Which third-party services process my data, and where is it hosted?
The Privacy Policy names the eight providers that run the core of the service under 3. Who Processes It. Each one only handles the data it needs to do its job. The infrastructure runs primarily in the United States.
The eight providers
- Supabase: the database and your sign in.
- Render: hosting for the application.
- Stripe: payments, so card details never reach Legiit Leads.
- Brevo: the transactional emails the service sends, such as alerts and digests. A backup email provider can stand in for it, so some of those emails may leave through a second sender.
- Google: business search results and website performance data.
- Anthropic: the AI writing and analysis behind your emails, briefs and checks.
- SerpApi: search ranking data.
- Twilio: call tracking and recording, through the credentials you supply yourself. Call recordings and transcripts pass through Legiit Leads so they can be classified.
The site analytics that counts page visits is covered in does Legiit Leads use cookies or trackers.
The GDPR Statement at /gdpr points to that same list under 6. Sub-processors as the current one, and says it will be updated as providers change. So the list on the Privacy Policy page is always the one to check, not a copy kept elsewhere.
Where your data is hosted
The infrastructure runs primarily in the United States. If you or your leads are in the EEA or the UK, that means personal data may be transferred internationally.
Where that happens, Legiit Leads and its providers rely on appropriate safeguards such as Standard Contractual Clauses. This is set out under 5. International Transfers in the GDPR Statement.
Twilio is the one provider on the list that only comes into play if you choose it. Until you connect your own Twilio account for call tracking, no call data exists to process.
Still stuck?
A real person on the Legiit team will help. No bots, no runaround.
Contact Supporthelp@legiit.com