workspace so we can set up your trial;
demo bookings: your name, email address, company and any notes you add when you book a demo through our embedded booking page. This creates a lead and a meeting in our own Leadey workspace so our team can prepare;
contact form enquiries: your name, work email, company, team size, the products you are interested in and any message you write on our contact page. We store these in our website's content management system and email them to our team (via our email provider) so we can respond, and we record whether you went on to book a demo;
newsletter sign-ups: your email address and the page you signed up on;
help centre feedback: whether an article was helpful and any comment you choose to leave;
emails you send us, for example to support@leadey.ai or sales@leadey.ai; and
technical data such as your IP address, browser type and pages requested, which our hosting provider processes to deliver and secure the Website.

Apart from our free-trial page at leadey.ai/try, we do not use advertising or cross-site tracking cookies on the Website. On that page we use the Meta Pixel, Microsoft Clarity and Leadpipe to measure our advertising and improve the page, and when you request a trial or book a call we also send Meta a hashed (scrambled) copy of your email address and phone number so it can measure our ads. You can block these in your browser settings. See our Cookie Policy for details.

2.7 Customer Data and Lead Data (processed on behalf of customers)

Personal data relating to third-party business contacts and leads that customers import, discover, enrich, or process through the Service. This may include names, business contact details, job titles, employer information, professional profiles, and engagement history. We process this data as a processor on behalf of our customers.

3. How We Use Personal Data

We use personal data to:

provide, operate, maintain, and secure the Service;
create and administer accounts and authenticate users;
process payments, Credits, and billing;
enable platform features such as discovery, enrichment, outreach campaigns, telephony, recording, and transcription, as instructed by customers;
provide customer support and respond to enquiries;
monitor, analyse, and improve the performance, reliability, and usability of the Service;
detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms;
comply with legal obligations and enforce our agreements; and
send service-related and, where permitted, marketing communications (you may opt out of marketing at any time).

We do not sell personal data.

4. Legal Bases for Processing

Where the GDPR or similar laws apply, we rely on the following legal bases:

Performance of a contract — to provide the Service to you and administer your Account.
Legitimate interests — to operate, secure, analyse, and improve the Service, and to conduct B2B marketing, provided these interests are not overridden by your rights.
Consent — where required (for example, certain cookies or marketing); you may withdraw consent at any time.
Legal obligation — to comply with applicable laws.

Where we act as a processor, our customers are responsible for establishing the lawful basis for processing Lead Data.

5. Artificial Intelligence Features

Certain features (such as call transcription and summarisation) use artificial-intelligence services. Where these features are used, relevant content (such as call recordings or text) may be processed by our AI sub-processors solely to deliver the feature. We do not permit our AI sub-processors to use Customer Data to train their general models except as necessary to provide the service and as governed by our agreements with them.

6. Google User Data

This section applies when you connect a Google account (Gmail and/or Google Calendar) to Leadey using Google sign-in ("Google user data"). It adds to the rest of this Privacy Policy; where the two differ, this section governs how we handle Google user data.

6.1 What we access and why

When you connect a Google account, Leadey asks for the following permissions, and uses each one only for the purpose stated:

Your email address and basic profile (name and profile picture): to identify the connected account and show you which mailbox is connected.
Send email on your behalf (gmail.send): to send the emails you write, schedule, or set up in Leadey (for example, one-off emails to a contact, or the email steps of your campaigns and workflows) from your own Gmail address.
Read your email (gmail.readonly): to detect new messages in the connected mailbox so that replies from your contacts appear in Leadey's inbox and on the contact's timeline, and so that replies, bounces, and unsubscribe requests can pause or stop your outreach. We check the senders and recipients of new messages against the contacts in your Leadey workspace. We store only messages exchanged with those contacts, and delivery-failure notices for emails sent through Leadey. Other messages in your mailbox are not stored.
View your calendars (calendar.readonly): to show your events in Leadey's calendar, calculate your availability for booking pages, and recognise meetings with your contacts.
Create and edit calendar events (calendar.events): to create, update, or cancel the meetings you book in Leadey (including video-conference links and invitations to attendees).

We access Google user data only after you connect your account and only while it stays connected.

6.2 Limited Use

Leadey's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google user data only to provide and improve the user-facing features described in section 6.1.
We do not use Google user data for advertising, including retargeting, personalised, or interest-based advertising.
We do not sell Google user data, or transfer it to data brokers or information resellers.
We do not use Google user data to determine creditworthiness or for lending purposes.
We do not use Google user data, including data from Google Workspace APIs such as Gmail and Google Calendar, to develop, improve, or train generalised artificial-intelligence or machine-learning models.
People at Leadey do not read your Google user data unless (a) you give us your explicit permission for specific messages or events, for example when you ask our support team for help; (b) it is necessary for security purposes, such as investigating abuse; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymised and is used for our internal operations.

6.3 AI features

Some features use artificial intelligence on content you ask them to work on. For example, "draft a reply" sends the recent messages in a conversation with a contact to our AI provider (OpenAI) to write a suggested reply for you. Google user data is sent to an AI provider only when you use such a feature, and only to produce that result for you. It is sent under terms that do not allow the provider to use it to train its models.

