Privacy Policy

The data controller is LeakIQ Ltd (company number 17311148), registered at 195 Wood Street, London E17 3NU, United Kingdom.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC187738.

For questions about this policy contact support@leakiq.io.

Account data. When you create a LeakIQ account we collect your name, business email address, company name and a hashed password. Personal email domains are rejected at registration.

Integration credentials. When you connect a third-party system (Stripe, Xero, Salesforce, etc.) we store the credentials needed to make read-only API calls. All credentials are encrypted at rest using AES-256-GCM.

Workspace and operational data. We store the revenue issues, recovery cases, audit log entries, approval decisions and evidence records generated by your use of the platform. This data belongs to your workspace and is processed on your behalf.

Usage data. We collect standard server logs including IP addresses, browser type, pages visited and timestamps, and may collect pseudonymised, aggregated analytics data to improve the product.

Communications. If you contact us via email or our contact form, we retain the content of that communication.

Cookies. We use essential cookies to maintain your session and limited analytics cookies. See our Cookie Policy for details.

We use the data we collect to:

• Create and manage your workspace account
• Provide the LeakIQ platform, detecting revenue issues and managing recovery workflows
• Process payments and manage your subscription
• Send transactional emails (account creation, password reset, billing receipts)
• Respond to your support enquiries
• Improve and develop the platform through pseudonymised, aggregated usage analytics
• Meet our legal and compliance obligations
• Detect and prevent fraud, abuse or security incidents

We do not sell your personal data. We do not use your data for profiling or automated decision-making that produces legal effects.

• Contract performance (Article 6(1)(b)). Processing your account and workspace data is necessary to provide the service you have signed up for.
• Legitimate interests (Article 6(1)(f)). We process usage and analytics data to improve the platform and detect abuse. Our legitimate interests do not override your rights.
• Legal obligation (Article 6(1)(c)). We may process data to comply with applicable law, including tax, accounting and fraud prevention obligations.
• Consent (Article 6(1)(a)). Where you have accepted analytics cookies, we process the associated data on the basis of your consent. You may withdraw consent at any time via your cookie preferences.

We share personal data only with the following sub-processors:

• Vercel Inc., cloud infrastructure and hosting. Application compute is pinned to the eu-central-1 (Frankfurt) region, so your data is processed in the EEA; Vercel is a US company, and standard contractual clauses cover any support access from the US.
• Neon Inc., PostgreSQL database provider. Your data is stored at rest in the EEA (AWS eu-central-1, Frankfurt); Neon is a US company, and standard contractual clauses cover any support access from the US.
• Resend Inc., transactional email delivery.
• Stripe, Inc., billing and payment processing for your LeakIQ subscription. Subscription and billing data only, never your revenue-recovery data. Processed globally under standard contractual clauses and, where applicable, the Data Privacy Framework. This is separate from any Stripe account you connect to LeakIQ as a data source.
• Upstash, Inc., rate limiting on login, password reset and detection runs. Processes your IP address and workspace identifier transiently. Data is processed in the US under standard contractual clauses.
• Functional Software, Inc. (Sentry), server-side error and performance monitoring. Receives exception stack traces and request diagnostics, tagged with a workspace identifier, so we can diagnose failures. Personal-data capture is not enabled. Data is stored in Sentry's EU region (Frankfurt). Sentry's parent company is US-based, so any support access from the US is covered by standard contractual clauses.
• Anthropic PBC, AI-assisted drafting in the issue assistant. Off unless your workspace turns it on, and every workspace starts with it off. Where enabled, it receives the description, metadata and figures of a revenue issue, never credentials and never a bulk export. Data is processed in the US under standard contractual clauses.
• Google LLC, website analytics (Google Analytics). Active only if you accept analytics cookies. Data may be processed in the US under appropriate safeguards.
• LinkedIn Ireland Unlimited Company, advertising measurement (LinkedIn Insight Tag). The tag is present on the site and loads only if you accept advertising cookies. We are not currently running any LinkedIn advertising. Data may be processed outside the UK under appropriate safeguards.
• OpenAI, L.L.C., advertising measurement (the ChatGPT Ads measurement pixel). The pixel is present on the site and loads only if you accept advertising cookies. We are not currently running any ChatGPT advertising. Where supported details are present on a page they are hashed in your browser before transmission, so OpenAI does not receive the raw values. Data may be processed outside the UK under appropriate safeguards.
• Your connected systems. We make read-only API calls to the systems you connect. We do not share your data with those providers beyond what is required for the API call itself.

