Privacy Policy

GAMMA IT SOLUTIONS SRL (Republic of Moldova) provides Data Scout. Write to [email protected] about anything here. This policy covers account holders (Business Users and Consumers), visitors to our site, and people whose published business contact details appear in Data Scout.

We are the controller for account, index, technical and billing data. For what a Business User uploads we are a processor under our Data Processing Agreement, and the customer is the controller.

We hold your email address, name if given, organization and role, a hash of your password, your Google account identifier if you sign in with Google, the Terms version you accepted, API keys (hashed) and integration tokens (encrypted), and your purchase records — plan, interval, Business User or Consumer, and checkout consents. We use them to provide the Service and bill for it (contract), to keep it secure (legitimate interest) and to keep invoices and consumer-purchase records (legal obligation). We send service email only; accepting the Terms is not consent to marketing, and we would ask before sending any. How long: see Retention.

Files, lists, leads and notes are used only to provide the Service to you. We do not add them to our index, share them or train models on them. If you appear in a Business User’s data, that business is the controller — contact it; if you write to us, we pass the request on. Consumers may upload other people’s data only where they are allowed to (Terms).

This is the notice Article 14 of the GDPR requires when data is not collected from the person it is about.

Source and content. Publicly accessible pages of companies’ own websites — contact, imprint or team pages. Our crawler, DataScoutBot, obeys robots.txt, never signs in or fills a form, and explains itself on its own page. We hold a name, role, business email and phone, professional profile links and the page they came from — nothing about your private life.

The email check. We ask the receiving mail server whether the address exists. No message is sent and nobody is contacted. We keep the verdict, the reply the mail server gave us and the time we asked, so the mailbox is not asked again for every customer, and which customer organization asked, for metering and abuse handling.

Legal basis. Legitimate interests — ours and our customers’ in reaching the right person at another business. We hold only what your employer published for being contacted, about your professional role, with no special-category data; our customers are bound by an Acceptable Use Policy; and you can object and be suppressed permanently, without an account.

Recipients and retention. Our customers, when they look up your company. One record serves all of them, so one removal reaches all of them in Data Scout — but not copies a customer exported before it. Records not refreshed for a year are deleted (see Retention). To be removed, write to [email protected]; we delete the record and keep only a suppression entry so it is never collected again (Data removal).

Security and audit logs (what changed, by whom, IP address and user agent), usage records for metered actions, and for the signed-out extension tier a random device identifier and IP address to apply a daily cap. Payments are taken by the provider named at checkout — a merchant of record, a card processor or an acquiring bank. We receive payment references, never the full card number; the provider is a separate controller of the payment data it collects, under its own privacy notice.

Company summaries, categories and scores use Anthropic. We send company-level facts about the website being analysed — address, company name and description, page titles and headings, detected technologies — and never people’s contact details, your uploads, account data or secrets. Anthropic processes them in the United States under Standard Contractual Clauses, keeps them only for a limited period and may not train on them. AI output is an estimate and we never use it to decide about people.

We do not sell our account holders’ personal data or use anyone’s data for targeted advertising. Business contact details in the index are available to our customers as part of the Service (section C). Our service providers act on our instructions and are listed on the Sub-processors page. An integration you connect, such as a CRM, receives data on your instruction under your own agreement with it. We disclose data where the law requires it.

We operate Data Scout from the Republic of Moldova; the application and database run on servers in the EU (see Sub-processors), and some providers operate in the United States. The safeguard depends on the route, and you can ask us for a copy:

Where the law requires a record to be kept longer, for example for tax, we keep only that record for that period.

Depending on the law that applies to you, you can ask for access to and a copy of your data, correction, deletion (including your whole account), restriction, portability, and object at any time to processing based on legitimate interests. Write to [email protected], from your account’s address if you have one. We acknowledge within 2 business days and answer within 30 days. You may also complain to the data-protection authority where you live or work.

Some US states give rights to know, access, correct and delete personal information, to opt out of its sale, targeted advertising and certain profiling, and to appeal a refusal. Whether a given law applies to us depends on its thresholds; we honour these requests from anyone. Suppressing your record (section C) is also how you opt out of any disclosure a state law treats as a sale. We do not discriminate against anyone for using these rights. If we decline, ask for an appeal and we answer within 60 days, telling you how to contact your state attorney general.

No advertising, analytics or tracking cookies. Everything below is strictly necessary, which is why you are not asked for consent:

The extension keeps a session token, a connection flag, the sites it analysed this session and, signed out, a random device identifier in the browser’s extension storage. A payment provider’s checkout page may set its own cookies.

Each organization’s data is isolated in the database (row-level security) and in the application; passwords and API keys are stored only as hashes, integration credentials are encrypted, traffic is encrypted in transit, and nightly backups go off-site to Cloudflare R2, which encrypts stored data at rest. Report a vulnerability to [email protected].

Data Scout is not for anyone under 18; tell us if we hold a child’s data and we delete it. Each version of this policy has a number and an effective date, and we email account holders before a material change.