Privacy Policy

Last updated: July 2026

What we collect

Lead Recorder collects website visitor behaviour data (pages visited, referrer, UTM parameters, device type) and lead submission data (name, email, form page) on behalf of our customers. This data is stored per-site and only accessible to the site owner.

No cookies

Our tracking snippet does not use cookies. Session data is stored in the visitor's browser using localStorage and is never shared with third parties.

Google user data

Lead Recorder integrates with your Google Account to sign you in and, if you choose to connect them, to pull marketing data from Google Ads, Search Console, and Google Business Profile. This section explains exactly what Google user data we access, how we use it, who we share it with, how we protect it, and how long we keep it.

What we access

Sign in with Google: your name, email address, and profile picture, used only to create and authenticate your Lead Recorder account.

Google Ads, only if you connect it: the account IDs and names of the Ads accounts you choose to link, and click-level data (campaign name, ad group name, search term) for the specific Google Click IDs (gclids) tied to leads captured on your own site.

Google Search Console, only if you connect it: the list of verified properties in your account (to match one to your site), and search analytics data (search queries, clicks, impressions) for pages on your connected site.

Google Business Profile, only if you connect it: your business account and location identifiers.

We never request access to your Gmail, Drive, Contacts, or any other Google data beyond what's described above.

How we use it

We use Google user data solely to attribute leads captured on your website (form submissions and phone clicks) to the marketing channel that produced them — for example, matching a lead's click ID to the Google Ads campaign and keyword that generated it, or matching an organic lead's landing page to the Search Console query that likely drove it. We do not use Google user data for advertising, profiling, or any purpose unrelated to providing this attribution feature to you.

Sharing, transfer, and disclosure

We do not sell Google user data, and we do not share, transfer, or disclose it to any third party, except: to Google Cloud Platform / Firebase, our infrastructure subprocessor, strictly to host and store it on our behalf; at your explicit direction (for example, when you export your own leads); or where required by law. We never share Google user data with advertisers or use it for ad personalisation. Lead Recorder's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Protecting sensitive data

OAuth refresh tokens are encrypted at rest (AES-256-GCM) before storage and are only ever decrypted in memory when needed to call a Google API on your behalf. Access tokens are never persisted — they are requested fresh from Google for each sync and discarded immediately after use. All traffic to and from Google's APIs is encrypted in transit over HTTPS/TLS, and access to a site's connected integrations is restricted to that site's admin-role users.

Retention and deletion

We retain an encrypted refresh token only for as long as the corresponding integration stays connected. Disconnecting an integration from your dashboard settings immediately revokes the token with Google and permanently deletes it from our database. Deleting a site or your account deletes all of its Google integration data as part of that deletion. Attribution data already resolved onto a lead (a campaign name or search query, for example) is retained for as long as the lead itself, per Data retention below, and is removed when that lead or your account is deleted.

Your account data

When you create an account, we store your email address and hashed password (or, if you sign in with Google, your name, email, and profile picture — see Google user data above). We do not sell or share your personal information with third parties.

Data retention

Lead data is retained for as long as your account is active. You can delete your account and all associated data at any time by contacting us.

GDPR and your data protection rights

Lead Recorder's tracking script runs on websites belonging to our customers, some of whom have visitors in the EU or UK. Here's how that works under GDPR.

Controller and processor

When it comes to visitor and lead data captured by the tracking script on a customer's website, that customer is the data controller — they decide to run the script and are responsible for having a lawful basis and appropriate disclosure for their own visitors. Lead Recorder acts as their data processor, handling that data only to provide the service and on their instructions. For your own Lead Recorder account data (your email, login, and billing details), we're the controller.

Lawful basis

We process account data under contract (to provide the service you've signed up for) and connected Google data under consent (you explicitly authorise each integration and can revoke it at any time). Our customers are responsible for the lawful basis they rely on to track their own site visitors.

Your rights

If you're a Lead Recorder customer, you have the right to access, correct, export, or delete your account data at any time — email us and we'll action it. If you're a visitor to one of our customers' websites and want to exercise a right over data captured about you (access, deletion, objection), the fastest route is to contact that website directly, since they control the data; we'll assist them in fulfilling the request. You can also contact us directly at hello@leadrecorder.com and we'll help route the request.

Sub-processors and international transfers

We use a small number of sub-processors to run Lead Recorder: Google Cloud Platform / Firebase (hosting and database), Vercel (application hosting), and Stripe (payment processing). Where these providers process data outside your region, they do so under their own GDPR-compliant transfer mechanisms (such as Standard Contractual Clauses).

Contact

Questions about privacy? Email us at hello@leadrecorder.com.