6.4 Sharing

We share Google user data only:

with Authorised Users in your workspace. Email conversations and meetings with your contacts form part of your organisation's Customer Data and are visible to other users in your workspace, according to the permissions your organisation configures;
with our sub-processors listed in section 7.1, such as hosting and AI providers, only as needed to provide the features above, and under confidentiality and data-protection obligations;
where required by law, or to protect the security of the Service and its users; and
as part of a merger, acquisition, or sale of assets, with your consent where required, and subject to this Privacy Policy.

6.5 Storage and security

Google user data is stored on Amazon Web Services infrastructure in London, United Kingdom. Access tokens are encrypted by our application before they are stored, our databases are encrypted at rest, and all data is encrypted in transit. Access is limited to the systems and personnel who need it to operate the Service.

6.6 Disconnecting and deletion

Disconnecting: you can disconnect a Google account at any time in Leadey under Settings → Mailboxes (or Settings → Calendars). Disconnecting immediately deletes the access tokens we hold for that account, which stops all further access. It also deletes the calendar events we synced from it.
Revoking at Google: you can also revoke Leadey's access at any time from your Google Account at myaccount.google.com/permissions.
Messages already stored: messages exchanged with your contacts that were already stored remain part of your workspace's contact history. They are kept until you or your organisation delete them, or until your account is closed, after which they are deleted as described in section 9.
Deletion requests: you can ask us to delete Google user data at any time by emailing privacy@leadey.ai.

We share personal data only as described below:

7.1 Sub-processors and service providers

We use trusted third parties to help operate the Service, which may include:

Hosting and infrastructure providers;
Telephony and messaging providers (for calling, SMS, and recording);
Payment processing providers;
Authentication and identity providers;
Data sourcing and enrichment providers (for discovery and enrichment features);
Artificial-intelligence providers (for transcription and summarisation);
Analytics, logging, and email providers.

Our current providers include Amazon Web Services, Vercel and Railway (hosting), Cloudflare (file storage), Clerk (authentication), Stripe (payments), Twilio (telephony and SMS), AssemblyAI and OpenAI (transcription and AI summaries), Resend (email delivery), Sentry (error monitoring), and data and channel providers used for enrichment, LinkedIn and WhatsApp features. We may update these providers from time to time.

These providers are authorised to process personal data only as necessary to perform services for us and are bound by appropriate confidentiality and data-protection obligations.

7.2 Between customer users

Personal data within a customer Account (such as activity, notes, and assignments) may be visible to other Authorised Users within the same organisation.

7.3 Legal and protection

We may disclose personal data where required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of Leadey, our users, or others, and to enforce our Terms.

7.4 Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to this Privacy Policy.

8. International Data Transfers

We are based in the United Arab Emirates and may process and store personal data in the UAE and in other countries where we or our sub-processors operate. Where personal data is transferred across borders, we take steps to ensure an appropriate level of protection in accordance with applicable law, which may include standard contractual clauses or other lawful transfer mechanisms.

9. Data Retention

We retain personal data for as long as necessary to provide the Service, fulfil the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements.

Account and billing data is generally retained for the life of the Account and for a reasonable period thereafter as required by law.
Customer Data and Lead Data are retained according to the customer's instructions and configuration; we will delete or return such data after termination in accordance with our Terms, subject to legal retention requirements.
Call recordings and transcripts are retained while the customer's Account is active, unless the customer deletes the related records, and are deleted or returned after termination in accordance with our Terms, subject to applicable law.
Newsletter subscriptions are kept until you unsubscribe or ask us to delete them. Help centre feedback is kept for as long as it is useful for improving our documentation.

10. Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration, including access controls, encryption in transit, and authentication safeguards. No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

11. Your Rights

Subject to applicable law (including the UAE PDPL and, where applicable, the GDPR), you may have the right to:

access the personal data we hold about you;
request correction of inaccurate or incomplete data;
request erasure of your data;
restrict or object to certain processing;
request portability of data you provided to us;
withdraw consent where processing is based on consent; and
lodge a complaint with the competent data-protection authority (in the UAE, the UAE Data Office).

To exercise these rights with respect to data for which we are the controller, contact us using the details in Section 16. If your data was uploaded by one of our customers (who is the controller), please contact that customer directly; we will support them as required.

We will respond to requests within the timeframe required by applicable law. We may need to verify your identity before fulfilling a request.

12. Call Recording and Monitoring

The Service records answered calls made and received through Leadey telephony so that customers can review and transcribe them. Customers control which of their users can access recordings. The customer is responsible for providing all legally required notices and obtaining all legally required consents from call participants. Recording-consent requirements vary by jurisdiction; some require the consent of all parties.

13. Cookies and Similar Technologies

We and our providers use cookies and similar technologies to operate the Service, remember your preferences and authenticate sessions. Our Cookie Policy explains exactly which cookies the Website and the Service use and how to control them.

14. Children's Privacy

The Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, provide additional notice through the Service or by other reasonable means. Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of personal data, please contact:

Leadey Technologies CO L.L.C
Dubai, United Arab Emirates
Email: privacy@leadey.ai