LeadLegWork.

Current

Privacy notice

What LeadLegWork collects, why, who else handles it, and how long it’s kept.

Effective date: October 21, 2026 · Version 2026-10-21

Who is responsible

“LeadLegWork,” “we,” and “us” mean Lucas Hull, doing business as LeadLegWork, based in New York, United States. Contact us at support@leadlegwork.com.

Who this service is for

LeadLegWork is an invitation-only business tool for adult business users in the United States. It helps website builders find business prospects, review source information, prepare sample websites and outreach drafts, and manage their own workflow. It is not designed for children.

Information handled

Sources and information about businesses

Discovery uses Overture Places and its contributors and OpenStreetMap. Overture data is read from public cloud storage for the map area of a search. OpenStreetMap data comes from state files downloaded from Geofabrik; no search details are sent to them. Optional cross-checks send the ZIP codes of a scan’s results to public city open-data portals. None of these sources receives account details. OpenStreetMap records carry ODbL attribution and share-alike requirements. We do not keep mapper usernames or infer personal email addresses. Users may add and independently verify business details. Public availability does not guarantee accuracy or authorize every use. Users are expected to record sources and review facts before using them in a demo or outreach. See source licenses and notices. A user-requested PageSpeed check measures a page; it does not verify business identity, contact permission, or sales interest.

How information is used

We use information to provide and secure accounts, run discovery and workspace features, prepare user-reviewed outputs, manage subscriptions, provide support, prevent misuse, and meet legal obligations. We do not send outreach for users. The user chooses whether to copy a draft and send it through another service. We do not sell personal information or use it for targeted advertising.

Who else handles information

We use these service providers only as needed to run the service:

Public data sources receive search areas or ZIP codes as described above. Site launches to Netlify or Vercel are switched off; if they’re offered later, they’ll run only when a user starts one with their own provider token, and this notice will be updated first. We do not use advertising pixels or cross-site analytics. We may disclose information when required by law or when necessary to protect the service and people.

Cookies and browser storage

The app uses a session cookie and a security (CSRF) cookie for sign-in and account protection, and a short-lived cookie while you review updated policies. They are HTTP-only and SameSite; the session expires after 14 days. Browser notification preference is stored locally only if the user enables preview alerts. The lead library stores the time of the previous visit in browser storage to mark leads added since then; it is not sent to the server. There are no analytics or advertising cookies.

Retention and deletion

Account and workspace records are kept while the account exists. Users can delete a single lead, or their whole account and workspace, from within the app, and can export workspace data at any time. Deletion removes the live records and files at once. Deleted information can remain in backups until they are replaced: the app’s daily backups (the newest 14 are kept) within about two weeks, and the hosting provider’s weekly server backups within about four weeks. A deleted business that asked not to be contacted keeps a minimal record (its catalog identifier and any opted-out email address) so it is not contacted or re-added. Service usage days are deleted after about 400 days. Stripe keeps billing records under its own policies and tax-record rules, and support emails are kept as long as needed to handle the request. To ask for access, correction, or deletion, email support@leadlegwork.com; we may need to verify your identity.

Security

The service uses HTTPS everywhere, separate workspaces for each account, salted password hashing, expiring sessions, and access controls. The server accepts administrator access only with a security key (no passwords), a firewall allows only web and administrator traffic, the application runs in an isolated container without administrator rights, operating-system security updates install automatically, and data is backed up daily. No internet service can promise perfect security. If you suspect an account or privacy issue, email support@leadlegwork.com promptly. If a breach affects your information, we’ll notify you as the law requires.

Your choices and rights

Users can review and export workspace information and correct their settings in Account. Anyone may ask us to access, correct, or delete their information using the contact above, and we aim to respond within 30 days. Depending on where you live and whether a privacy law applies to us, you may have additional rights such as portability or opting out of certain processing; we’ll explain how they apply to your request.

Changes and contact

We’ll post any revised notice with its effective date. When a change is material, the product will ask account holders to review it. Send privacy questions to support@leadlegwork.com.