What we collect about you
To run your account: your email address and password (handled by our authentication provider — we never see or store your password in plain text). To process payments: your purchase amounts and credit balance; card details are handled entirely by Stripe and never touch our servers. To provide the service: the searches you run (industry, country, cities) and the results they produce. If you apply to the referral program, we also collect the business and payout details you enter on that form, including the account holder's name and IBAN, so commission can actually be paid.
The business data a search produces
A search collects information businesses have already published about themselves: company name, address, phone number, category, and whatever contact details sit on their own website. For most results that is company information rather than information about a person. But not for all of them — a sole trader or a one-person business is a real individual, and a named address like firstname@company.com or a personal mobile number identifies someone. Data protection law treats those as personal data even when they are public.
Who is responsible for that data
We are responsible for collecting it and for the sources and methods we use. Once results are delivered to you, you decide what happens next, which makes you responsible for how you use them. That is not a formality: before you contact anyone in a results file you need your own lawful basis for doing so — usually legitimate interest for business-to-business outreach — and you must identify yourself, say where you got the details, honour any request to stop, and follow the marketing rules of the country you are contacting. Our terms require it.
Why we process your data
Account and payment data is processed because it is necessary to provide the service you signed up for (contractual necessity) — running searches, tracking your credit balance, and billing you correctly. The business data a search collects is processed on the basis of legitimate interest: supplying business contact information to companies for business-to-business use. We do not use your account data for advertising and we do not sell it.
Who else sees it
Vercel hosts the site and processes every request to it, and also provides the visitor counting and page-speed measurement described under Cookies — no new company sees anything as a result, because it already saw the request. Supabase provides the database, authentication and file storage. Stripe processes payments. Resend sends transactional email. Anthropic provides the AI behind the assistant on the site, which receives what you type into it. It receives nothing about your search results. Microsoft receives the session recordings described under Cookies, and Google, Meta and OpenAI the advertising measurement described there. Each only receives what it needs: Stripe never sees your search history, and Supabase never sees your card details.
Where your data is processed
The providers above are largely United States companies and some processing happens outside the European Economic Area, including in the United States. Where that is the case, transfers rely on the European Commission's standard contractual clauses in those providers' terms. If you need the specifics for a particular provider before you buy, ask us and we will point you at their current documentation.
How long we keep things
The ready-made result files (CSV/XLSX) are deleted automatically 48 hours after a search finishes. That is housekeeping, not deletion of your data: the underlying results stay in your job history for as long as your account exists, both so you can see what a past search returned and so the file can be rebuilt from them on demand at no charge. Your account, jobs and credit ledger are kept on the same basis. Ask us to delete your account and we remove that data; it does not retroactively un-charge past purchases (see our refund policy).
Your rights
You can ask us to access, correct, export or delete your data at any time, and to object to how we process it. Use the contact form or WhatsApp and we will handle it. If you are not satisfied with how we deal with a request you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the regulator in your own country.
Security
All traffic to DataFacilitator is encrypted (HTTPS). Customer records are separated in the database so one account cannot read another's, and payment processing is handled by Stripe, a PCI-compliant provider — we never store full card numbers. Referral payout details are stored where only the operator can reach them, never the browser.
Cookies
Some cookies are needed for the site to work: the session cookie that keeps you logged in, one recording your language if you choose it from the switcher, and one recording which of the tools described below are switched on in this browser. If you arrive through a referral link, a further cookie records who referred you so the right person is credited when you buy; that one lasts 90 days.
We also set two cookies of our own that recognise this browser: one lasting 90 days recording only that it has been here before, and one lasting 30 minutes marking the visit you are on. Together they let us tell a first visit from a return, and see whether an advertisement led to a purchase days later. Neither holds anything about you — each is only a random number — and neither goes anywhere: this site alone reads them.
We count visits and measure how quickly pages load using the analytics built into Vercel, who already host the site and see every request to it — it sets no cookies, does not store your IP address, and cannot single you out.
Microsoft Clarity also records how the site is used — clicks, scrolling, how someone moves through a form — and sends that recording to Microsoft. It sets its own cookies. It is switched on automatically for every visitor, with two exceptions: it does not load if you declined it on an earlier visit, back when this site still asked, or if your browser blocks cookies from this site.
When you arrive from an advertisement, a search result or a link on another site, a further cookie records which one — the campaign labels in the address you arrived at, the click identifier the advertising network itself added to it, and the name of the site you came from, never the full address of that page. It lasts 90 days, it is written only when there is something new to record, and it goes nowhere: this site alone reads it.
We also load advertising tags from Google, Meta and OpenAI so that a purchase here can be matched to the advertisement that led to it. Those tags set their own cookies (_gcl_au, _fbp, _fbc and __obref), and they are only present while we are actually running advertising. Like Clarity, they are switched on automatically for every visitor, with the same two exceptions. Where we report a purchase to one of them directly, from our own records rather than from your browser, anyone who declined them on an earlier visit is left out of that as well.
Changes to this policy
If this policy changes in a meaningful way, we'll update this page. Continuing to use DataFacilitator after a change means you accept the updated policy.