Privacy notice
Who we are
This website is run by Leapr Limited, trading as Leapr (“we”, “us”), a company registered in England and Wales, company number 17512642. Our registered office is 152 Barnsbridge Grove, Barnsley, S70 3RW. We are the data controller for the information described here, registered with the ICO under reference ZC278683. You can contact us at hello@leapr.co.uk.
What we collect
When you book a free consultancy call, we collect your name and email address, and, if you choose to give them, your phone number, your business name and what you would like help with. We also record the date and time you sent the form.
When you fill in Get started, we collect your answers about your business: what you do, the services you offer, your business name, the town you work from and the area you cover, and, if you give them, your colours, the design you like and anything else you tell us. If you give us links to your current website or your social media pages, such as Facebook, Instagram or your Google Business Profile, we look at them to learn about your business before we build. If you upload a logo or photos of your work, we keep those too. Before we store a photo, we remove the hidden details some cameras add to it, such as the place it was taken. If you start a plan, we also collect what we need to build and run your website, such as your phone number, the email address for enquiries, your opening hours, your domain and your ICO registration number if you have one, and we record which version of our terms you agreed to and when.
When you create an account, we collect your name, your email address and a password, plus the plan, payment option and design you choose. We never store your password itself, only a scrambled version of it that can’t be turned back into the password. If you sign up or log in with Google, Google shares your name, your email address and your Google account number with us. We never see your Google password.
If you set up a passkey, we store its public key, which lets us check that it’s you when you log in. Your fingerprint, face or device PIN never leave your device.
If you turn on 2-step verification with an authenticator app, we store the app’s secret key, encrypted, and your recovery codes only in a scrambled form we can’t read back.
Do you have to give us your details?
We need your name and email address to reply to you. To make your free preview we need what you do, your business name (or your own name) and the town you work from. To create an account we need your name, your email address and either a password or a Google account. Everything else is optional.
Why we use it
We use these details to reply to you, arrange the call and talk about your enquiry. If you fill in Get started, we use your answers, logo and photos to make a free preview of your home page and, if you go ahead, to build your website. We email you about your preview and your website, including one reminder if you haven’t started a few days after your preview; every reminder has a link to stop them. If you create an account, we use your details to create and run your account, keep you logged in and protect it, for example by pausing log ins for 15 minutes after 10 wrong passwords in a row. To do this, we count wrong passwords for each email address typed in, saved in a scrambled form rather than as the address itself, and keep that count for no more than 24 hours. We won’t add you to a mailing list, and we will never sell or rent your details.
To protect our forms and log ins from misuse, our server counts how many requests come from each internet address. It keeps that count in memory for no more than an hour and never saves it. Our server doesn’t keep a log of the internet addresses that visit.
Our legal basis
We use your details to take steps you have asked for before a possible agreement with you, and to provide the account you asked for (UK GDPR, Article 6(1)(b)). We rely on our legitimate interests (Article 6(1)(f)) when you contact us on behalf of a company or someone else, and when we keep your enquiry for up to 12 months in case you come back. We also rely on them to protect accounts and forms from misuse, and to send you one reminder about your preview. Those interests are answering business enquiries, keeping a short record of them, keeping accounts secure and following up on a preview you asked for.
If you pay for a plan, we use your details to provide it under our agreement with you (Article 6(1)(b)). We keep the records of your payments because UK tax and company law requires it (Article 6(1)(c)).
If you accept analytics cookies, we rely on your consent for the analytics described under Analytics, if you agree (Article 6(1)(a)). You can withdraw it at any time in Cookie settings.
You can object to us using your details on the basis of our legitimate interests at any time by emailing hello@leapr.co.uk.
Where it is stored and who can see it
Your enquiry and your account are stored on a server we rent from OVHcloud, in a data centre in the UK. Our hosting partner, ETOMM DROPSALE S.R.L. (NextBuilders AI) in Romania, helps us look after that server. Romania is in the European Economic Area, so this is covered by the UK adequacy regulations for the EEA. They handle your details only to provide their service to us.
We send our emails through Resend, an email service. It receives your email address and the emails we send you, such as your preview and updates about your website. We get notes about your enquiry, your preview and your plan by email in our own inbox, which runs on Google Workspace. Emails you send us are kept there too.
When you pay for a plan, our payment provider, Stripe, takes the payment by Direct Debit. On a monthly plan, Stripe keeps a Direct Debit mandate for your setup fee and monthly payments. If you pay once, the Direct Debit is for that single payment only. Stripe receives your name, your email address, your billing address and your bank details. We get your name, your business name, your billing address and whether the payment went through, but we never see your full bank account details. Stripe also uses some of these details for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy.
