Question 1

What is lead.box?

Accepted Answer

lead.box is a GDPR-first B2B visitor identification platform. It turns anonymous companies visiting your website into a named pipeline — company-level, first-party identifiers only, no advertising cookies, no analytics shipped outside the EU.

Question 2

How does company identification work?

Accepted Answer

IP-to-company resolution via verified, GDPR-compliant data sources. The lookup is transient: raw IPs are not persisted beyond the processing window.

Question 3

What data do I see per company?

Accepted Answer

Per identified company: legal name, industry, size band, HQ country, LinkedIn URL, website, inferred tech stack where available, and the full page history. Company-level only.

Question 4

Do you identify individual people?

Accepted Answer

No, deliberately not. lead.box resolves organisations, not people. No person-level profiling, no contact scraping, no contact reselling.

Question 5

Why isn’t every visitor identified?

Accepted Answer

A large share of B2B traffic comes from home-office broadband, mobile carriers, VPNs and consumer ISPs and cannot be resolved to a company. Typical identification rates land between 20% and 45%.

Question 6

Is it real-time?

Accepted Answer

Yes. Visits stream into your workspace in seconds, with a live feed and real-time notifications for hot accounts.

Question 7

How is this different from Google Analytics?

Accepted Answer

Google Analytics reports pageviews. lead.box reports the companies behind them, company-level and without sending data to a US analytics vendor.

Question 8

Where does company data come from?

Accepted Answer

From verified, GDPR-compliant B2B data sources with documented lawful basis, contracted with EU standard clauses.

Question 9

How current is company data?

Accepted Answer

The IP-to-company graph is refreshed continuously and firmographics are re-verified on a rolling basis. Wrong matches are investigated same-day.

Question 10

What about home-office visitors?

Accepted Answer

Home-office visitors usually stay anonymous. lead.box does not guess a corporate identity from private broadband lines.

Question 11

How do I report a wrong match?

Accepted Answer

Open the company card and use the report control. We investigate and correct upstream if needed. Same-day response during business hours.

Question 12

Which countries and languages are covered?

Accepted Answer

Identification is global; strongest across EU, UK, US, Canada, DACH and MENA. Product UI in EN, DE, FR, ES, RU, AR.

Question 13

What share of traffic is typically identifiable?

Accepted Answer

For B2B sites, typically 20% to 45% of sessions are resolved to a company. Pricing and product pages trend higher, blog pages lower.

Question 14

What counts as an identified company?

Accepted Answer

One company equals one count per calendar month, no matter how many times it visits. Predictable bill, no traffic-spike surprises.

Question 15

What happens when I hit my monthly limit?

Accepted Answer

Identification pauses for the rest of the month with no overage charges. Visits keep being recorded. Warnings at 80% and 100%.

Question 16

How many users or seats do I get?

Accepted Answer

Unlimited seats on every paid plan. Roles and permissions are workspace-level.

Question 17

Can I run multiple websites or workspaces?

Accepted Answer

Yes. Each workspace maps to a property or property group with its own snippet, integrations, team and billing.

Question 18

Monthly or yearly billing?

Accepted Answer

Monthly (cancel anytime) or yearly (~23% saving, one invoice). Monthly→yearly is immediate and prorated; yearly→monthly takes effect at the end of the annual term.

Question 19

Are up- and downgrades prorated fairly?

Accepted Answer

Upgrades apply immediately, with the prorated price difference invoiced. Downgrades apply at the next billing period, without a refund for the current one. Itemised Stripe invoices.

Question 20

Free trial without a credit card?

Accepted Answer

Yes. Email sign-up, no card, no sales call. When the 14-day trial ends, tracking and dashboard access pause until you pick a plan; existing data is retained.

Question 21

Can I cancel anytime?

Accepted Answer

Yes. Monthly and yearly plans renew automatically until you cancel in a few clicks from billing settings (Stripe customer portal). Cancellation takes effect at the end of the current billing period, with no partial refunds. Upgrades apply immediately (prorated); downgrades apply at the next billing period.

Question 22

What happens to my data after cancellation?

Accepted Answer

Access runs to the end of the paid period; export your data anytime from Settings (GDPR export). Full account deletion is self-service — 30-day grace window, then permanent.

Question 23

Invoices and payment methods?

Accepted Answer

Cards, SEPA and other common methods via Stripe on all plans. Invoices in EUR or USD, VAT where applicable, available in the Stripe portal.

Question 24

How do I invite team members?

