Privacy Policy

Who is responsible

[[COMPANY_NAME]] ([[LEGAL_FORM]]), [[REGISTERED_ADDRESS]], is the controller for the processing described here. Privacy questions and requests go to [[PRIVACY_EMAIL]] or through the contact form. Data is hosted in [[HOSTING_REGION]].

No cookies, no analytics, no tracking

We set no cookies, run no analytics, and embed no advertising or tracking pixels. There is nothing to consent to, which is why you have not been asked. Two things are stored locally in your own browser and never sent to us: the search you were drafting, so a refresh does not lose it, and — for staff — an admin sign-in token.

If you buy a list

We hold:

• The delivery email address you gave us, and the category, location and quantity you ordered.
• Payment records from Stripe. Your card details never reach us; what we store is Stripe's own record of the transaction, which we keep for tax and accounting purposes.
• A salted, hashed form of your IP address for rate limiting. It is a one-way digest: enough to count requests, not enough to identify you or to recover the address.

The lawful basis is performance of the contract for the order itself, and our legitimate interest in preventing abuse for the rate-limit hash. Retaining payment and delivery records is a legal obligation.

If your business appears in a list

We process business contact information that is already published — map listings, the business's own website, and the public social profiles it links to. We do not scrape personal social profiles, and we record where each piece of information came from and when, so any question about a specific row can be answered rather than guessed at.

Our crawler identifies itself as a lead-qualification research crawler, respects robots.txt, fetches only a handful of pages per site, and waits between requests to the same host.

We rely on legitimate interest for this processing, limited to business rather than personal contact details. Where a business name or address is also a person's — a sole trader, for instance — the removal route below applies in full.

How to be removed

Use the contact form, choose the removal option and name the business. We add it to a suppression list which is consulted at the moment a list is built, so it is excluded from every future order rather than filtered out after the fact.

One thing to be straight about: we keep the suppression entry itself, and the record of where the original data came from, precisely so we can demonstrate the request was honoured. Deleting the evidence of a deletion request would leave us unable to prove we acted on it.

You also have the rights to access, correct, restrict and object to this processing, and to complain to your data-protection authority.

How long we keep things

• Delivered files: 30 days, then deleted from storage. Download links expire sooner, after 7 days.
• Free previews and their leads: 30 days.
• Server logs: 14 days.
• Dormancy readings: re-checked on a 21-day cycle.

Being honest about the rest: the business directory, the readings taken from it, the leads we have delivered, and order, payment and staff-action records are kept without a fixed expiry. Orders and payments are retained because tax and accounting rules require it; the directory and its readings are retained so a delivered list stays auditable — if you ask why a business scored as it did six months ago, the answer has to still exist.

Who else processes it

These providers process data on our behalf:

• Google (Places API) — finding businesses and their map listings.
• Bright Data — reading public Facebook and Instagram profiles for post dates.
• Stripe — payments, refunds and payment records.
• Cloudflare (Turnstile) — distinguishing people from scripts on public forms.
• Sentry — error reporting.
• Our object-storage and email providers — storing and delivering your files.

Changes

If this policy changes materially we will update the date above. Buyers with an order in progress are covered by the version in force when they ordered.