LeadGrind Privacy Policy

Last updated: 1st July 2026

1. Who we are

LeadGrind ("we", "us", "LeadGrind") is a trading name of Max Solomon, a sole trader trading from 75 Highlander Road, Chester, CH36DH ("we", "our"). We are registered with the UK Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER].

We are the data controller for the personal data described in Section 3 (Account Data). For personal data submitted through lead capture forms on our customers' branded sites, we act as a data processor — see Section 4.

2. Scope of this policy

This policy covers:

The LeadGrind marketing website (leadgrind.co.uk).
The LeadGrind platform ("brand" panel, "partner" panel, and admin panel) used by our subscribing businesses ("Brands") and the partners they route leads to ("Partners").

This policy does not cover the privacy notice a Brand shows to their own website visitors when collecting leads — that's a separate document each Brand is responsible for publishing themselves. Brands can edit theirs from their Brand settings; it's shown at /privacy on their own site.

3. Personal data we collect as a controller ("Account Data")

When you register as a Brand or Partner, or visit our marketing site, we collect:

Account holders (Brands): name, email address, password (hashed), the brand/company name you register, billing details (processed by Stripe — we do not store card numbers), IP address and basic usage logs.
Partner users: name, email address, password (hashed).
Marketing site visitors: standard server logs (IP address, browser user agent, pages visited). We do not currently use analytics or advertising cookies on the marketing site beyond what's strictly necessary to serve the page.

We use this data to: provide and bill for the service, authenticate you, respond to support requests, and comply with our legal obligations (e.g. accounting records for payments).

Lawful basis: performance of a contract (providing the service you've signed up for) and, for billing records, legal obligation.

4. Personal data we process on behalf of Brands ("Lead Data")

Brands use LeadGrind to build lead-capture forms and collect enquiries from their own website visitors ("Lead Data"). Depending on the form a Brand builds, this can include name, email, phone number, postal address, and — for finance or insurance-sector Brands — financial or insurance- related details submitted voluntarily through the form.

We are a data processor for this data, not a controller. The Brand decides what fields to collect, why, and what lawful basis they rely on. We process Lead Data strictly on the Brand's documented instructions, as set out in our Data Processing Agreement with each Brand.

In summary, Lead Data is:

Stored in our database, associated with the Brand and the form it was submitted through.
Automatically routed to a Partner the Brand has configured, based on rules the Brand sets.
Delivered to that Partner by webhook, email notification, and/or a CRM integration (HubSpot) the Partner has connected — whichever the Brand/Partner has configured.

We do not use Lead Data for our own marketing, do not sell it, and do not share it with anyone outside the Brand's own configured Partners and the sub-processors listed in Section 6.

5. Retention

Account Data: retained for as long as your account is active, and for [RETENTION PERIOD — e.g. 6 years] after closure to meet accounting/legal obligations.
Lead Data: retained for 24 months from the lead's submission date, after which it is automatically deleted by a scheduled process.

6. Sub-processors

We use the following sub-processors to provide the service. We'll update this list whenever it changes, and notify Brands of material changes as required by our Data Processing Agreement.

Sub-processor	Purpose	Data involved
Stripe	Payment processing for Brand subscriptions	Billing/payment details
Amazon Web Services (S3)	File storage (e.g. uploaded hero images)	Files a Brand uploads; region: [AWS REGION — TBD]
postcodes.io	UK postcode validation/lookup during form completion	Postcode entered by an end-user, where a form uses the postcode field
Companies House (UK government, public API)	Company name/number lookup during form completion	Search term entered by an end-user, where a form uses the company-search field
HubSpot	CRM delivery, only when a Partner chooses to connect their own HubSpot account	Lead Data for leads routed to that Partner
Resend	Transactional email (partner invites, lead notifications, password resets)	Recipient email address, email content
OpenAI	Optional "AI website builder" feature — drafts page copy and a lead form from a Brand's own input	Business name, product/service description, and — only if the Brand supplies them — a logo image URL or the contents of an existing website they own. Used only when a Brand actively runs this feature; not used for Lead Data

7. Your rights

Under UK GDPR, you have the right to: access the personal data we hold about you, have inaccurate data corrected, request erasure, restrict or object to processing, and request data portability. Where we act as a processor for Lead Data, requests about that data should generally go to the relevant Brand first, since they are the controller — but you may contact us and we will assist or redirect you as required by our DPA with that Brand.

To exercise these rights, contact hello@leadgrink.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

8. International transfers

[TBD pending AWS region confirmation — if data is stored outside the UK/EEA, this section needs to describe the transfer mechanism relied on (e.g. UK International Data Transfer Agreement, adequacy regulations). Do not leave blank in the published version.]

9. Changes to this policy

We'll post any changes here and update the "Last updated" date. Material changes affecting Brands' obligations as controllers will be communicated directly, per the DPA.