Using leads responsibly.
Last updated 22 October 2026.
The leads are business contact details that companies published themselves. How you use them is up to you, and the law of your country and of the country you contact decides what is allowed. This page sets the rules we expect you to follow and gives a plain summary of the common legal points. It is not legal advice; if you are unsure, ask a lawyer.
What you must do
- Write to businesses, about business. Your message must be relevant to the recipient's business activity.
- Be honest. Say who you are, why you are writing, and how you got the address. Do not disguise your identity, use a false sender name or a misleading subject line.
- Make it easy to say no. Include a simple way to opt out, and honour it quickly, within a few days at most. Keep your own do-not-contact list and apply it.
- Respect removal requests. If a business tells you to stop, or we tell you it asked to be removed, stop and do not contact it again.
- Keep the data safe. Store the CSV securely, share it only with people in your business who need it, and delete what you no longer need.
What you must not do
- Send bulk unsolicited email in ways that break the anti-spam laws that apply, or send anything fraudulent, deceptive, defamatory, illegal or abusive.
- Contact consumers or private individuals with these lists. They are meant for businesses.
- Resell, publish or share the lists, or use them to build or feed another directory, database or lead-selling product.
- Scrape or automatically copy the service, or try to get around limits, the pool, or the checks.
- Use the lists for phone, SMS or messaging campaigns where the law needs prior consent you do not have.
- Share your account, or use the service to harm HighLevel Inc., its customers or the businesses in the directory.
The common rules in short
- United States (CAN-SPAM). Business email is allowed without prior consent if you do not mislead, you identify yourself with a real postal address, and you honour opt-outs within 10 business days. Rules for calls and texts (TCPA, Do-Not-Call) are stricter.
- European Union and United Kingdom (GDPR, ePrivacy, PECR). Writing to a generic business address (info@, sales@) of a company is generally treated as business-to-business. Addresses of named people, and the addresses of sole traders and some partnerships, can count as personal data; you need a lawful basis, must tell the person where you got the data and how to object, and must stop when they object. We pass on only general role addresses for companies in these regions, but the final responsibility is yours.
- Canada (CASL). One of the strictest regimes. You normally need consent, but there is a limited allowance for a business address that is published without a notice that says “no unsolicited messages”, and only for messages relevant to the person's role. Identify yourself and include an unsubscribe.
- Elsewhere. Check the local rules before you write. Some countries require prior consent or registration, or ban cold email.
If you break the rules
We may suspend or end your account and ask you to delete the data. You are responsible for complaints, claims and penalties that result from your outreach. If a business complains about you, we may share your details with it or with the authorities where the law requires.
Reporting a problem
If you receive a lead you think should not be in the directory, or you see misuse of the lists, tell us by replying to any email from us. Businesses can use the removal page.