Who controls the data
The data controller and operator of leadiy.co is sole proprietor Oleh Halahan (ФОП Галаган Олег Олегович), registration number 10000002273060, Kryvyi Rih, Ukraine.
Privacy contact: oleh.halahan@zanzarra.com. This policy applies to the public site, Google sign-in, the Leadiy workspace, payment records received from WayForPay, and support forms.
Data Leadiy collects
Account and sign-in
Google supplies an immutable account identifier, verified email, display name, and profile-picture URL through an ID token. Leadiy does not receive your Google password or a Google API access token.
Matching profile
Leadiy stores your company website, selected technologies or stack combinations, the site domain, page title, detected service signals, analysis status, and matching-profile timestamps. The website analysis is limited to a public URL and derived signals used for matching.
Workspace activity
Leadiy stores matched records, pipeline stages, board memberships, comments, notes, feed-view timestamps, prepared outreach fields, and outbound email logs when the optional SMTP feature is used. Users can also add lead contact details manually.
Payments and support
Leadiy stores subscription status, order reference, amount, currency, payment-system name, callback status, and transaction metadata returned by WayForPay. Card numbers and Apple Pay credentials are processed by WayForPay, not stored by Leadiy. Contact and removal forms store the fields you submit.
Technical logs
The application database does not store IP addresses or browser fingerprints. Server access and error logs may contain IP address, request path, time, user agent, and error context for security and operation.
Why data is used
- Authenticate the account and secure the session.
- Build a company and technology profile and show matching leads and vacancies.
- Maintain search, filters, comments, boards, pipeline state, unread counts, and billing access.
- Process payments, prevent abuse, investigate errors, and protect the service.
- Answer support, privacy, refund, and opt-out requests.
Leadiy does not sell personal data and does not use it for third-party advertising.
Service providers and disclosure
| Provider | Purpose | Data involved |
|---|---|---|
| Google Identity Services | Authentication and optional One Tap | Basic Google profile and sign-in state |
| WayForPay | Card and Apple Pay checkout | Email, order, amount, status, payment metadata |
| DigitalOcean | Application and database hosting | Hosted account, workspace, and operational data |
| Email provider | Support delivery and optional outbound email | Address, subject, message, and related context |
Data may also be disclosed when required by applicable law, to protect users or the service, or as part of a lawful business reorganisation with appropriate safeguards.
How long data is kept
- Account, profile, comments, boards, and activity: while the account is active, then removed from the active database within two business days after a verified deletion request.
- Opportunity records: while needed to operate and refresh the service; user-specific assignments are removed with the account.
- Payment records: for accounting, fraud prevention, charge disputes, and legal obligations for the period required by applicable law.
- Support and removal requests: until resolved and then as long as reasonably needed to demonstrate the response and protect legal rights.
- Server access/error logs: rotated daily with up to 14 archived rotations on the current host.
- Backups: seven access-restricted daily copies. Data deleted from active systems may remain until those copies rotate, normally up to seven days.
- Sessions: up to 30 days, or two hours for a temporary admin link; expired sessions are removed during session creation.
Your choices and requests
You may request a copy, correction, restriction, or deletion of account data through the contact form or by email. Account deletion is targeted within two business days after verification. A person or company represented in an opportunity record can use the separate Data Removal form.
Where local law gives additional rights, including objection, portability, or a complaint to a regulator, those rights are not limited by this policy.
Security and international use
Leadiy uses HTTPS, HttpOnly session cookies, same-origin API checks, role and tenant access controls, hashed session tokens, encrypted stored integration secrets, restricted database permissions, rate limiting, and protected rotating backups. No internet service can promise absolute security.
Leadiy operates from Ukraine and uses providers that may process data in other countries. By using the service globally, data may be processed where those providers operate, subject to their safeguards and applicable law.
Age, cookies, and changes
Leadiy is intended for business use by people aged 18 or older. It is not directed to children.
For browser storage and optional Google One Tap controls, read the Cookie Policy. Material privacy changes will be published on this page with a new effective date.
This policy is governed by applicable Ukrainian law, including the Law of Ukraine “On Personal Data Protection”.