Privacy Notice

1. Controller and processor roles

Leadsmith is the controller for personal data collected through this website and for our direct business relationships. For agency customer data processed inside the service, the agency will usually be the controller and Leadsmith will act as its processor. Our operational customer data-processing information is set out in the Data Processing page.

2. Data we collect and its sources

The data we collect depends on how you use Leadsmith. We receive it from you, your agency or employer, your use of the service, service integrations, and public sources. It can include:

• contact and demo details, such as your name, agency, role, email address, phone number, branch information, CRM, and the needs you describe;
• property-enquiry details submitted to an agency, such as name, email, phone number, property type, budget range, timeline, message, and subsequent conversation messages;
• account, onboarding, subscription, and service configuration details, including agency preferences, postcode patch, tone, email signature, integration settings, and Stripe customer or subscription identifiers;
• information from the interactive demo, including a postcode, email address where you request a signal pack, submitted text, and scan or capture details;
• technical and usage information, including IP address or an irreversible IP hash, browser and device information, user-agent, requested path, referrer, visitor identifier, and timestamps; and
• publicly available property and company information used for seller-signal features, including planning, Land Registry, and Companies House records.

3. Why we use it and our lawful bases

We use personal data for the following purposes, relying on the lawful basis that best fits the activity:

• Contract: to provide and support Leadsmith, including generating lead replies, qualification summaries, follow-ups, CRM integrations, seller-signal results, onboarding, and subscription administration, or to take steps at your request before entering a contract;
• Legitimate interests: to secure and improve the service, prevent abuse, troubleshoot errors, measure aggregate usage, respond to business enquiries, maintain customer relationships, and establish or defend legal claims, balanced against your rights and expectations;
• Legal obligation: to keep required business, tax, accounting, security, and compliance records, respond to lawful requests, and comply with court or regulatory processes; and
• Consent: where you have given it, for example for optional cookies, certain analytics or marketing activity, or another use that requires consent. You can withdraw consent at any time.

If an agency gives us lead data, it is responsible for choosing and documenting the appropriate lawful basis for that processing and for providing any required privacy information to the people concerned.

4. Processors and service providers

Leadsmith uses an AI service through the Polsia platform proxy for features such as drafting replies, extracting qualification fields, and enhancing seller-signal explanations. The relevant enquiry, agency configuration, and conversation context may be sent for that feature. We do not use customer lead data to sell advertising profiles.

Depending on how you use the service, our processors and service providers include:

• Polsia-hosted application infrastructure and platform proxies for hosting and authenticated AI, email, and file services;
• Neon/PostgreSQL for application data storage;
• Postmark for transactional and inbound email delivery;
• Stripe for subscription and payment processing;
• the AI provider reached through the Polsia AI proxy for drafting, extraction, and related AI features;
• first-party and platform analytics providers for service and campaign measurement; and
• customer-configured CRM, webhook, or integration destinations where an agency enables that transfer.

These providers may process personal data only for the relevant service and under appropriate contractual and security controls. Customer-configured CRM and webhook destinations remain the agency's responsibility.

5. Retention

We retain personal data only for as long as needed for the purpose collected, to provide the service, resolve disputes, maintain appropriate business records, meet legal obligations, and protect the service. We apply retention periods or review points by record type rather than keeping everything indefinitely.

For example, enquiry and conversation history may be retained while an agency uses the service and for a reasonable period afterwards; account, subscription, and transaction records may be kept for longer where tax, accounting, fraud-prevention, or legal requirements apply; and security, access, and audit records may be retained for as long as needed to investigate incidents and protect the service. We delete or anonymise data when it is no longer required, subject to lawful exceptions and protected backup cycles.

6. Security

We use access controls, authenticated service connections, signed or token-protected routes where appropriate, encryption in transit, logging, restricted operational access, backups, and other safeguards designed to protect personal data. We review access and service configuration as part of operating the application.

No internet service can guarantee absolute security. You are responsible for keeping account and integration credentials confidential and for checking customer-configured destinations. Please contact us promptly if you believe data has been exposed or your account has been compromised.

7. International transfers

Some providers or infrastructure may process personal data outside the UK. Where a restricted transfer applies, we will rely on an applicable UK adequacy decision or another lawful transfer mechanism, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

Where required, we assess the transfer and use appropriate supplementary measures and contractual, technical, or organisational safeguards. You can contact us for more information about the relevant safeguards for a particular processing activity.

8. Cookies and analytics

Leadsmith uses necessary cookies and similar storage for functions such as referral attribution, dashboard access, and remembering a dismissed lead-capture prompt. We also use first-party server-side pageview and event measurements, and may use Meta Pixel or platform analytics to understand site usage and campaign performance. These technologies may record information such as pages visited, device details, approximate network information, and actions taken. You can control cookies through your browser settings; disabling them may affect some features.

9. Your UK GDPR rights

Subject to the conditions and exemptions in data-protection law, you may ask us to:

• provide access to the personal data we hold about you;
• correct inaccurate or incomplete data;
• erase data or restrict processing;
• provide a portable copy of data you supplied to us;
• object to processing based on legitimate interests; and
• withdraw consent where consent is the lawful basis.

To exercise a right, contact us at leadsmith-31@polsia.app. We may need to verify your identity and will respond within the time required by law. If your request concerns lead data supplied by an agency, we may refer you to that agency as controller.

10. Complaints

Please contact us first so we can investigate your concern. You can also complain to the UK Information Commissioner's Office (ICO), the supervisory authority for UK data protection: ico.org.uk/make-a-complaint.

11. Changes to this notice

We may update this notice when our service, providers, or legal obligations change. The latest version will be published at /legal/privacy with its updated date.