Legal
Privacy Policy
Last updated: October 21, 2026
1. Who we are
CertLeads.com ("CertLeads", "we", "us") is a B2B lead-generation service. We detect websites within hours of their launch by watching public Certificate Transparency logs, and we surface the public business information those websites publish so that other businesses can reach them.
The data controller for the processing described here is [LEGAL ENTITY NAME], [registered address]. For any privacy matter, write to privacy@certleads.com.
This policy covers two groups of people: the businesses whose public information appears in our directory, and the visitors and customers who use CertLeads. Each section says which group it applies to.
2. Data we collect about businesses
Every lead in CertLeads starts from a public source. We collect:
- Newly issued certificates — observed in public Certificate Transparency (CT) logs, which are operated by Google, Cloudflare, Let's Encrypt and others and are publicly auditable by design. A certificate tells us that a domain has just gone live; nothing more.
- Public website content — the page title, description, language, country, the platform the site is built on (WordPress, Shopify, Wix and so on), SEO indicators and a thumbnail, read from the site's public homepage and a small number of public pages such as
/contactand/about. We record the page we read each fact from and when we read it, and both appear in every export. - Business contact information published on the site — email addresses, phone numbers and links to public social profiles. This includes shared mailboxes such as
info@and, where the business publishes them, the work email addresses of named people at the business. We grade each address (see section 5) and prefer a named work address over a shared mailbox when a customer asks for one contact per lead. We do not collect personal email addresses that are unrelated to the business, and we do not collect home addresses or identification numbers. - Domain registration metadata — registration date, registrar and whether WHOIS privacy is enabled, used to confirm a domain is genuinely new. Personal WHOIS fields (registrant name, email, phone, organisation and country) are held internally for that check only and are never shown in the directory, returned by our API, or included in any export. Database access rules enforce this, not just application code.
- Verification verdicts — when a customer verifies an email address (section 5), the verdict (valid, invalid or risky) and the time of the check are stored on the lead.
3. Data we collect about you
If you visit or use CertLeads, we collect:
- Account data — your email address, a hashed password (we never see the plain text), your plan, and your activity in the product: contact reveals, exports and the leads they contained, saved searches, saved leads, API keys you create, and email-verification token balance and spend.
- Payment data — handled by Stripe. We store your Stripe customer ID, subscription status and invoice references. We never see or store full card numbers.
- Messages you send us — support and contact-form messages, opt-out requests, and the email address you give us when you ask to be notified about the launch.
- Email delivery events — whether an email we sent you bounced or was reported as spam, so we stop sending to addresses that cannot or do not want to receive mail.
- Technical and analytics data — described in section 10.
4. How we use the data
- To build and maintain the directory of newly launched businesses.
- To classify and enrich each lead with category, platform, language, SEO score, freshness tier and contact quality.
- To deliver the product: directory browsing, contact reveals, CSV exports, saved searches with email alerts, the Domain Feed, and the API for plans that include it.
- To limit how often a lead is sold. Each lead is delivered to at most three customers, and we record which customer received which lead so that no customer is delivered, or charged for, the same lead twice.
- To run accounts, billing and customer support.
- To receive, verify and honour opt-out and removal requests.
- To detect abuse, prevent fraud and keep the service secure.
- To measure how the website is used, in aggregate (section 10).
5. Email verification
Customers can check whether a business email address accepts mail before contacting it. When a customer runs a verification, we send the address to our verification provider, MillionVerifier, which checks the receiving mail server and returns a verdict. No message is sent to the address. We store the verdict on the lead so that it is not checked again for another customer, and we never store or share the result beyond that verdict and its date.
An address that comes back as undeliverable is excluded from contact filters and exports from then on, so it is not sold as a working contact.
6. Lawful basis for processing
We process business contact information on the basis of legitimate interest in enabling business-to-business outreach. Our assessment rests on the following:
- The information is published by the business itself, on its own public website, for the purpose of being contacted.
