Leadibly

No model claim appears anywhere across the homepage, the pricing section, the how it works sequence or the privacy policy. The mechanism is described plainly and mechanically: query a mapping platform's business listings by sector and country, visit each resulting website, extract contact addresses, then send on a fixed schedule. The removal test has nothing to remove.

Graded at the middle band under the convention that treats a competent product making no model claim as neither better nor worse for it. The one place a model could plausibly sit is left undescribed, which is handled on the disclosure axis rather than here: messages are said to be sent in the recipient's local language across more than fifty countries, and campaigns are described as personalised, with no statement of whether either is template substitution or generation.

Once a campaign is configured the system runs the whole loop without further intervention: it collects listings, crawls websites, extracts addresses, and sends across multiple countries on a schedule. Two real ceilings are published and both are unusual enough to credit. Sending is capped at one message per minute, stated as a headline figure rather than buried, and messages are held to local business hours and time zones in each target country.

A global blocklist and a per account barring list further constrain who can be contacted. What is entirely absent is oversight at the point of action: there is no approval step before a message goes, no review queue, no per message record of what was sent to whom beyond aggregate counts of sends, errors and bounces, and no documented way to halt a running campaign. Ceilings at the design layer, nothing at the moment of contact.

Nothing is claimed and therefore very little is withheld, which is why this sits at the middle band rather than lower. The gap that does matter is specific. Campaigns are marketed as personalised and messages are said to be sent in the recipient's local language across more than fifty countries, from an interface offered in five languages. Neither claim is explained.

A buyer cannot tell whether localisation is a set of translated templates or generated text, and if generated, by what, hosted where, or with what review. For a product whose output is a message signed by the customer and sent from the customer's own mail server, the question of who actually wrote the words is not a small one, and it is unanswered.

Four headline statistics sit at the top of the homepage and not one of them is a customer outcome: countries covered, businesses indexed, the send rate, and a compliance assertion. There are no named customers, no case studies, no testimonials, no customer logos, no quantified results and no independent coverage. A listing exists on one software directory, created in June 2026 with zero likes, zero comments and no reviews, and the descriptive copy on it is vendor authored.

A profile page exists on a major review platform carrying no reviews. The one accuracy figure available anywhere, an average verified rate of sixty two percent, appears only on that vendor authored directory listing and not on the vendor's own site, so a buyer reading the product page sees no accuracy claim at all. The company is recent and that explains the position without changing what a buyer can currently verify, which is nothing.

The mechanical controls are real, specific and better than several larger vendors in this index manage. Unsubscribes are honoured automatically, a global blocklist screens invalid addresses, each account carries its own barring list, sending is capped at one message per minute, and messages are held to local business hours and time zones in each target country, which is a time of day control almost nobody here publishes.

Two statutes are named by name in the privacy policy, the European data protection regulation and the United States commercial email statute. What undoes the posture is that they are named only in order to hand the obligation over. The policy states that the customer acts as an independent controller for the leads they collect and contact and is responsible for ensuring their outreach complies.

That is a complete transfer of compliance responsibility to the buyer, and it sits directly beneath a homepage that advertises full compliance as one of its four headline figures. No acceptable use policy, anti spam policy or consent position was located anywhere on the site.

The half of the policy written for the account holder is tight, specific and honest. The controller is named as a real legal entity with a published company tax identifier, data categories are enumerated including the lead data itself, two suppliers are named with their function, retention carries an actual number with deletion inside thirty days of account closure, rights are listed with a thirty day response commitment, and cookies are stated to be functional only with the storage mechanism described and tracking and advertising cookies explicitly ruled out.

Separate addresses are published for privacy and for legal requests. The half that matters most for this particular business is missing. No lawful basis is stated for collecting the contact details of people who never interacted with the vendor; the policy says only that the information is publicly available business information, which describes a source rather than a ground.

