Privacy Policy

Information about users

• Account details: your name, email address and password (stored only as a hash by our authentication provider), and, if you sign in with Google, the name, email address and profile photo Google shares with us.
• Team details: your team’s name and logo, who belongs to it and each member’s role.
• Profile photo you choose to upload.
• What you enter: the email addresses and names you look up or import, and notes you write about contacts.
• Usage and technical data: the lookups you run and their cost, and the IP address, browser and request logs our hosting provider records when you use the site.

Information about contacts

When a user looks up an email address, we retrieve information about the person it belongs to from third-party data providers and public sources, and save it for the user’s team. This can include:

• name, photo and LinkedIn profile URL;
• current employer, job title and location;
• career history;
• a work email address, and whether the mailbox accepts mail.

We also read public job postings from the careers pages and job boards of companies where contacts work, so a team can see open roles there. Job postings are about companies, not individuals.

If you are a contact and want to know what we hold about you, or want it deleted, see your rights below. You don’t need an account to ask.

How we use information

• to run the service: create accounts, perform lookups, show contacts to the team that looked them up, and track job openings at their companies;
• to keep the service secure, prevent abuse and enforce our Terms of Use;
• to send account emails such as sign-up confirmation;
• to understand costs and improve the service;
• to meet legal obligations.

We don’t sell personal information, we don’t share it for cross-context behavioral advertising, and we don’t send marketing email to contacts. Where the GDPR or similar laws apply, we rely on performing our contract with users, and on our and our users’ legitimate interest in reconnecting with past business contacts, which we balance against contacts’ rights by limiting what we collect to professional information and honoring objections.

Who can see it

Contacts and notes are visible only to members of the team that saved them; other teams can’t see them. Teammates can see each other’s names and photos. We share information only with service providers that process it for us under contract:

• Supabase: database, authentication and file storage;
• Vercel: hosting;
• treg and the data providers it routes to: person and company enrichment, email finding and verification, and web search;
• Anthropic: researching how companies and their brands are organized (company names and public web pages only, no information about contacts or users);
• Logo.dev: company logos, looked up by company domain;
• Google: sign-in, if you choose it.

We may also disclose information when the law requires it, to protect the rights and safety of people or the service, or to a successor if Prospect Arcade is sold or merged, in which case this policy continues to apply.

Cookies

We use cookies only to keep you signed in, and your browser’s local storage to remember display settings such as light or dark mode. We don’t use advertising or third-party analytics cookies.

How long we keep it

Account and team information is kept while your account exists. Contacts stay until a member of the team deletes them or the team is closed. Internal logs of background jobs are deleted after 30 days, and our providers keep request logs for their own limited periods. When you ask us to delete your information, we delete it within 30 days, except where we must keep it to meet a legal obligation.

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy, object to or restrict how we use it, and withdraw consent you gave. California residents have the right to know, delete and correct, and not to be discriminated against for using these rights.

To use any of them, whether you are a user or a contact, email privacy@prospectarcade.com. We may ask you to confirm you control the email address the request is about. We answer within 30 days (45 where California law allows). If you are in the EEA or UK and not satisfied with our answer, you can complain to your data protection authority.

Security

Data is encrypted in transit, every team’s data is separated by row-level security in the database, and service credentials stay on our servers. No system is perfectly secure, so we can’t guarantee absolute security; we will notify affected people of a breach as the law requires.

International transfers

We and our providers process data in the United States and possibly other countries. Where the law requires, we rely on safeguards such as the European Commission’s standard contractual clauses for these transfers.

Children

The service is for businesses and not meant for anyone under 18. We don’t knowingly collect their information.

Changes and contact

We’ll post any changes here and update the date above; for material changes we’ll also notify users by email or in the app. Questions or requests: privacy@prospectarcade.com. See also our Terms of Use.