VisitLead privacy policy
Version of 13 November 2026.
1. Who we are
Quantum Liquid LLC, a company governed by the laws of Wyoming, 30 N Gould St, Ste R, Sheridan, WY 82801, United States of America, operates the VisitLead service ("VisitLead" or "the Service"). Contact for any question about personal data: hello@visitlead.io.
VisitLead helps a business (the "Customer") find out which companies visit its website, and be notified when a contact it already knows returns to its website. VisitLead never identifies an unknown person, does not buy data about people and does not sell any data.
This policy applies with regard to the Swiss Federal Act on Data Protection (Swiss FADP, revFADP), the General Data Protection Regulation (GDPR) for persons located in the European Union, the EEA or the United Kingdom (UK GDPR), and US state privacy laws, in particular the California Consumer Privacy Act as amended by the CPRA (CCPA).
2. Two different roles
VisitLead processes data in two roles, and this policy distinguishes between them throughout:
| Data | Role of Quantum Liquid LLC | Who decides |
|---|---|---|
| Customer accounts: people who sign in to VisitLead, subscriptions, settings, Service emails | Controller | Quantum Liquid LLC |
| Global opt-out list of the /optout page | Controller | Quantum Liquid LLC |
| Visits to a Customer's website: page views, company recognised by its network, contacts known to the Customer and their returns | Processor ("service provider" within the meaning of the CCPA) | The Customer, as controller |
For visitors to a Customer's website, the Customer is the controller: it installs the VisitLead tag, chooses its settings and informs its visitors in its own privacy notice. VisitLead acts on its instructions, under the Data Processing Agreement (DPA) available on visitlead.io. A person visiting a Customer's website may contact the Customer or VisitLead, which will forward the request to the Customer.
3. Customer data (VisitLead as controller)
3.1 Account
VisitLead does not manage passwords. Sign-in goes through the Lead account (ERPlead), the identity service shared by the Lead applications (erplead.io). VisitLead keeps the Lead account identifier, the email address, the name, the language, the organisation, the role, the plan and the associated rights, and the open sessions.
3.2 Subscription
For a Pro or Pro+ subscription taken out in VisitLead, VisitLead keeps the Stripe customer and subscription reference, the plan, its status and its dates; card data remains with Stripe. A plan granted because the organisation has a paid subscription in another Lead application is read from the Lead account (plan, originating application, end date): no payment data is exchanged.
3.3 Settings and integrations
The declared websites (name, domain), the key pages, the alert settings, the Slack webhook or generic webhook address and its secret, and the fingerprints of the team IP addresses that the Customer chooses to exclude (never the addresses themselves).
3.4 Service emails
The Monday digest, alerts and account emails are sent by Resend. VisitLead keeps a sending log (fingerprint of the address, subject, date, status) for 400 days at most, in order to cap sending and to respect an opt-out or a bounce.
3.5 visitlead.io website
The visitlead.io website uses neither third-party analytics nor advertising cookies. To limit abuse, a fingerprint (HMAC) of the network identifier is kept for two hours at most; the IP address itself is never recorded.
4. Data of visitors to Customers' websites (VisitLead as processor)
4.1 What is measured
When a person visits a website that carries the VisitLead tag, the tag sends: the page address (without its parameters, except utm_* parameters), its title, the website the person came from (its domain name only), the screen size, the browser language and the detected consent status.
The IP address of the connection is used, in memory only and for the duration of the request, to find the network the visit comes from. It is transmitted to the public internet registries for this purpose. For Switzerland, the commercial register is then consulted with the organisation's name only. If that network belongs to a company, a school or a public administration, the visit is attributed to that organisation. If it is an internet access provider, a mobile operator or a hosting provider, the visit remains "unidentified". The IP address is never written to a database or to a log.
To group the pages of a single visit without a cookie, VisitLead calculates a daily fingerprint: a hash of the website, the IP address and the browser with a secret that changes every day and is deleted after 48 hours at the latest. Two different days cannot be linked.
4.2 Contacts known to the Customer
A "known contact" is a person the Customer already knows: they clicked a link in a Customer newsletter carrying a VisitLead token, filled in a form on the Customer's website, or were imported by the Customer (CSV file, ScanLead, manual entry). For a known contact, VisitLead keeps their email address, name, company and job title as provided by the Customer, a fingerprint of the address (HMAC), a random token for links, and their visits.
When the tag reads a form on a website, it only transmits the email address and the name and company fields, never the other fields or a password, and only if the rule for the visitor's country allows it (§ 4.3).
