Who controls the data
The data controller and operator of leadiy.co is sole proprietor Oleh Halahan (ФОП Галаган Олег Олегович), registration number 10000002273060, Kryvyi Rih, Ukraine.
Privacy contact: oleh.halahan@zanzarra.com. This policy applies to the public site, consented Google Analytics measurement, Google sign-in, the Leadiy workspace, payment records received from WayForPay, and support forms.
Data Leadiy collects
Account and sign-in
Google supplies an immutable account identifier, verified email, display name, and profile-picture URL through an ID token. Leadiy does not receive your Google password or a Google API access token.
Matching profile
Leadiy stores your company website, selected technologies or stack combinations, the site domain, page title, detected service signals, analysis status, and matching-profile timestamps. The website analysis is limited to a public URL and derived signals used for matching.
Workspace activity
Leadiy stores matched records, pipeline stages, board memberships, comments, notes, feed-view timestamps, prepared outreach fields, and outbound email logs when the optional SMTP feature is used. Users can also add lead contact details manually.
Payments and support
Leadiy stores subscription status, order reference, amount, currency, payment-system name, callback status, and transaction metadata returned by WayForPay. Card numbers and Apple Pay credentials are processed by WayForPay, not stored by Leadiy. Contact and removal forms store the fields you submit.
Consent-aware product analytics
The Google tag loads with analytics and advertising storage denied and may send cookieless consent or diagnostic pings containing consent state and basic page/device context. It does not set analytics cookies or receive Leadiy engagement, identity, or checkout events until “Accept all”. After consent, Google Analytics may receive a pseudonymous browser identifier, page path and title, language, referrer, device and browser characteristics, approximate geography, engagement events, workspace section, internal user ID, account category, and checkout events including payment method, order reference, currency, and value. Leadiy does not send names, email addresses, notes, lead records, or card details to analytics.
First-party site analytics
After analytics consent, Leadiy stores a random browser identifier for up to 180 days and measures page paths, sessions, active foreground time, returning visits, referring hostname, device category and browser family on its own server. The server stores a keyed hash of this identifier, not a name, email, full IP address, raw user agent or browser fingerprint. URL queries are excluded except an allowlisted workspace section. Only administrators can read reports. Withdrawing consent stops browser collection and removes the local identifier; existing history expires after 400 days. Separately, the server counts successful HTML requests by hour, page and declared crawler family, including AI bots, without setting a visitor identifier. User-Agent labels are heuristic, not verified identities.
Technical logs
The application database does not store IP addresses or browser fingerprints. Server access and error logs may contain IP address, request path, time, user agent, and error context for security and operation.
Why data is used
- Authenticate the account and secure the session.
- Build a company and technology profile and show matching leads and vacancies.
- Maintain search, filters, comments, boards, pipeline state, unread counts, and billing access.
- With consent, measure visits, page usage, conversion steps, and completed purchases to improve the product.
- Process payments, prevent abuse, investigate errors, and protect the service.
- Answer support, privacy, refund, and opt-out requests.
Leadiy does not sell personal data and does not use it for third-party advertising.
Service providers and disclosure
| Provider | Purpose | Data involved |
|---|---|---|
| Google Identity Services | Authentication and optional One Tap | Basic Google profile and sign-in state |
| Google Analytics | Consented audience, engagement, and checkout measurement | Pseudonymous identifiers, page/device context, events, account category, order reference, currency, and value |
| WayForPay | Card and Apple Pay checkout | Email, order, amount, status, payment metadata |
| DigitalOcean | Application and database hosting | Hosted account, workspace, and operational data |
| Email provider | Support delivery and optional outbound email | Address, subject, message, and related context |
Data may also be disclosed when required by applicable law, to protect users or the service, or as part of a lawful business reorganisation with appropriate safeguards.
How long data is kept
- Account, profile, comments, boards, and activity: while the account is active, then removed from the active database within two business days after a verified deletion request.
- Opportunity records: while needed to operate and refresh the service; user-specific assignments are removed with the account.
- Google Analytics: event and user data follow the retention controls configured in the GA4 property; withdrawing consent stops future collection from that browser.
- Payment records: for accounting, fraud prevention, charge disputes, and legal obligations for the period required by applicable law.
- Support and removal requests: until resolved and then as long as reasonably needed to demonstrate the response and protect legal rights.
- Server access/error logs: rotated daily with up to 14 archived rotations on the current host.
- Backups: seven access-restricted daily copies. Data deleted from active systems may remain until those copies rotate, normally up to seven days.
- Sessions: up to 30 days, or two hours for a temporary admin link; expired sessions are removed during session creation.
Your choices and requests
You may request a copy, correction, restriction, or deletion of account data through the contact form or by email. Account deletion is targeted within two business days after verification. A person or company represented in an opportunity record can use the separate Data Removal form.
Where local law gives additional rights, including objection, portability, or a complaint to a regulator, those rights are not limited by this policy.
Security and international use
Leadiy uses HTTPS, HttpOnly session cookies, same-origin API checks, role and tenant access controls, hashed session tokens, encrypted stored integration secrets, restricted database permissions, rate limiting, and protected rotating backups. No internet service can promise absolute security.
Leadiy operates from Ukraine and uses providers that may process data in other countries. By using the service globally, data may be processed where those providers operate, subject to their safeguards and applicable law.
Age, cookies, and changes
Leadiy is intended for business use by people aged 18 or older. It is not directed to children.
For browser storage and optional Google One Tap controls, read the Cookie Policy. Material privacy changes will be published on this page with a new effective date.
This policy is governed by applicable Ukrainian law, including the Law of Ukraine “On Personal Data Protection”.