Security and privacy
Privacy and data handling in Leadnote
See what data Leadnote handles, who controls it, how long it is kept, how the cookie banner on the website works, and where to read the legal pages.
Leadnote stores your business contacts, so this article explains in plain words what data it handles, who decides what happens to it, and which controls you have. It is a summary. The privacy policy on the Leadnote website is the legal text and the one that counts.
What data Leadnote handles
| Kind of data | Examples | Who decides what is in it |
|---|---|---|
| Account details | Your name, company, email address, and your password stored only as a salted hash | You, when you sign up or are invited |
| Workspace content | Leads, customer details, tasks, quotes, invoices, notes, files | You and your team |
| Usage data | Pages visited, features used, device and browser type, approximate location from the network address | Leadnote, to run and improve the service |
| Contact form messages | What you write to Leadnote through the website's contact page | You |
For the leads and customer details in your workspace, you decide what to collect and why. Leadnote processes them on your instructions as your service provider. You are responsible for having a lawful reason, including consent where the law requires it, to contact those people. Read sending limits and consent before you run campaigns.
How your account is protected
- Passwords are never stored in readable form, and sign-in is rate limited. Changing a password signs out other sessions by default.
- You can add a second step with two-factor authentication. The authenticator secret is stored encrypted and recovery codes are stored only as one-way hashes.
- You can review every open session and your sign-in history, and sign out any device.
- Leadnote emails you about sensitive events such as a new device sign-in or a password change.
- Account Owners and Managers can read the audit log of changes made in the organisation.
- Who sees which leads inside your organisation follows roles and, if you turn them on, list based access rights and team visibility.
Cookies and the consent banner
The Leadnote app uses essential cookies to keep you signed in and, if you choose it at the code step of sign-in, to remember a trusted browser. These are needed for the app to work.
The public website can also use optional analytics and advertising tools. When it does, and your region requires consent, a banner titled Your privacy choices appears with two buttons:
- Essential only loads nothing optional. Pressing Escape on the banner does the same.
- Accept all allows the optional analytics and advertising tools.
Nothing optional loads, and no optional provider is contacted, until you choose. Your choice is saved in your browser for a limited time, after which you are asked again. To change your mind sooner, select Cookie settings in the website footer, which reopens the banner. The link shows only when the website uses optional tools. If your browser sends a Do Not Track or Global Privacy Control signal, the website can treat that as a refusal, depending on how it is set up.
The banner does not appear when the website has no optional tools switched on.
How long data is kept
| Data | How long |
|---|---|
| Workspace data | While your account is active |
| After an organisation is deleted | Deleted after a 7 day cancellable grace period, usually within minutes of the deletion starting |
| After a user deletes their own account | Personal details removed immediately |
| Subscription invoices and payment records | 8 years after the end of the financial year, as tax and accounting rules require, without contact details |
| Your sign-in history | One year |
| Encrypted backups | Older copies stay until they are overwritten as backups rotate |
| Contact form messages | Up to 24 months, according to the privacy policy |
The full explanation of what is erased and what is kept is in delete your account or organisation.
Your controls
| You want to | Do this |
|---|---|
| Take a copy of your data | Export leads and download a backup |
| Delete your personal data | Settings, My Profile, Delete your account and data |
| Delete the whole organisation | Account Owner only, Settings, Data Management |
| Stop optional cookies | Cookie settings in the website footer |
| Make a rights request (access, correction, objection) | Use the contact page on the Leadnote website |
The legal pages
These pages are on the Leadnote website, linked from its footer:
- Privacy policy at
leadsnote.com/legal/privacy - Terms of service at
leadsnote.com/legal/terms - Refund policy at
leadsnote.com/legal/refund - Delete account at
leadsnote.com/delete-account, which explains deletion for people who cannot sign in
The legal pages are written in English, even when the rest of the website is shown in another language. Legal wording is kept in one language so a translation cannot change its meaning.
On the mobile app
On the Leadnote mobile app, signing out wipes the app's local copy of your data. The same happens when your session is ended from somewhere else, for example when you sign the phone out from the web, as described in sessions and devices.
Frequently asked questions
Does Leadnote sell my data?
No. The privacy policy states that Leadnote does not sell personal information. It shares data only with infrastructure and communication providers that help run the service, and where the law requires it.
Who owns the leads I store in Leadnote?
You do. You own the leads, customer details and files you add. Leadnote hosts and processes them only to run the service for you, and you can export them at any time.
How do I change my cookie choice?
Select Cookie settings in the footer of the Leadnote website. It reopens the banner so you can choose Essential only or Accept all again. The link appears only when the site uses optional tools.
How do I ask for my personal data to be corrected or deleted?
You can delete your own account from your profile. For other requests, use the contact page on the website. The privacy policy says requests are answered within 30 days.