If you accept analytics cookies, PostHog receives the details described under Analytics, if you agree. PostHog, Inc. handles them for us as our processor, on its EU cloud in Frankfurt, Germany.
Resend, Stripe and Google are based in the United States, so your details may be handled there. Each is certified under the UK Extension to the Data Privacy Framework between the EU and the US, which UK law recognises as giving adequate protection. If that ever changes, we rely on the safeguards in their data processing terms, such as the UK Addendum to the EU standard contractual clauses.
If your business uses the Leapr CRM, the accounts you connect to it also mean other providers handle data for it. They are Google (Gmail and Google Calendar), Microsoft (Outlook), Meta (Facebook, Instagram and WhatsApp), Twilio (text messages and phone calls) and ElevenLabs (the AI receptionist that answers calls). Resend also receives the emails your customers send to your business through the forwarding you set up, and keeps them for 30 days.
Microsoft, Meta, Twilio and ElevenLabs may also handle details in the United States. Where a provider is certified under the UK Extension to the Data Privacy Framework, we rely on that. Otherwise, we rely on the safeguards in their data processing terms, such as the UK Addendum to the EU standard contractual clauses.
Apart from these providers, and anyone the law requires us to tell, we don’t share your details with anyone, and we never sell or rent your details. If you log in with Google, Google’s own privacy policy covers your Google account. Your free preview has a private link: anyone you share that link with can see it.
How long we keep it
If we don’t end up working together, we keep your enquiry for up to 12 months, so we have the context if you come back to us, and then delete it. You can ask us to delete it sooner at any time. We keep your account while you use it. If you don’t go ahead with a plan, we delete it after 12 months without a log in, together with your answers, your logo, your photos and your free preview. You can ask us to delete your account at any time. If you leave after having a plan, we delete your data within 30 days of the handover, and from our backups within a further 14 days, apart from the records of what you paid us. We keep the records of what you paid us, such as invoices and payments, for at least 6 years after the end of the financial year they belong to, because UK law requires it. When we delete an account that never paid us, we also ask our payment provider, Stripe, to delete the customer record it holds for you. We keep daily backups for 14 days, so anything we delete is gone from them within 14 days. If you accept analytics cookies, PostHog keeps the analytics data, including replays, for up to 12 months, then deletes it. The keys that let Leapr use the accounts you connect are deleted as soon as you disconnect them, or when we delete your account.
If a business uses Leapr to handle your details
Some businesses use Leapr to run their website forms, their CRM or office tasks, such as answering enquiries. If you contact one of those businesses, that business is the controller and we are its processor. We handle your details only on its instructions, under our terms with that business. Its own privacy notice explains how it uses your details. To ask about your details or use your rights, please contact that business. If you contact us instead, we will pass your request on to it.
If you connect your accounts to Leapr
If your business uses the Leapr CRM, you can connect your own accounts to it, so you can see and answer your customers in one place. You choose what to connect, and you can disconnect it at any time in Settings. Here is what we receive from each one and what we do with it.
Google (Gmail and Google Calendar)
If you connect Gmail, Google lets Leapr send emails from your Gmail address. We use this only to send the emails you or your team write in Leapr, and the messages you have set Leapr to send, such as invoices and reminders. Leapr can’t read, change or delete the emails in your Gmail. To bring your customers’ replies into Leapr, you set up forwarding in Gmail to an address we give you. You choose this, and you can turn it off at any time.
If you connect Google Calendar, Leapr creates one calendar called Leapr in your Google account and adds your bookings to it. It also checks when you are busy in your other calendars, so it doesn’t book over them. It sees only busy and free times, never the details of your other events.
Google gives us your name, your email address and your Google account number, plus a key that lets Leapr do these things. We keep that key encrypted.
Leapr’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide the features you see in Leapr and choose to use.
- We don’t sell it, we don’t use it for advertising, and we don’t use it to train AI models.
- We don’t let anyone read it, unless you ask us to, for example for support, or we need to for security or to follow the law.
- We don’t share it with anyone, apart from the providers that help us run Leapr, listed under Where it is stored and who can see it.
Microsoft (Outlook)
If you connect an Outlook or Microsoft 365 mailbox, Microsoft lets Leapr send emails from it and read the emails that arrive in it. Leapr checks new emails and brings into the CRM only the ones from people, not newsletters, mailing lists or automatic messages. The ones it doesn’t bring in are not kept anywhere. We keep the key Microsoft gives us encrypted.
