Privacy Policy

We collect information you provide directly, information generated when you use the Service, and information received from third parties.

• Account information — your name, email address, password (stored only as a hash), profile photo, and account identifiers. If you sign in with Google, GitHub, Apple, Facebook, or Microsoft, we receive your name, email address, profile image, and the provider's account identifier. If you enable two-factor authentication, we store your secret and recovery codes in encrypted form.
• Team and workspace information — team names, member roles, invitations, and the searches, locations, and keywords saved to a team.
• Search and scrape data — the keywords, locations, countries, languages, and other parameters you submit, together with the results we return. Results may include business names, addresses, phone numbers, websites, ratings, review counts, public email addresses, social profiles, and other information that is publicly available in search results and online directories.
• Outreach information — the business email addresses you contact, the content of your messages, the sending account, delivery and bounce status, and records of unsubscribe requests.
• Payment information — payments for MCP scrape downloads are processed by Stripe. We receive transaction identifiers, amounts, currency, status, and the email address associated with the payment. If you save a card for automatic payments, Stripe stores the card and we keep the card brand, expiry date, last four digits, and Stripe identifiers so you can identify and manage it. We do not receive or store full card numbers.
• Connected application data — when you authorize an MCP client, we store OAuth client details, granted scopes, authorization codes, access tokens, and related request metadata.
• Usage and technical information — IP address, browser type, device information, pages viewed, actions taken, timestamps, and server logs.

• To provide the Service, including running searches, performing scrapes, storing results, and generating exports.
• To create and manage accounts, teams, invitations, and access permissions.
• To send outreach emails on your behalf and to honor unsubscribe requests.
• To process payments, issue receipts, and prevent fraud.
• To authenticate users, secure accounts, and protect the Service against abuse.
• To provide support, respond to requests, and troubleshoot problems.
• To monitor usage, improve features, and understand how the Service performs.
• To comply with legal obligations and enforce our agreements.

Where data protection laws such as the GDPR apply, we rely on the following legal bases:

• Performance of a contract — to provide the Service you have requested and administer your account.
• Legitimate interests — to secure the Service, prevent abuse, improve our product, and conduct responsible business-to-business outreach.
• Consent — where we ask for it, such as optional communications. You may withdraw consent at any time.
• Legal obligation — to keep records, respond to lawful requests, and meet tax and accounting requirements.

We use a small number of strictly necessary cookies and similar technologies:

• Session cookie — keeps you signed in and protects forms against cross-site request forgery.
• Remember-me cookie — keeps you signed in when you choose that option.
• Appearance preferences — stores your light or dark mode choice in your browser.

We do not use advertising cookies or sell data to advertising networks. You can control cookies through your browser settings, but disabling essential cookies may prevent the Service from working.

We do not sell personal information. We share information with service providers that help us run the Service, and only as needed for the purposes described in this policy:

• Cloud hosting and infrastructure providers that store data and serve the application.
• Cloudflare for browser rendering and network security.
• Search data providers, such as SerpApi, to retrieve search results.
• Stripe to process payments and manage billing.
• Email delivery providers, such as Mailgun or Postmark, to deliver outreach and transactional email.
• Identity providers such as Google, GitHub, Apple, Facebook, and Microsoft when you choose social sign-in.
• Professional advisers, auditors, and insurers where necessary.
• Authorities or other parties where required by law, or to protect our rights, users, or the public.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets.

Team members can see information saved to their shared team workspace, including searches, results, and outreach records. Team owners and administrators control membership.

Our Service helps you find publicly available information about businesses and contact them. We process this information on the basis of our legitimate interest in providing business-to-business research and outreach tools, and our customers' legitimate interest in promoting their products and services.

If you receive an outreach email from one of our customers and do not wish to be contacted again, use the unsubscribe link in the email. We honor unsubscribe requests and suppress the address from future outreach through the Service. You may also contact us to request access, correction, or deletion of your business contact information.

We keep personal information only for as long as needed for the purposes described in this policy:

• Account, team, search, and outreach records are kept while your account is active and for a reasonable period afterward so you can recover your work.
• Billing and transaction records are kept for as long as tax and accounting laws require.
• Unsubscribe records are retained so that we can continue to honor your opt-out.
• Server and security logs are kept for a limited period, typically no longer than 90 days, unless needed to investigate an incident.

When information is no longer needed, we delete it or anonymize it.

We use industry-standard measures such as encryption in transit, hashed passwords, encrypted secrets, access controls, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and enable two-factor authentication where available.

We may process information in countries other than your own. Where required, we use appropriate safeguards, such as standard contractual clauses, to protect information transferred internationally.

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal information, to receive a portable copy, and to withdraw consent. You may also have the right to opt out of certain sharing and to not be discriminated against for exercising your rights.

You can update your profile and delete your account from your account settings. To make another privacy request, email us at [email protected]. We may need to verify your identity before responding, and we will respond within the time required by applicable law.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

The Service is intended for businesses and professionals and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The date at the top of this page shows when the policy was last updated.

If you have questions or requests about this policy or your personal information, contact us at [email protected].