Trust
Security, privacy and compliance
Buying contact data means trusting someone with other people's details. This page sets out exactly how we hold them, who can reach them, how long we keep them and how anyone can have theirs removed.
Controls
What is in place today
Access control
Access is limited by role, sensitive administration is restricted, and each client workspace is isolated from every other client.
Audit trail
Sensitive actions and privacy-request outcomes are recorded so activity can be reviewed and investigated.
Encryption
Data is encrypted in transit and at rest. Private credentials and confidential operating information are not exposed to the browser.
Retention
A daily sweep deletes stored contact files 90 days after delivery. Exports are generated on demand rather than piling up.
Backups and recovery
Managed backups and recovery procedures protect service data, with recovery controls reviewed as the service changes.
Vendor review
Every subprocessor is reviewed before use and recorded, covering hosting, storage, payments, email and supporting services.
Abuse prevention
Public forms are rate limited per address, screened for automated submission, and free text is stripped of anything that could act as an instruction further down the line.
Secure development
Dependencies are reviewed for known vulnerabilities, sensitive actions require authorization, and public requests are validated before processing.
Your rights
GDPR, UK GDPR and California
Europe and the UK
You can ask to see what we hold, have it corrected, have it deleted, restrict how it is used, object to it being used at all, or receive a copy in a file. We answer within 30 days, free of charge. Business records are held on the legitimate interests basis for business-to-business contact, and an objection ends that immediately and permanently.
California
You can ask what categories we hold and where they came from, ask for deletion or correction, and tell us never to share your information. We answer within 45 days and never treat anyone differently for asking. The do-not-share instruction takes effect the moment it is submitted.
Subprocessors
Who else touches the data
| Category | Purpose | Region |
|---|---|---|
| Cloud hosting and edge delivery | Serving the site and running background work | United States |
| Managed database and file storage | Storing accounts, contacts and documents | United States |
| Secure file storage | Protected service files | United States |
| Payments | Subscriptions and invoices | United States |
| Transactional email | Delivery of lists and account email | United States |
| Specialist services | Supporting service delivery and quality | United States and Europe |
Further processing details are shared only when appropriate under a signed data processing agreement.
Questions
Common compliance questions
How do you protect the quality of contact data?
Every delivered record is screened against the client's written profile, checked for required contact fields and covered by our replacement policy. Detailed sourcing information is confidential and shared only when legally required or under an appropriate agreement.
What is the lawful basis for holding business contacts?
Legitimate interests for business-to-business outreach, as recognised under UK and EU GDPR. Every record is business contact information: a work role, an employer, a work email and a business number. We run a balancing test, honour objections immediately, and never build special category data.
How does someone remove themselves?
Through the privacy request page or the opt-out page, with no account and no cost. Removal is permanent: the person is added to a do-not-contact list that every build and every delivery checks before anything is created or sent.
Are you SOC 2 certified?
Not yet. LeadNumbers is preparing for an independent audit and maintains documented safeguards for access, privacy, retention, recovery and security review. See the SOC 2 status page for the current position.
How long is client data kept?
Exported contact files are deleted 90 days after delivery by an automatic daily sweep. Documents a client uploads themselves stay until the client deletes them or closes the account. Delivered records stay in the client's own workspace, visible only to that client.
Do you sell personal information?
We do not sell personal information in the ordinary sense, and Californians can still tell us never to share theirs. That instruction takes effect the moment it is submitted, before anyone reviews it.