Accepted Answer

From Settings → Team, invite by email and pick a role. Magic-link onboarding. Unlimited seats on paid plans.

Question 25

Can I export my data?

Accepted Answer

Yes. Every table exports to CSV, Excel or JSON with current filters. Localised column headers. No export throttling on paid plans.

Question 26

Why is lead.box GDPR-compliant?

Accepted Answer

Company-level signal only, EU infrastructure in ISO 27001-certified European data centers, first-party identifiers only, no advertising or cross-site cookies, no cross-site profiling, no person-level resolution.

Question 27

Legitimate interest (Art. 6(1)(f)) — explained

Accepted Answer

Art. 6(1)(f) GDPR allows processing needed for a legitimate interest when the visitor’s rights do not override it. lead.box operates at the legal-entity level, so the balancing test favours the business interest.

Question 28

Do my visitors need to consent?

Accepted Answer

The tracker uses a first-party functional identifier on your domain. Whether §25 TDDDG requires a banner is your DPO’s scoping call; personal identifiers are never processed.

Question 29

What exactly does the tracker store on the visitor device?

Accepted Answer

A first-party functional identifier on your own domain (device-scoped ID). No advertising, cross-site or third-party cookies. No fingerprinting. Company resolution runs server-side.

Question 30

Ready-made privacy-policy paragraph

Accepted Answer

A ready-made privacy-policy paragraph is provided on this page in English and German with a copy button, matching the /gdpr page.

Question 31

Where is data processed?

Accepted Answer

Inside the EU only, on infrastructure hosted in ISO 27001-certified European data centers. No third-country transfers of customer analytics data.

Question 32

How do I conclude a DPA?

Accepted Answer

Digitally, in about two minutes. Pre-fill your details on /dpa, review the terms and sign electronically. Countersigned copy stays in your workspace.

Question 33

Sub-processors?

Accepted Answer

Full sub-processor list in Annex III of the DPA, versioned and dated. GDPR-compliant contracts and EU SCCs where relevant. Material changes announced in advance.

Question 34

Can companies or individuals opt out?

Accepted Answer

Yes. Visitors can opt out at /opt-out. Company-level opt-outs can be requested at privacy@lead.box.

Question 35

What do you store about IP addresses, and for how long?

Accepted Answer

The IP is used transiently at resolution and never persisted as a raw address. Stored per visit: resolved organisation and coarse geographic metadata.

Question 36

How do I install the snippet?

Accepted Answer

Two minutes. Copy the snippet from Settings → Tracking and paste before . Guided installers for GTM, WordPress, Shopify, Webflow. Real-time install verification.

Question 37

Does it slow my site down?

Accepted Answer

No. Edge-cached loader with stale-while-revalidate and ETag revalidation (304 on repeat visits). The tracker is a small async script and does not block rendering.

Question 38

Does it work with consent banners and CMPs?

Accepted Answer

Yes. lead.box needs no consent for its own signal but can be gated behind a CMP category if preferred. Docs cover the major CMPs.

Question 39

SPAs and server-side rendering?

Accepted Answer

Fully supported. Route changes in SPAs fire virtual pageviews on pushState and hashchange. SSR needs no special integration.

Question 40

Multiple domains?

Accepted Answer

Yes. One workspace can track multiple domains under the same snippet; visits are tagged with the originating hostname. Cross-domain sessions stitch server-side.

Question 41

How do I trigger a test visit?

Accepted Answer

Load your site with the snippet installed from an office network. Home connections may not identify. Use the onboarding wizard’s "Send test visit" control to confirm the install.

Question 42

Where are servers located?

Accepted Answer

Exclusively inside the European Union, in ISO 27001-certified European data centers. App, database and object storage all on EU infrastructure.

Question 43

Encryption in transit and at rest?

Accepted Answer

TLS 1.2+ in transit. AES-256 encryption at rest. Secrets stored in an encrypted vault and rotated on a documented schedule.

Question 44

Who has access to my data?

Accepted Answer

Row-level security isolates workspaces at the database layer. Internal access is scoped by role, logged, and restricted to on-call engineers for incident response.

Question 45

What happens during outages?

Accepted Answer

The tracker queues and re-sends visits on brief incidents. Status and post-mortems on status.lead.box. Security-relevant incidents are emailed to workspace owners under DPA timelines.

Every question, straight answer

Product

Data & accuracy

Pricing & billing

Account & contract

Setup & tech

Security & hosting

See lead.box on your own traffic

What lead.box does

How it works

Quick links