Privacy Policy
This policy explains what personal data Leasyd collects, why, who we share it with, and the choices you have. It covers our website (www.leasyd.com), the Leasyd app (app.leasyd.com) and our APIs.
1. Who we are
Leasyd is operated by Leasyd Ltd, a company registered in England and Wales (company number 17285875), whose registered office is at 4-6 Greatorex Street, London, England, E1 5NF ("we", "us"). We are the controller of the personal data described in this policy under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For privacy questions, email support@leasyd.com.
2. Our two roles
- Controller of the data about our customers and their users that we need to run accounts, bill and support them, and of website visitors' data. This policy covers that data.
- Processor (or service provider) of the telemetry our customers send us (logs, traces, metrics and check results, "Customer Data"). It may contain personal data about our customers' own users; we process it only to provide the Service, under our Terms. If your data is in a Leasyd customer's telemetry, please contact that customer: they decide what is sent and how it is used.
3. What we collect
| Data | Examples | Source |
|---|---|---|
| Account data | Email address, company name, role (owner or member), who invited whom, sign-in records | You, or the teammate who invited you |
| Billing data | Billing name, email and address, tax ID, subscription status, invoices. Card details are collected and held by Stripe, never by us | You, through Stripe |
| Usage data | Amount of data received, stored and dropped per day, check runs, searches, features used | The Service |
| Technical data | IP address and request details when you sign up, sign in or call our APIs | Your browser or systems |
| Communications | Emails you send us and our replies | You |
| Customer Data | Whatever telemetry a customer sends (see section 2) | Our customers' systems |
Our website has no analytics, advertising or tracking scripts.
4. How we use it
| Purpose | Data | Legal basis (UK GDPR) |
|---|---|---|
| Create and run your account, sign you in, send account emails (invitations, passwords, trial notices) | Account, technical | Contract |
| Measure usage, bill and collect payment | Usage, billing, account | Contract; legal obligation (tax and accounting) |
| Keep the Service secure, prevent abuse (for example, limiting sign-ups per IP address) and enforce our Terms | Technical, usage, account | Legitimate interests |
| Support you and answer questions | Communications, account, usage | Contract; legitimate interests |
| Operate, troubleshoot and improve the Service | Usage, technical | Legitimate interests |
| Tell you about important changes to the Service, prices or these terms | Account | Contract; legitimate interests |
We don't sell personal data, use it for advertising, or use Customer Data to train AI models. We don't make decisions with legal or similarly significant effects about you by automated means alone.
5. Who we share it with
We share personal data only with the service providers below, who process it on our behalf under contract, and where the law requires (for example, a valid court order).
| Provider | What for | Location |
|---|---|---|
| Amazon Web Services, Inc. | Hosting, storage and processing of all data, including Customer Data; sign-in (Amazon Cognito); account emails (Amazon SES); AI features may also run Anthropic's Claude models on Amazon Bedrock | United States (us-east-1) |
| Anthropic, PBC | AI features ("Ask Leasyd AI"): runs the Claude models that answer your questions. Only when you use them, and only the question and the parts of your Customer Data the assistant reads to answer it are sent. Under Anthropic's commercial terms it does not train models on this data | United States |
| Stripe Payments UK, Ltd. and Stripe, Inc. | Payments, invoices, subscriptions, tax IDs; Stripe also acts as a controller for fraud prevention and its legal obligations (Stripe's privacy policy) | United Kingdom, United States |
| Google LLC (Google Fonts) | Serves the fonts of our website; your browser sends your IP address to Google when it loads them | United States |
| GoDaddy.com, LLC | Our email (support@leasyd.com and other leasyd.com addresses): correspondence with you | United States |
We'll update this list before we start using a new sub-processor for Customer Data. If we're involved in a merger, acquisition or sale of assets, personal data may be transferred to the new owner, who will be bound by this policy.
6. Where it's stored
Leasyd runs on AWS in the United States (us-east-1), so your personal data is transferred from the UK to the United States. Each transfer is protected under the UK GDPR: by the UK Extension to the EU-U.S. Data Privacy Framework (the "UK-US data bridge") where the recipient is certified, or otherwise by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with additional safeguards such as encryption. You can ask us for a copy of the safeguards that apply.
7. How long we keep it
- Customer Data: 30 days plus the current day (UTC), then deleted automatically; all of it within 30 days of an account being closed.
- Account data: while the account is open, and up to 90 days after it is closed. A removed user's login is deleted when they are removed.
- Billing and usage records: as long as tax and accounting law requires (6 years after the end of the financial year they relate to, under UK law).
- Sign-up records and security logs: up to 90 days, unless needed to investigate abuse.
- Emails with us: up to 3 years after our last exchange.
8. Security
Data is encrypted in transit (HTTPS) and at rest. Each customer's data is stored separately, and queries run with credentials limited to that customer's data. API keys are stored only as hashes; synthetic check secrets are encrypted with a dedicated key. Access to production systems is limited to the people who need it. No system is perfectly secure: if a breach affects your personal data, we will tell you and the authorities as the law requires.
9. Cookies and browser storage
The website sets no cookies. The app keeps your sign-in session and preferences (such as light or dark theme and saved views) in your browser's local storage; they are needed for the app to work and are not used for tracking. Payment pages hosted by Stripe use Stripe's own cookies for fraud prevention.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict how we use it, and to withdraw consent where we rely on it. California residents may also ask what personal information we collect and how we use it; we do not sell or share it for cross-context behavioural advertising. To exercise a right, email support@leasyd.com; we'll answer within one month and may need to confirm your identity. You may also complain to the UK Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to address your concern first.
If your request is about Customer Data, we'll pass it to the customer concerned and help them answer it.
11. Children
Leasyd is a service for businesses and is not directed at children. We don't knowingly collect personal data from anyone under 16.
12. Changes to this policy
We'll post any changes on this page and update the date above. For material changes we'll also tell account owners by email before they take effect.
13. Contact
Leasyd Ltd, 4-6 Greatorex Street, London, England, E1 5NF. Email: support@leasyd.com.