4.3 Rules by visitor's country
| Visitor's region | Company recognised by its network | Recognition of a known contact (_vl cookie) |
|---|---|---|
| European Union, EEA, United Kingdom | Yes, IP never kept | Only after consent |
| Switzerland | Yes, IP never kept | Information and possibility to object, or consent depending on the Customer's setting |
| United States | Yes, IP never kept | Yes, unless there is a Global Privacy Control or Do Not Track signal or an opt-out |
| Other countries | Yes, IP never kept | As for the European Union |
In all countries, a Global Privacy Control or Do Not Track signal from the browser prevents any cookie and any form reading. An opt-out set by the "#visitlead-optout" link on the Customer's website prevents any sending.
4.4 What VisitLead never does
- Identify an unknown person, by their IP address, their browser or a purchased database.
- Keep a visitor's IP address.
- Track a person from one Customer website to another: each Customer's data stays in its own workspace.
- Sell or share visitor data, within the meaning of the CCPA, or use it for advertising.
Information about company networks (organisation name, domain, country, city) is kept in a shared cache for 90 days: this is data about organisations taken from public registries, never data about people.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service to Customers, collecting subscription payments | Performance of the contract (GDPR Art. 6(1)(b)) |
| Service emails (digest, alerts, account) | Performance of the contract (Art. 6(1)(b)) |
| Limiting abuse, security | Legitimate interest (Art. 6(1)(f)) |
| Global opt-out list (/optout) | Legal obligation to respect an objection (Art. 21 GDPR, Art. 30 revFADP) and legitimate interest (Art. 6(1)(f)) |
| Measuring visits for a Customer | Processing on behalf of the Customer (Art. 28 GDPR, Art. 9 revFADP); the Customer chooses its basis: legitimate interest for the company recognised without a cookie, consent for the cookie where it is required |
6. Retention periods
- Visits, page views, alerts and _vl cookies: 12 months at most, then automatic deletion (daily task). On the Free plan, only the last 30 days are shown to the Customer.
- Daily fingerprint: its secret is deleted after 48 hours at the latest.
- Company network cache: 90 days, then refreshed.
- Known contacts: for as long as the Customer keeps them, and at the latest until its workspace is deleted. A contact who opts out is flagged and no longer recognised.
- Global opt-out list: a fingerprint of the address (HMAC), for as long as the opt-out applies, without the address itself.
- Account data: while the Service is used; deleted 30 days after all access ends, or earlier on request.
- Email sending log: 400 days at most. Sessions: 12 hours.
7. Processors
| Processor | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting of the application and the tag | Frankfurt region (Germany) |
| Neon (Databricks, Inc.) | Database | AWS eu-central-1 (Frankfurt) |
| Resend | Service emails | European Union and United States |
| Stripe Payments Europe | Subscription payments | Ireland and United States |
| Public internet registries and Swiss commercial register | Identification of a visit's network and organisation | Depending on the registry |
| Anthropic | AI Assistant | United States |
| Slack, or the tool chosen by the Customer | Signals sent to the address specified by the Customer | Depending on the tool |
8. Transfers abroad
The data is hosted in Frankfurt (European Union). Quantum Liquid LLC is established in the United States, and some processors may process data outside Switzerland and the EU/EEA. These transfers rely on the safeguards provided for by the revFADP and the GDPR, in particular the European Commission's Standard Contractual Clauses, with the Swiss addendum, and the Data Privacy Framework where the recipient is certified under it.
9. Your rights
Anyone can request access to their data, its rectification, its erasure, the restriction of processing and its portability, and object to processing based on legitimate interest. California residents also have the right to know what data is processed, to have it deleted or corrected, and not to be discriminated against for exercising these rights; VisitLead does not sell or share personal data.
- No longer be recognised by any VisitLead Customer: page https://visitlead.io/en/optout. After confirmation by email, your address is flagged as opted out with all Customers and refused in any future import.
- No longer be measured on a website: the "#visitlead-optout" link on the website concerned, the Global Privacy Control setting of your browser, or refusal in the website's consent banner.
- Other requests: hello@visitlead.io. For visits to a website, we forward the request to the Customer concerned and help it respond.
A complaint may be lodged with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), with the supervisory authority of the place of residence in the European Union, or with the California Privacy Protection Agency.
10. Cookies
On visitlead.io, only necessary cookies are used (session, language, currency, Lead account sign-in). The _vl cookie set by the tag on Customers' websites is described in the tag cookie policy.
11. Security
Encryption in transit (TLS), database encrypted at rest, access limited to the people who need it, secrets separated by use, keyed fingerprints (HMAC) instead of values where possible. A data breach affecting a Customer's data is notified to that Customer without undue delay.
12. Changes
Any material change is announced on the website and, for Customers, by email or in the application before it takes effect.