Privacy policy

Who we are

Prospect Locally is operated by EDSDEV INC., a Canadian company. In this policy, “we” and “us” mean EDSDEV INC. This policy explains what personal data we collect, where it comes from, who handles it for us, how long we keep it, and how you ask us to remove it. Questions about it go to [email protected].

What we collect from our customers

• Account data: your name, your email address, and either a password hash or your Google sign-in identifier.
• Billing data: Stripe takes your card details and sends us a customer identifier, your plan, and your invoices. Your card number never reaches our servers.
• Usage data: the searches you run, your credit balance and history, your exports, the API calls you make, and the technical details of your requests, such as your IP address and browser.
• Cookies: described in the section on cookies below.

Where lead data comes from

The business data a search returns comes from public sources: Google Maps listings, which we receive through DataForSEO; the public websites of those businesses; and the public pages of the Better Business Bureau. That data includes business names, addresses, phone numbers, email addresses published on a business’s own website, and the names of owners that a website states. We do not collect private or password-protected data, and we do not guess email addresses.

Who handles data for us

We use these companies to run the service. Each one receives only the data it needs for its task.

• Hetzner hosts our servers and our database.
• Cloudflare delivers and protects our websites, and Cloudflare R2 stores archives and exports.
• Stripe processes payments and subscriptions.
• Mailgun sends our account and billing emails.
• Crisp provides the chat window and receives the messages you send through it.
• Google Analytics measures how visitors use our websites. Its library runs on every page, and it sets cookies only after you accept analytics cookies.
• PromoteKit tracks affiliate referrals, after you accept advertising cookies.
• Anthropic processes the text of a business’s website to find the owner’s name.
• DataForSEO supplies the Google Maps listings that a search returns.
• Telnyx checks a phone number when you ask us to verify it.
• Google provides sign-in when you choose to sign in with Google.

Cookies

We sort cookies into three categories.

• Essential: keep you signed in and remember your cookie choice and your theme. These are always on. The Crisp chat window also belongs here: when you are signed in, it loads after you answer the cookie banner, whichever choice you make, and it sets its own cookies to keep your chat session.
• Analytics: Google Analytics. Its library loads on every page, including before you choose and after you reject analytics cookies. Until you accept, it runs in a cookieless mode: it sends Google the address of the page you view without the query string, the page you came from, your browser type, and your IP address, and it sets no cookie and stores no identifier. The Google Analytics cookies stay off until you accept them.
• Advertising: PromoteKit, which credits an affiliate who referred you. These stay off until you accept them.

Your choice lasts 180 days, and then we ask again. You can change it at any time with the Cookie preferences link in the footer of every page.

How long we keep data

• Lead rows: 14 days in our database after a search finishes. We then move them to an archive, where they stay for 12 months before we delete them.
• Raw provider responses: 14 days.
• Exports: 90 days.
• Account data: we delete it within 30 days of the day your account is closed.

We store API keys only as hashes, so we cannot read a key after you create it. If you lose a key, you create a new one.

Removal requests

If your business or your name appears in a search result and you want it removed, email [email protected] with the subject “Removal request”. Tell us the business name and the phone number, email address, or website that identifies it. We read that mailbox ourselves. If you are a customer, you can ask for your account data to be deleted at the same address, and we do it within 30 days.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. To make a request, email [email protected], and we answer within 30 days. If you are in Canada and our answer does not satisfy you, you can complain to the Office of the Privacy Commissioner of Canada.

If you are in the European Union or the United Kingdom: we process the business data that a search returns, including an owner’s name and the email addresses and phone numbers a business publishes, on the basis of legitimate interests, under Article 6(1)(f) of the GDPR and of the UK GDPR. The interest is that of our customers, and ours, in finding and contacting businesses that may want their services. We limit that data to what appears on public pages, we keep it only for the periods above, and you can object at any time by sending a removal request, after which we delete the records we hold about you. We process our customers’ account and billing data to perform our contract with them, and we set analytics and advertising cookies only with consent. Our servers are in Finland. Some of the companies listed above, and a server in the United States that fetches public websites for us, process data outside the European Union and the United Kingdom. You can also complain to the data protection authority of the country where you live, or, in the United Kingdom, to the Information Commissioner’s Office.

Changes to this policy

When we change this policy, we change the date at the top of this page. If a change reduces your rights, we also email the address on your account.