Privacy Policy

1. Who we are and what this covers

This policy explains how Prospectal ("we", "us"), of 30 N Gould St Ste R, Sheridan, WY 82801, USA, handles personal data when you visit prospectal.io, use the application at app.prospectal.io or the Prospectal REST API (together, the "Service"), or contact us.

For your account, billing and website data, we decide how and why it is used. For the files you upload and the Results we produce for you, we process the data on your behalf and on your instructions — you decide what goes into a project and what you do with the Results.

2. What we collect

• Account data: your name, company, work email and password (stored only as a hash by our authentication provider), or your basic Google profile if you sign in with Google.
• Project and billing data: the tools you run, the search URLs and options you submit, row counts, project status, your credit balance and transactions, and your package purchases.
• Input and Results: the files you upload and the files we produce for you. These can contain business contact details such as names, job titles, companies, work emails and profile URLs.
• API keys: we keep only a one-way hash and a short prefix of each key, never the key itself.
• Communications: emails you send us, messages you send to buy credits, live-chat conversations in the app, and enquiries you send through the website.
• Technical data: IP address, browser and device information and the pages requested, which our hosting providers process to deliver and protect the Service.

3. How we use it

• to create and secure your account and sign you in;
• to run your projects, deliver Results and keep your credit balance accurate;
• to send service emails — sign-up confirmation, password resets, and notices when a project starts and completes;
• to arrange purchases, add credits and keep billing records;
• to answer your questions and provide support;
• to prevent fraud and abuse, enforce our Terms and keep the Service secure;
• to understand which pages of the website are useful, using the analytics described below.

We do not sell personal data, do not use your Input or Results to build a database for anyone else, and do not use advertising trackers.

4. Legal bases

Where the GDPR or UK GDPR applies, we rely on: performing our contract with you (running your account and projects); our legitimate interests (securing the Service, preventing abuse, improving the website and answering enquiries); legal obligations (for example keeping purchase records); and your consent where the law requires it. For personal data in your Input and Results, you are responsible for having a lawful basis for the processing you ask us to do.

5. Service providers

We use a small number of providers to run the Service. Each receives only what it needs for its task:

• Supabase

  Authentication (including passwords and Google sign-in), the application database (accounts, projects, credits, API-key hashes) and server functions that run projects, the API and download links.

• Cloudflare R2

  Private storage of the files you upload and the Results we produce, deleted automatically after 30 days. Files are downloaded only through short-lived links issued to your account.

• Vercel

  Hosting of the website and the app, including the request logs that hosting requires, and the website’s cookieless analytics.

• Email delivery (SMTP)

  Sending account and project emails, and delivering messages you send us.

• Google

  Only if you choose to sign in with Google: confirms your identity and shares your name and email with us.

• Crisp

  Live chat inside the app, when you use it: your name, email and the conversation.

• WhatsApp (Meta)

  Only if you message us to buy credits: the messages you send us there.

• Data and verification sources

  Enrichment and verification tools look up data with third-party sources on your behalf, sending only what each lookup needs — for example a name with a company or domain, or an email address to verify.

We may also disclose data where the law requires it, to protect our rights or the safety of others, or to a successor if the business is reorganised or sold — in which case this policy continues to apply to your data.

6. International transfers

Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards offered by those providers, such as standard contractual clauses.

7. How long we keep data

• Uploaded files and Results: 30 days, then deleted automatically.
• Account, project and credit records: while your account is open. When you ask us to delete your account, we delete them, except purchase records we must keep for legal or accounting reasons.
• Emails, chat and messages: as long as needed to deal with your request and any follow-up.
• Hosting logs and analytics: for the limited periods our providers keep them; website analytics are aggregated.

8. Security

Data travels over encrypted connections (HTTPS). Files are kept in private storage and downloaded only through short-lived links issued to the signed-in account. Passwords are handled by our authentication provider and never stored in plain text, and API keys are stored only as a hash. Access to data is limited to what is needed to run and support the Service. No system is perfectly secure; if we become aware of a breach that affects your data, we will notify you and the authorities as the law requires.

9. Cookies, storage and analytics

The website sets no cookies. It keeps one item in your browser’s session storage — which button you used to reach the enquiry form — so that an enquiry can record where it started; it is deleted when you close the tab.

The website uses Vercel Web Analytics to count page views. It sets no cookies and stores nothing on your device. It records the page visited, the referring page, and your browser, operating system, device type and country (derived from your IP address, which is not stored). Visits are grouped with a hash of the request that is discarded within a day, so you are not tracked across days or across other websites.

The app uses your browser’s storage to keep you signed in, to remember where to return after signing in, and to remember a package you chose on the Pricing page so it can be shown on the Billing page. The live chat in the app, when used, may set its own cookies to keep your conversation.

10. Your rights

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format, and you can withdraw consent at any time where we rely on it. Email contact@prospectal.io; we will answer within one month, and may need to confirm your identity first.

If you are unhappy with how we handle your data, please tell us so we can put it right. You also have the right to complain to your local data-protection authority.

11. If your details appear in a customer’s Results

Our customers use Prospectal to build lists of business contacts, typically from professional profiles and company information that is publicly available. In that case the customer decides how your data is used, and is responsible for having a lawful basis and for honouring your rights — please contact them first. You can also write to contact@prospectal.io: we will help where we can, for example by telling you whether a file containing your details is still stored (files are deleted after 30 days).

12. Children

The Service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18.

13. Changes to this policy

We update this policy when the Service, our providers or the law change. The current version is always on this page with its date; if a change materially affects how we use your data, we will tell you in the app or by email first.

14. Contact

Questions or requests about your data: contact@prospectal.io.

Postal address: Prospectal, 30 N Gould St Ste R, Sheridan, WY 82801, USA.