Your data, explained clearly.

This Privacy Policy explains how Leadbury (“we”, “us”), the platform at leadbury.com, collects, uses, stores and shares personal data, including data we receive from Google APIs. Contact us about privacy at [email protected] or through the contact page.

• Account data: your name, email address and the workspace roles you hold.
• If you sign in with Google or Apple: your name, email address and the account identifier the provider shares. Apple may give a private relay address that forwards to you. We never receive your Google or Apple password.
• Business data you provide: the brief, website address, plans, creatives and other content.
• Your business contact details for your website: phone number, email for enquiries, address with its map point, opening hours and links. Your website shows them publicly; you choose whether the address and map appear.
• Requests you send us from leadbury.com: messages from the contact page (name, email, website and message) and waitlist requests (name, email, website and type of business), with contact details stored encrypted, to answer you and to send your invitation. We keep a waitlist request until you create your account or ask us to remove it.
• Messages you type in the AI chat on leadbury.com, as described in “AI chat” below.
• Enquiries that visitors send through websites built with Leadbury, on behalf of the business that owns the website. Contact details in enquiries are stored encrypted.
• Website statistics for leadbury.com and for websites built with Leadbury, counted in aggregate without cookies on visitors’ devices, visitor IDs or stored IP addresses. Visits by people signed in to Leadbury, and from devices of our team or of a website's owner that carry the mark described in “Cookies”, are left out.
• Billing data when you accept a proposal: company details and VAT number; payments are processed by Mollie, we do not receive card numbers.
• Technical data: server logs with IP address, browser and time, used for security and kept for up to 30 days.

Sign in with Google

If you choose “Continue with Google”, Google shares your name, email address, profile picture and Google account ID with Leadbury (scopesopenid email profile). We use them only to sign you in to your Leadbury account and show your name in it. The sign-in tokens Google returns are stored encrypted with your account and deleted with it. This gives Leadbury no access to your Google Ads, Gmail or other Google data.

Google Ads

Leadbury accesses Google Ads data through the Google Ads API in one of two ways:

• Your own account. You connect a Google Ads account you own by signing in with Google and granting access on Google’s consent screen (Google Ads API scopehttps://www.googleapis.com/auth/adwords), or by accepting a link request from Leadbury’s Google Ads manager account (MCC). The account and its billing stay yours.
• An account Leadbury runs for you. We open a Google Ads account for your business under our manager account (MCC) and pay Google for your ads.

Connecting is optional; Leadbury works without it. The rules below apply in both cases.

What we access

• Google Ads account information: customer ID, account name, currency, time zone, status and links to manager accounts.
• Billing status: whether payment is set up and the account can serve ads. We do not receive card or bank details.
• Campaign settings: campaigns, ad groups, ads, keywords, assets, budgets, bidding strategies and conversion actions.
• Performance reports: impressions, clicks, cost, conversions and similar metrics by date, campaign, device and location.
• OAuth access and refresh tokens that let Leadbury act within the access granted: yours if you signed in with Google, or those of Leadbury’s manager account.

How we use it

• To show your advertising results in your Leadbury dashboard and reports.
• To create, change, pause or resume the campaigns, budgets and ads that you (or a person you authorised) approve in Leadbury, and to keep spending within your limits.
• For an account Leadbury pays for: to invoice your advertising budget and show the actual cost.
• To let Leadbury’s AI marketer explain your results and propose changes when you ask it to.
• To detect problems with your campaigns and keep the service secure.

We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalised artificial-intelligence or machine-learning models. People at Leadbury read it only when you ask us to (for example for support), when needed for security, or when the law requires it.

How we store and protect it

• Google Ads data is stored in our database on servers in the European Union. Access is limited to your workspace and the team members you authorise.
• OAuth tokens are stored encrypted and are used only by the part of Leadbury that talks to Google Ads.
• Connections use HTTPS. Database backups are encrypted and kept for up to 30 days.

Who we share it with

• Members of your workspace and the Leadbury team members you assign to your account.
• Service providers that run Leadbury for us, only as needed to provide the features you use: our hosting provider (Hetzner, servers in Germany), Cloudflare (network security and delivery), Resend (delivery of the emails we send you, such as password resets: it receives your email address and the email), Geoapify (address search in the brief and the map image of your business location, once enabled: it receives the address text you type and your business’s map point, never data about visitors of your website) and, when you use AI features, AI model providers reached through OpenRouter under terms that do not allow training on your data and require zero data retention.
• Authorities, if the law requires it.

