Privacy policy

This policy explains how HeyLead Attribution ("we", "us") handles personal data when you visit our website, create an account, or use the HeyLead Attribution service to track visits and leads on your own website.

There are two kinds of personal data in this policy:

• Customer data: information about you and your team as users of HeyLead (account, billing, support). For this data we are the controller.
• Visitor and lead data: information about people who visit our customers' websites and fill in their forms. For this data our customer is the controller and we are their processor. We only use it to provide the service to that customer, as described in our Data Processing Addendum.

If you visited a website that uses HeyLead and have a question about your data, please contact that website first. They decide how it is used. We will help them answer you.

• Account details: name, email address, password (stored only as a secure hash) or your Google sign-in, workspace name, time zone and team members you invite.
• Billing details: plan, billing period and subscription status. Payments are handled by Polar, our merchant of record. We never see or store your full card number.
• Websites you add: domain names, site settings and the forms HeyLead detects.
• Support and contact: messages you send us through the contact form or email, and newsletter sign-ups.
• Usage and security logs: sign-in times, IP address at sign-in and basic request logs kept by our hosting providers to protect the service.

When a customer adds the HeyLead script to their website, it collects:

• The page address, page title, referring website, UTM tags and ad click IDs (such as gclid or fbclid).
• A random visitor ID and visit ID stored in first-party cookies and local storage on the customer's own domain. See Cookies and data collection.
• Device type, browser and screen size, and the visitor's country, which is worked out from the IP address at the moment of the request. IP addresses are not stored.
• When someone submits a form, the answers in that form (for example name, email, phone and message), so the customer can see which channel the lead came from. The script never reads password, payment card or file-upload fields.

Website owners can turn on consent mode so nothing is stored or sent until the visitor accepts their cookie banner.

We do not sell personal data, use it for advertising, or use visitor and lead data from one customer for any other customer.

We use a small number of service providers to run HeyLead. Each only receives what it needs and is bound by a data processing agreement. The current list, with what each one does and where, is on our Subprocessors page.

We may also share data if required by law, to protect our rights or users, or as part of a merger or sale of the business, in which case this policy will continue to apply.

If you connect a webhook, Zapier or CRM, HeyLead sends lead data to the destination you chose. That transfer happens on your instructions.

Our providers operate globally, so data may be processed outside your country, including in the United States. Where data from the EU, UK or Switzerland is transferred, we rely on our providers' Standard Contractual Clauses or other approved safeguards.

• While your account is active, we keep your data so your reports work.
• You can delete any lead at any time from its page. This also deletes that visitor's recorded visits.
• After your plan ends, your data stays available read-only for 90 days so you can export it or come back. It is then permanently deleted.
• Backups are kept for up to 30 days, so deleted data disappears from backups within 30 days of deletion.
• Billing records are kept by Polar and by us for as long as tax law requires.

Data is encrypted in transit and at rest, access is limited to people who need it, and passwords and API keys are stored only as hashes. Details are on our Security, backup and restore page.

Depending on where you live, you can ask us to access, correct, export or delete your personal data, or object to or restrict how we use it. You can also withdraw consent, for example by unsubscribing from the newsletter.

To make a request, email hello@heylead.io. We answer within 30 days. If you are a visitor to a customer's website, we will pass your request to that customer and help them respond.

You also have the right to complain to your local data protection authority.

California residents: we do not sell or share personal information for cross-context behavioural advertising.

HeyLead is a business tool and is not meant for anyone under 16. Customers must not use it on websites aimed at children.

If we make a material change, we will email account owners and update the date at the top of this page before it takes effect.

Email hello@heylead.io. We reply within one business day.