1. Who controls your data
Frontage Leads is the controller of personal data described in Part A. Contact: hello@frontageleads.com.
Paddle.com Market Ltd is a separate controller for payment and tax data, as merchant of record. We never see your full card number. See Paddle's privacy notice.
Part A — Data about you, our customer
| What | Why | Lawful basis (GDPR) | Kept for |
|---|---|---|---|
| Email address | To identify your account, send receipts and service notices | Contract | Life of the account, then 30 days |
| Password hash (scrypt) | To let you sign in. We never store the password itself | Contract | Life of the account |
| Plan, subscription status, Paddle IDs | To give you what you paid for | Contract | Life of the account, then 7 years for tax records |
| Monthly export and audit counts | To apply plan limits fairly | Contract | 24 months |
| Account events (signup, plan change, export) | Support, billing disputes, abuse | Legitimate interests | 24 months |
| Report branding you enter (business name, logo, pitch) | To brand your reports | Contract | Until you delete it |
We do not run advertising trackers and we never sell or share your browsing behaviour. Two cookies can exist. The session cookie that keeps you signed in is strictly necessary and is always set. The Google Analytics cookie, which lets us count visits and see which pages get read, is set only if you press Allow on the bar at the foot of the page — decline it, or ignore it, and the analytics script is never loaded at all. To change your answer, clear this site’s data in your browser and the bar comes back.
Who we share it with
Paddle (payments and tax), our server host (Hostinger International Ltd.), Google Analytics (visit statistics, and only for visitors who allowed it), and nobody else. We do not sell customer data. We will disclose data if a court with jurisdiction over us orders it, and we will tell you unless we are prohibited from doing so.
Where it is processed
The Service runs on servers in Kuala Lumpur, Malaysia. We are established in Pakistan, which does not currently benefit from a UK or EU adequacy decision; transfers to us therefore rely on the standard contractual clauses and on the transfer being necessary to perform your contract.
Your rights
Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or export it in a portable form. Email hello@frontageleads.com and we will answer within 30 days. Deleting your account removes your email, password hash, branding and usage rows; anonymised billing records are kept where tax law requires it. If you are in the EU or UK and are unhappy with our answer, you may complain to your national supervisory authority.
Part B — The business database
The product is a database of businesses, assembled from openly licensed public sources — principally the Overture Maps Foundation (CDLA-Permissive-2.0) and All The Places (CC0-1.0), as detailed on our data licensing page.
What is in it
Business name, category, street address, city, region, country, coordinates, business telephone number, website address, and where the business publishes one, a business email address — typically a role address such as info@, sales@ or contact@.
What is deliberately not in it
- Named individuals, job titles or personal profiles.
- Direct dial numbers or personal mobile numbers.
- Personal email addresses of employees.
- Anything scraped from social or professional networks.
We do not enrich, append or cross-reference records to build pictures of people. That is a deliberate product decision, not an oversight.
Where a business record is still personal data
For a sole trader or a partnership, the business name, address and contact details may also be personal data under GDPR and similar laws. Where that is the case we rely on legitimate interests (Article 6(1)(f)) — making already-public business contact information findable for legitimate B2B purposes — having weighed that against the limited privacy impact of information the business itself published in order to be contacted.
Because the data was not collected from the individual, Article 14 applies: this page is our notice. We have not contacted every business individually because doing so for millions of records would involve disproportionate effort, which Article 14(5)(b) recognises.
If you are a business owner and want your record removed
Email hello@frontageleads.com with the business name and address. We will suppress it from our copy within 30 days and keep it suppressed through future imports. Please note we are not the origin of the data: to have it removed at source, contact Overture Maps or the original publisher, otherwise it will continue to appear in other products built on the same open data.
Part C — Customers' own use of exported data
Once you export records, you become the controller of that copy. Sending marketing to it is your decision and your legal responsibility under the anti-spam and privacy rules that apply where you and the recipient are. We say this plainly at the point of export rather than in a footnote.
Security
Passwords are hashed with scrypt and never stored or logged in plain text. All traffic is over HTTPS. Access to the server is restricted to key-based administrator login. We do not store payment card details at any point.
If a breach affects your personal data and is likely to result in a risk to you, we will tell you and the relevant regulator within 72 hours of becoming aware of it.
Children
The Service is for business use and is not directed at anyone under 18. We do not knowingly collect data from children.
Changes
We will update this page when our practices change, and the "last updated" date above will always reflect it. Material changes are emailed to active customers.