These marketing and analytics recipients receive website-visitor data only. They are not given access to your workspace or revenue-recovery data. The sub-processors that handle customer data under our Data Processing Agreement are listed separately on the Sub-processors page.

We never sell your personal data. Beyond the analytics and advertising cookies you choose to accept (Google Analytics, the LinkedIn Insight Tag and the ChatGPT Ads measurement pixel, described in our Cookie Policy), we do not share your data with third parties for their own marketing. We may disclose data to law enforcement or regulatory authorities where required by law.

We may contact people in finance roles at UK companies about LeakIQ. To do this we use your name, job title, work email address and the company you work for.

We get these details from public sources, such as company websites, and from business contact directories such as Hunter.io. Some directories predict a work email address from a company's usual email format. We keep a note of where we found your details.

We use this information only to contact you about LeakIQ and our free revenue leakage report. Our lawful basis is legitimate interests (Article 6(1)(f)): telling businesses about a service that may help them recover revenue, balanced against your rights. We never sell your details.

One of our current email sequences also records whether a message was opened, so that we can tell whether our messages are arriving at all. We are switching this off: no sequence started after October 2026 records it, and we do not record whether you clicked a link in any of them. You can object to this at any time by replying "no".

We keep your details for 12 months from our last contact with you, then delete them, unless you become a customer.

You can object at any time. Reply "no" to any of our emails, or write to support@leakiq.io. We will stop immediately and add your email address to a suppression list, which holds only what we need to make sure we do not contact you again.

We retain your personal data for as long as your workspace subscription is active. On cancellation or trial expiry:

• Workspace data (issues, recovery cases, connector data) is deleted on request, within 30 days of the request. You can also delete it yourself at any time from Settings, Security, without contacting us.
• The audit log is retained. It is a tamper-evident hash chain in which each entry is cryptographically linked to the one before it, so removing entries would destroy the integrity of the records that remain. It holds a record of actions taken, not your billing or customer data, and personal identifiers in it are pseudonymised on erasure.
• Account data (name, email) is retained for up to 12 months after workspace deletion for fraud prevention and legal compliance, then deleted.
• Server logs and pseudonymised analytics data may be retained for up to 24 months.

You may request earlier deletion by contacting support@leakiq.io.

Under UK GDPR you have the right to:

• Access, request a copy of the personal data we hold about you
• Rectification, ask us to correct inaccurate or incomplete data
• Erasure, request deletion where there is no legitimate reason to continue processing
• Restriction, ask us to restrict processing in certain circumstances
• Portability, receive your data in a structured, machine-readable format
• Objection, object to processing based on legitimate interests
• Withdraw consent, where processing is based on consent, withdraw it at any time without affecting prior processing

Email support@leakiq.io to exercise any of these rights. We will respond within one calendar month.

If you are not satisfied with how we handle your request, you may lodge a complaint with the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We implement appropriate technical and organisational measures, including:

• AES-256-GCM encryption of all integration credentials at rest
• TLS encryption for all data in transit
• Read-only, scoped API connections to your connected systems
• Workspace-level data isolation, no data crosses workspace boundaries
• Immutable, hash-chained audit logs for all platform actions
• Role-based access controls within each workspace

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with UK GDPR Article 33.

We use essential cookies to operate the platform and limited analytics cookies to understand how the site is used. See our Cookie Policy for full details and how to manage your preferences.

We may update this policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of LeakIQ after changes take effect constitutes acceptance of the updated policy.

• Email: support@leakiq.io
• Post: LeakIQ Ltd, 195 Wood Street, London E17 3NU, United Kingdom

To lodge a complaint: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. ico.org.uk