- What we surface is limited to business contact details: work email addresses, business phone numbers and public social profiles. Not personal addresses, personal phone numbers or identification numbers.
- Outside the countries listed in section 8 — including every country in the European Union and the European Economic Area — we surface only impersonal company contacts, such as an info@ address or an office line, and never a person’s name, personal email address or mobile number.
- A free, public and permanent opt-out is available at /opt-out (section 11).
- Every customer accepts our Terms of Service, which require them to comply with the outreach laws that apply to them (CAN-SPAM, CASL, PECR and equivalents) and prohibit consumer marketing and harassment.
For account holders we also process data to perform our contract with you and to meet legal obligations such as tax and accounting record-keeping. Analytics runs on the basis of legitimate interest in understanding how the site is used; see section 10 for how to opt out.
7. Data retention
- Lead records — a business stays listed while its website remains live and within scope. Every lead shows when we first saw the site, and leads are labelled by freshness tier so that age is visible rather than hidden. A lead whose owner opts out is removed from the directory, the API and all future exports, and is never re-added by a later crawl.
- Opt-out records — kept indefinitely, so that we can prove a request was honoured and keep the domain out of future crawls.
- Account data — kept while your account is active. When you delete your account from the account page, your profile, subscriptions, saved searches, saved leads, reveals, API keys, feed history and purchase records are deleted at once, and any live subscription is cancelled. Stripe remains the system of record for invoices, which we are required to keep for tax purposes.
- Operational logs — records of emails we sent, webhook deliveries, payment-event ledgers and feed deliveries are deleted after 90 days by a nightly job.
8. Country scope
CertLeads lists business metadata (domain, title, category, platform and SEO signals) for websites worldwide. For businesses in the United States, Canada, Australia, New Zealand, the United Kingdom, Singapore, the United Arab Emirates and India we surface the business contact details the business publishes — email addresses and phone numbers.
For businesses in any other country, including every country in the European Union and the European Economic Area, and for businesses whose country we cannot determine, we surface only impersonal company contacts: generic role addresses such as info@ or sales@ on the company’s own domain (or on a free email service, only where the business is a registered company and the address is clearly not a person’s), fixed-line, toll-free and shared-cost company phone numbers, and company social pages. We never show names, job titles, personal email addresses, mobile or personal phone numbers, or personal social profiles for these businesses, and a business that appears to be a sole trader, or whose website is named after a person, shows no contact details at all. The same rule applies in the directory, the API and every export, and contact filters and counts include only contacts we will actually show.
11. Your rights
Subject to the law that applies to you, you may access, correct, port, restrict or delete personal data we hold about you, object to our processing of it, and lodge a complaint with your data protection authority.
If your business is listed and you want it removed, submit the domain at /opt-out. We email you a confirmation link to verify the request; once verified, we review and remove the domain within 7 days. Removal covers the directory, the API and every future reveal and export, and is permanent: the domain is never re-added by a later crawl. If you are a California resident, this same form is how you tell us not to sell or share your information.
If you have an account, you can update your details and delete your account, with everything listed in section 7, from your account page. For a copy of the data we hold about you, or any other request, email privacy@certleads.com from the address on your account. We answer within 30 days.
12. Security
Data is encrypted in transit (TLS) and at rest. Database access is restricted by row-level security rules so that the browser can never read contact details or internal fields directly, export download links are signed and expire, and access to internal systems is limited to authorised people. No system is perfectly secure; if a breach materially affects you, we will notify you without undue delay.
13. Children's data
CertLeads is a business service and is not directed to anyone under 16. We do not knowingly collect data about children. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes to this policy
When we change this policy, the "Last updated" date at the top changes with it. We notify account holders of material changes by email at least 14 days before they take effect.
15. Contact us
Privacy questions, data requests and compliance matters: privacy@certleads.com.
To remove a business from CertLeads, use /opt-out — it is the fastest route and creates a verified record of the request.