Privacy policy.
Last updated 22 October 2026.
This page explains what we do with the personal data of the people who use GHL Lead Central (our customers). Information about the businesses in the directory is described on how we handle business data.
What we collect about you
- Account: your email address, when you created the account, when you last signed in.
- Use of the service: your plan, your filters, which leads were sent to you and when, your pool of leads, your automatic-send settings (the email address you chose and the start date), and simple events such as signing in, downloading a CSV, or starting a checkout.
- Payments: handled by Stripe. We receive a customer and subscription identifier, your plan and status, and the end date of the paid period. We never see or store your card number.
- Email records: a log of the emails we send you (such as sign-in links and lead emails) and whether they were delivered.
- Technical data: your IP address and browser details in server logs and for protection against abuse, such as limiting repeated sign-in requests.
Why we use it, and on what basis
- To sign you in, provide the leads and run your plan: it is needed to perform our contract with you.
- To take payments, keep accounting records and meet legal duties: legal obligation and contract.
- To keep the service secure, prevent abuse and fix problems: our legitimate interest in running a safe service.
- To send you the emails that belong to the service (sign-in links, your leads, billing notices): contract. You can switch off the weekly lead email from the link inside it; sign-in and billing emails cannot be switched off.
- We do not sell your data and we do not use it for advertising.
Who receives it
- Stripe for payments.
- Our email provider to deliver emails to you (and to the address you choose for automatic sending).
- Our hosting and infrastructure where the service runs.
- Authorities, if the law requires it.
If any of these are located outside your country, the transfer is protected by the safeguards the law requires, such as standard contractual clauses.
How long we keep it
- Sign-in links expire after 15 minutes and can be used once; a sign-in session lasts up to 30 days.
- Your account data and your delivery history are kept while your account exists, so that you never receive the same business twice.
- When you ask us to delete your account (reply to any email we send you) we delete your account data. Payment records are kept as long as accounting law requires. Backups are overwritten within about 30 days.
Your rights
Depending on where you live you can ask to see, correct, export or delete your data, to restrict or object to some uses, and to withdraw consent where we rely on it. You can also complain to your data protection authority. To use a right, reply to any email we send you; we answer within one month.
Security
Sign-in links and sessions are stored only as one-way hashes, connections are encrypted, and access to the admin area is limited to named people. No system is perfectly secure; if there is a breach that affects you, we will tell you and the authorities as the law requires.
Children
The service is for businesses and is not directed to anyone under 18.
Changes
If we change this policy in a way that matters, we will tell you before it applies.