Lyre Leads
Lyre Leads
This Privacy Policy explains how Lyre Leads ("we," "us," or "our") collects, uses, stores, and protects personal data when you use our platform at lyreleads.com ("Service").
We are committed to protecting your privacy and processing your personal data in accordance with the EU General Data Protection Regulation (GDPR), the Danish Data Protection Act (Databeskyttelsesloven), and other applicable data protection legislation.
The data controller responsible for your personal data is:
Lyre Leads
Website: lyreleads.com
Email: [email protected]
When you create an account, we collect your name, email address, and password (stored as a one-way cryptographic hash, we cannot read it), along with your account creation date.
As you use the Service, we collect search queries you submit, lead data you retrieve and store, token consumption history, AI evaluation requests and results, enrichment requests and results, and filter/sort preferences saved in your session.
Payment is handled by Stripe, a PCI DSS-compliant payment processor. We do not store your full card number or CVV. We retain your Stripe customer ID, subscription plan and status, billing history, and the last 4 digits of your card on file (as provided by Stripe).
We automatically collect your IP address at login and key actions, browser type and version, operating system, pages accessed and timestamps, and error logs. This data is used for security, abuse prevention, and service reliability.
We keep a first-party, cookieless record of page requests to our public website so we can understand which channels people find us through. For each page request we store the page path, the referring site, any campaign (UTM) parameters in the link, the country supplied by our CDN, and whether the request came from a known bot or crawler.
We do not store your IP address or your browser's user-agent string in this record, and we set no cookie for it. To count visitors without identifying them, we derive a short one-way hash from the IP address and user-agent combined with a secret value that changes every day. The hash cannot be reversed, and because the daily secret changes, records from different days cannot be linked together. These records are retained for 180 days and then deleted. No third-party analytics provider is used, and this data is never shared or sold.
If you contact us, we retain those communications to resolve your enquiry and improve the Service.
When you use Lyre Leads to search for and store business leads, the platform retrieves and stores data about third-party businesses, including business names, addresses, phone numbers, email addresses, social media profiles, and website intelligence data.
This data relates to businesses, not consumers. However, some data points, particularly email addresses of sole traders or named business contacts, may constitute personal data under GDPR. You, as the user, are an independent data controller for lead data you retrieve and use. You are responsible for ensuring your use complies with applicable data protection law. We process this data as your data processor to provide the Service, and additionally as an independent controller for the aggregated business datasets described below.
Aggregated business datasets (Lead Lists). We aggregate, deduplicate, enrich, and verify business listing and business contact information collected through the operation of the Service, and offer the resulting curated datasets ("Lead Lists") to users as one-time purchases. This applies only to information about third-party businesses (business names, addresses, phone numbers, websites, business contact details, and website intelligence). It never includes your account data, files you upload, or your private notes and settings. For this aggregation and licensing we act as an independent data controller on the basis of legitimate interests (Art. 6(1)(f) GDPR).
Opt-out for business contacts. If you are a business or a named business contact and want your details excluded from Lead Lists, email [email protected] with the subject line "List Opt-Out" or use the opt-out option at lyreleads.com/lists. Suppressed addresses are excluded from all future Lead List deliveries.
| Data Type | Legal Basis |
|---|---|
| Account registration and management | Performance of contract (Art. 6(1)(b)) |
| Providing Service features | Performance of contract (Art. 6(1)(b)) |
| Payment processing | Performance of contract (Art. 6(1)(b)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Service improvement and debugging | Legitimate interests (Art. 6(1)(f)) |
| Transactional emails (receipts, alerts) | Performance of contract (Art. 6(1)(b)) |
| Product update or marketing emails | Legitimate interests or consent (Art. 6(1)(f)/(a)), opt out anytime |
| Aggregating business contact data into Lead Lists | Legitimate interests (Art. 6(1)(f)), opt out anytime |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
We use collected data to create and manage your account, deliver Service features, process payments, send transactional and product emails, detect and prevent fraud and abuse, debug and improve the platform, and comply with legal obligations. We do not sell your personal data to third parties.
| Third Party | Purpose |
|---|---|
| Stripe | Payment processing, stripe.com/privacy |
| SerpAPI | Business data retrieval, serpapi.com/privacy |
| OpenAI | AI relevance checking, openai.com/privacy |
| Render | Server hosting and infrastructure, render.com/privacy |
| Cloudflare | CDN and DDoS protection, cloudflare.com/privacypolicy |
| MillionVerifier | Email address verification, millionverifier.com/privacy-policy |
In addition, business listing and business contact information may be included in Lead Lists purchased by other users, as described in Section 4. We do not share your account data with any other third parties except where required by law.
Some of our third-party service providers are located outside the EEA, including in the United States. Where we transfer data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.
| Data Type | Retention Period |
|---|---|
| Account and profile data | Duration of account + 30 days after deletion |
| Lead database (searches and enrichment) | Duration of account + 30 days after deletion |
| Payment and billing records | 5 years (accounting and tax compliance) |
| Security and access logs | 90 days |
| Support communications | 2 years |
As a data subject under the GDPR, you have the following rights:
To exercise any of these rights, contact us at [email protected] with the subject line "Data Subject Request." We will respond within 30 days and may ask you to verify your identity.
You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet): datatilsynet.dk / [email protected].
Strictly Necessary: Session cookies required for the Service to function (login sessions, security tokens). These cannot be disabled.
Functional / Preference: Cookies that remember your settings within the platform (saved filters, column preferences).
We do not currently use third-party advertising cookies or tracking pixels on our own platform pages. Our website traffic measurement (section 3.5) sets no cookie at all. You can control cookies through your browser settings, though disabling strictly necessary cookies will prevent the Service from functioning.
We implement appropriate technical and organisational measures to protect your data, including bcrypt password hashing, HTTPS/TLS encryption for all data in transit, and access controls limiting who can access production systems. No security measures are 100% guaranteed. In the event of a data breach likely to result in high risk to your rights, we will notify you and the relevant supervisory authority as required by law.
Where lead data you collect constitutes personal data under GDPR:
If you require a formal Data Processing Agreement (DPA) signed by both parties, contact [email protected].
The Service is not intended for individuals under 18 years of age. If you believe we have inadvertently collected data from a minor, contact us at [email protected] and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice in the platform at least 14 days before the change takes effect. Continued use after changes take effect constitutes your acceptance of the updated policy.
Email: [email protected]
Website: lyreleads.com
Response Time: Within 5 business days
Version 2.1, August 2026