There is no notice mechanism for those people, no route designed for them to be removed from the source corpus as distinct from a customer's own copy, no supervisory authority complaint route, and no transfer position covering the payment and lead discovery suppliers, both of which sit outside the residency claim made elsewhere on the site.

The supply chain is named with a precision that most vendors in this category avoid, and that deserves credit before the criticism. Discovery runs through a named mapping platform's official programmatic interface, identified by name in the privacy policy, and enrichment is described plainly as visiting each business website and extracting the contact address published there. There is no resold static database, and the vendor draws that distinction itself.

What is missing is everything that would make the sourcing defensible rather than merely disclosed. No licensing position covers the reuse and redistribution of listing data obtained through that interface, which is the exact activity a downloadable contact list represents. No position at all covers the website crawl, including whether robots directives are honoured. No lawful basis, notice or removal route exists for the individuals whose addresses are extracted. And the policy resolves the question by assigning it elsewhere, stating that the customer is the independent controller of the leads they collect.

Two mechanisms operate and only one of them is accounted for. Lead discovery is stated in the privacy policy to run through the mapping platform's official programmatic interface, which is materially better than the homepage line implies and lifts this clearly off the bottom band. Sending runs through the customer's own mail server rather than vendor infrastructure.

Nothing on the site offers a browser extension, account rotation, proxy infrastructure, multiple identity sending or any language about avoiding detection. Against that: no conformance position is published for the terms governing reuse of listing data obtained through that interface, and those terms are precisely what a bulk contact export puts pressure on.

The second mechanism, crawling each business website to extract published addresses, is described as a product feature with no stated method, no robots handling position and no rate discipline. Naming the official source for one half and saying nothing about the other half is the middle band.

No model is claimed, so the training question has no subject. The stewardship question underneath it is live and unanswered. This vendor bills per lead delivered and accumulates a corpus of business contact details as a by product of every customer query.

Nothing published states whether leads discovered and enriched for one customer's search are retained by the vendor and served to another customer running a similar search, which is the defining question for any business whose inventory is generated by its own users' demand. The retention clause addresses how long the customer's copy is kept and is silent on the vendor's.

A second gap sits alongside it: the product requires the customer to connect their own mail sending credentials, and those credentials do not appear anywhere in the enumerated inventory of data collected.

Nothing synthetic operates anywhere in this product. There is no agent, no cloned voice, no manufactured caller identity, no automated social action and no simulated conversation, and messages leave from the customer's own mail server under the customer's own identity, so nothing is being passed off as something it is not. Unsubscribes are honoured automatically and a per account barring list is maintained.

Held at the middle band because of how the recipient arrives rather than how they are addressed: their details were taken from a business listing and from a crawl of their own website, they have no prior relationship with either party, they receive a cold message with no statement of how they were found, and the only removal route published belongs to the account holder rather than to them. Disclosure at first contact, of either the sourcing or the automation, is nowhere addressed.

Two connections work and both are minimal. The customer connects their own mail server using the standard protocol, which is an open interface rather than a proprietary one and keeps the sending path in the customer's hands. The full lead list exports to a spreadsheet file at any time, unmetered and on every tier.

Beyond those two there is nothing: no programmatic access of any kind, and the pricing copy confirms it by promising no interface charges rather than describing an interface; no webhooks, no connection to any system of record, no automation connector, no marketplace and no agent protocol server. The two suppliers named in the privacy policy are the vendor's own dependencies, not customer integrations. For a tool whose entire output is contact records intended to be worked in a pipeline elsewhere, the absence of any path into a system of record means every lead moves by file.

The residency claim is more precise than most vendors of any size manage. The hosting provider is named, the country is named, and the specific data centre region code is published in the footer of every page, alongside a plain statement that the application data sits in the European Union. Naming the region slug rather than only the continent is a level of specificity that appears rarely in this index. Off the top band on three counts.

There is no explicit commitment that data is not transferred outside that region, only a statement of where it currently sits. Two suppliers named in the privacy policy, the payment processor and the lead discovery interface, both sit outside the residency claim and neither is reconciled with it. And no sub processor register exists beyond those two names, so where the crawling and sending infrastructure runs is unstated.