We do not share Google user data with anyone else.

Keeping and deleting it

We keep Google Ads data while the account is connected to Leadbury. When you disconnect Google Ads in Leadbury or close your Leadbury account, we revoke our access, remove the link to our manager account and delete the Google Ads data we stored within 30 days; encrypted backups expire within a further 30 days. For accounts Leadbury pays for, we keep cost and invoice records for as long as tax law requires. You can also remove Leadbury’s access at any time in your Google Account permissions or by removing the manager link in Google Ads.

The chat in the corner of our website is answered by Lea, an AI assistant, not a person. It answers questions about Leadbury and can prepare a waitlist request for you to check and send.

• Your messages are sent to an AI model (DeepSeek V4.1 Flash) through OpenRouter, only to providers that may not collect your messages or train on them and that keep no data after answering (zero data retention).
• Your browser keeps the conversation for the open tab; closing the tab clears it. We do not store the conversation while you chat. Our server records only technical usage (time, cost and a fingerprint of the request, not its text) for budgets and abuse protection. Besides the usual server logs described above, the chat uses your IP address only as a hash, in memory, to limit how many messages can be sent.
• If you send a request from the chat, we store your name, email, website, type of business, goal, the package you chose and a short summary the assistant wrote and you confirmed, encrypted, and add you to the waitlist. We keep it like a waitlist request: until you create your account or ask us to remove it.
• The conversation itself is stored only if you tick “Share this conversation with the team”: encrypted, for 30 days, then deleted automatically.
• Please do not share passwords, card or bank details, health data or identity documents in the chat; they are not needed.

We rely on your request to answer you and to prepare an invitation, and on your consent for sharing the conversation, which you can withdraw by writing to [email protected].

We use personal data to provide the service you asked for (plans, websites, campaigns, enquiries, reports and billing), to keep Leadbury secure, to answer your messages and to meet legal obligations. Under the GDPR we rely on the contract with you, our legitimate interest in a secure and working service, your consent where we ask for it, and legal obligations.

We do not sell personal data. We share it only with providers that run Leadbury for us (hosting, network security, email delivery through Resend, AI processing through providers that may not train on your data, payments through Mollie once enabled) and with the advertising platforms that run your ads. Resend delivers our emails (waitlist confirmations, invitations, password resets, email confirmations, payment receipts and messages to our team) and receives the recipient’s address and the email’s content. Resend and some AI providers may process data outside the European Union, for example in the United States, under appropriate safeguards such as the EU Standard Contractual Clauses.

Address search and maps: when you type your business address, our server asks Geoapify (OpenStreetMap data, EU data centres) for matching addresses. The map on your website is an image our server makes once and serves from your website itself, so visitors never connect to a map provider. The directions link opens Google Maps only when a visitor clicks it.

Data is stored on servers in the European Union. Each business’s data is isolated from other customers, enquiry contact details and access tokens are encrypted, and backups are encrypted. We keep account data while your account is open and delete it within 30 days after closure, unless the law requires us to keep records such as invoices for longer.

Leadbury uses only essential cookies, for example to keep you signed in. We do not use advertising or tracking cookies. You can review your choices on the privacy choices page.

One more cookie, lb_internal, keeps our own visits out of visit statistics. It is set only on the devices of Leadbury's team, of members of our own workspace and of website owners who ask for it: by itself when a team member opens Leadbury signed in, or when the device's owner turns it on in Leadbury or opens a link from their account on that device. It holds only “1” or “0” and no identifier, is not used to recognise anyone and lasts one year. For our team it is sent to leadbury.com and to websites on its subdomains; for a website owner, only to their website. Visitors never receive it.

You can ask for a copy of your data, its correction or deletion, restriction of or objection to processing, and data portability. Write to [email protected]. You can also complain to your data protection authority. Leadbury is not intended for children under 16.

We will announce material changes to this policy in the platform or by email.

Questions about privacy or your data: [email protected], or the contact page.