Other email accounts
If you connect another email account with its server details, you give us a password for that mailbox, which we keep encrypted. Leapr uses it only to bring in emails, as with Outlook, and to send your replies.
Facebook, Instagram and WhatsApp
If you connect a Facebook Page, an Instagram account or a WhatsApp Business number, Meta sends Leapr the messages people send to it, with their name and account number, or their WhatsApp phone number. Leapr uses them to show the conversations in the CRM and to send your replies. We keep the key Meta gives us encrypted. To remove this connection and ask us to delete the data, see Data deletion.
Text messages
If you use text messages in Leapr, we set up a UK phone number for your business with our provider, Twilio. Leapr sends your messages through it and receives the replies. If someone replies STOP, Leapr stops sending them text messages.
When you disconnect
When you disconnect an account in Settings, we delete the key that gave Leapr access. Where the provider allows it, we also ask it to cancel that access. The messages already in your CRM stay there, because they are part of your business’s records, until you delete them or your account.
Your rights
You can ask to see your data, correct it, delete it, limit how we use it, receive a copy to take elsewhere, and object to how we use it. Email hello@leapr.co.uk and we will reply within one month. We don’t make automated decisions about you. You can also withdraw your consent to analytics at any time in Cookie settings, at the bottom of every page.
If your business connected Facebook, Instagram or WhatsApp to the Leapr CRM, our data deletion instructions explain how to remove that connection and have its data deleted.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first at hello@leapr.co.uk. We’ll acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commission (the ICO) at ico.org.uk or on 0303 123 1113.
Analytics, if you agree
If you accept analytics cookies, we use PostHog to see how people use our site, so we can find what is confusing or slow and make it better. Nothing is set and nothing is sent to PostHog until you accept. If you reject them, or close the banner without choosing, PostHog stays off.
PostHog then records the pages you visit, the page you came from, the buttons and links you click, how quickly the pages load, and your browser, type of device and screen size. It also keeps a replay of your visit, so we can see where people get stuck. Anything you type into a form is hidden from the replay. PostHog also receives your internet address, as every website does, and uses it to work out your rough location, such as your town or country.
We also count a few steps, such as starting the booking form, choosing a plan or reading an article to the end. These steps never include what you type, your name, your email address or your phone number. On the pages you see once you’re logged in, such as your account and checkout, PostHog records only the pages you open and those steps, with no replay. If your browser sends a Do Not Track signal, PostHog stays off even if you accept.
We use these details only to improve our site. We don’t use them for advertising, we don’t build a profile of you, and we never sell them. Our legal basis is your consent (UK GDPR, Article 6(1)(a)).
PostHog, Inc. handles this data for us as our processor, on its EU cloud in Frankfurt, Germany. PostHog says this data stays in the EU. PostHog is a US company, so if your details are ever handled outside the UK and the EU, we rely on the safeguards in PostHog’s data processing terms.
The PostHog cookie expires 6 months after your last visit. PostHog keeps the analytics data, including replays, for up to 12 months, then deletes it. We ask for your choice again after 6 months.
You can change your mind at any time in Cookie settings, at the bottom of every page. If you withdraw your consent, PostHog stops, and we clear what it saved in your browser. This doesn’t affect what was collected before.
Cookies
We use cookies and similar storage in your browser for two things. Some are strictly necessary for the site and your account to work, so they don’t need your consent. Analytics cookies from PostHog are used only if you accept them. The cookie __Host-leapr_session keeps you logged in for up to 30 days, or until you log out. When you log in with Google, a second cookie, __Host-leapr_oauth, protects that log in for up to 10 minutes. When you log in with a passkey, a third cookie, __Host-leapr_passkey, links that log in to your browser for up to 5 minutes. After you enter your password, __Host-leapr_2fa remembers it for up to 30 minutes while you finish 2-step verification. All four are strictly necessary for your account to work, so they don’t need your consent. We use no cookies for advertising.
As each page loads, it checks a few things on your device: your screen size, whether you use a mouse or a touch screen, your browser type and whether ‘reduce motion’ is on. It uses them only to lay out the page and tone down the animations. These checks stay on your device, and nothing is saved or sent to us. If you accept analytics cookies, PostHog separately records your screen size and browser, as described under Analytics, if you agree. To turn the animations off, switch on ‘reduce motion’ in your device settings. Your browser may also keep a note to always use a secure connection to our site, and copies of our pages so they load faster.