Disclosure amounts to one badge and one short paragraph. The badge advertises transport encryption, which is universal and closer to table stakes than to a credential. The paragraph adds hashed passwords and access controls, plus an honest acknowledgement that no system is completely secure and an instruction to the user to choose a strong password.

There is no certification of any kind, no trust centre, no audit report or period, no penetration test, no dedicated security page, no vulnerability disclosure route, no status page and no statement about encryption at rest. The specific gap worth naming: the product requires the customer to hand over working credentials for their own mail server, which is among the more sensitive items any tool in this index asks for, and those credentials appear nowhere in the enumerated list of data the vendor says it collects.

A buyer can budget this purchase completely from the published page, which is the test. Three tiers carry real figures on both billing periods, forty nine, one hundred and forty nine and four hundred and ninety nine euros per month, against four hundred and seventy, one thousand four hundred and thirty and four thousand seven hundred and ninety per year, and the stated twenty percent annual saving checks against the arithmetic on all three.

The unit is defined and consistent: leads delivered with a verified email address, allowances of one hundred, three hundred and one thousand per month, with sending included at every tier and no separate charge for it. Billing is monthly with no annual commitment. The payment processor is named and card details are stated not to be stored. A free trial delivers three verified leads with no card.

The vendor states plainly that there are no consumption charges, no interface charges and no surprises, and nothing located contradicts it. Two items are recorded as observed rather than as defects: the price per lead is effectively flat at about half a euro across all three tiers, so the tiers buy volume rather than a better rate; and what happens when a monthly allowance runs out is not addressed anywhere, nor is any seat or user dimension stated.

Both halves of this axis are at least partly answered, which is uncommon anywhere in the index and rare at this size. During the relationship, the full lead list exports to a spreadsheet file at any time, stated as a product feature, unmetered and available on every tier including the cheapest. After it, the privacy policy publishes an actual number: data is deleted within thirty days of account closure.

A data export right and a restriction right are enumerated separately with a thirty day response commitment, and billing is monthly with no commitment period, so there is no contractual lock in to escape. Off the top band because the processing agreement carrying the formal termination obligations is available on request rather than published; because no export file format or schema is specified; because nothing addresses what becomes of campaign history and sent message records as distinct from lead records; and because there is no programmatic route out at all, so extraction depends entirely on a manual download.

Unusually concrete for a vendor of this size, and the headline control is a published number rather than a promise. Sending is capped at one message per minute and that figure appears as one of four statistics at the top of the homepage, framed explicitly as pacing that protects the sender's reputation. Messages are held to local business hours and time zones in each target country.

A global blocklist screens invalid addresses before they are attempted, each account maintains its own barring list, unsubscribes are honoured automatically, and sends, errors and bounces are reported in real time. Sending runs through the customer's own mail server, so reputation consequences stay with the party making the sending decisions rather than pooling across a shared vendor sender.

Off the top band because the discipline stops at pacing: no authentication guidance is published, no warmup ramp, no complaint rate threshold, no bounce handling policy beyond reporting the counts, no blocklist monitoring of the customer's own domain and no placement testing.

The segment is stated consistently and worked properly rather than merely asserted. Eight buyer types each carry their own page, covering marketing agencies, consultants, business to business sales teams, suppliers, software companies, freelancers, recruiters and accountants, and the positioning line repeats the first three verbatim in the footer of every page.

Coverage is quantified with more than fifty countries and more than ten million businesses indexed, the interface ships in five languages, and the tier allowances give the size claim a numeric shape at one hundred, three hundred and one thousand leads per month. The strongest element is that the vendor names five specific competitors it expects to displace and publishes a comparison page against each, which turns positioning into something testable rather than decorative.

Off the top band because no ceiling and no disqualifying condition is stated anywhere, and because the promise of any business type in any country sits awkwardly beside a European first identity and a European hosting claim.