Privacy policy
Last updated
Short version: we collect what we need to run your account and bill you correctly. The leads a search returns are information businesses have already published about themselves — though for a one-person business that can still be personal data, which is why what you do with a results file is your responsibility as well as ours.
What we collect about you
To run your account: your email address and password (handled by our authentication provider — we never see or store your password in plain text). To process payments: your purchase amounts and credit balance; card details are handled entirely by Stripe and never touch our servers. To provide the service: the searches you run (industry, country, cities) and the results they produce. If you apply to the referral programme, we also collect the business and payout details you enter on that form, including the account holder's name and IBAN, so commission can actually be paid.
The business data a search produces
A search collects information businesses have already published about themselves: company name, address, phone number, category, and whatever contact details sit on their own website. For most results that is company information rather than information about a person. But not for all of them — a sole trader or a one-person business is a real individual, and a named address like firstname@company.com or a personal mobile number identifies someone. Data protection law treats those as personal data even when they are public, and we would rather say so than pretend otherwise.
Who is responsible for that data
We are responsible for collecting it and for the sources and methods we use. Once results are delivered to you, you decide what happens next, which makes you responsible for how you use them. That is not a formality: before you contact anyone in a results file you need your own lawful basis for doing so — usually legitimate interest for business-to-business outreach — and you must identify yourself, say where you got the details, honour any request to stop, and follow the marketing rules of the country you are contacting. Our terms require it, and it is the part customers most often skip.
Why we process your data
Account and payment data is processed because it is necessary to provide the service you signed up for (contractual necessity) — running searches, tracking your credit balance, and billing you correctly. The business data a search collects is processed on the basis of legitimate interest: supplying business contact information to companies for business-to-business use. We do not use your account data for advertising and we do not sell it.
Who else sees it
Vercel hosts the site and processes every request to it, and also provides the visitor counting and page-speed measurement described under Cookies — no new company sees anything as a result, because it already saw the request. Supabase provides the database, authentication and file storage. Stripe processes payments. Resend sends transactional email. Anthropic provides the AI behind the assistant on the site, which receives what you type into it. It receives nothing about your search results. Microsoft receives the session recordings described under Cookies, and only from visitors who accepted them — if you declined, or were never asked, it receives nothing. Where a search needs to reach a website through a proxy provider, that provider handles the request but never your account data. Each only receives what it needs: Stripe never sees your search history, and Supabase never sees your card details.
Where your data is processed
The providers above are largely United States companies and some processing happens outside the European Economic Area, including in the United States. Where that is the case, transfers rely on the European Commission's standard contractual clauses in those providers' terms. If you need the specifics for a particular provider before you buy, ask us and we will point you at their current documentation.
How long we keep things
The ready-made result files (CSV/XLSX) are deleted automatically 48 hours after a search finishes. That is housekeeping, not deletion of your data: the underlying results stay in your job history for as long as your account exists, both so you can see what a past search returned and so the file can be rebuilt from them on demand at no charge. Your account, jobs and credit ledger are kept on the same basis. Ask us to delete your account and we remove that data; it does not retroactively un-charge past purchases (see our refund policy).
Your rights
You can ask us to access, correct, export or delete your data at any time, and to object to how we process it. Use the contact form or WhatsApp and we will handle it. If you are not satisfied with how we deal with a request you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the regulator in your own country.
If your business appears in our results
You can ask us to remove your business from our results and to stop collecting it in future, and you do not need an account to do so. Write to us through our contact form or by email and tell us which business to exclude — the more precisely you identify it, the faster we can match it, and we will confirm once it is done. From then on every search skips your business before anything is collected. Two honest limits: we cannot recall a file a customer has already downloaded, and if your business is later re-listed publicly under new details that counts as a new entry, so tell us again and we will add it.
Security
All traffic to DataFacilitator is encrypted (HTTPS). Customer records are separated in the database so one account cannot read another's, and payment processing is handled by Stripe, a PCI-compliant provider — we never store full card numbers. Referral payout details are stored where only the operator can reach them, never the browser.
Cookies
Some cookies are needed for the site to work: the session cookie that keeps you logged in, one recording your language if you choose it from the switcher, and one remembering your answer to the cookie banner. If you arrive through a referral link, a further cookie records who referred you so the right person is credited when you buy; that one lasts 90 days. We count visits and measure how quickly pages load using the analytics built into Vercel, who already host the site and see every request to it — it sets no cookies, does not store your IP address, and cannot single you out. Separately, and only if you accept, Microsoft Clarity records how the site is used — clicks, scrolling, how someone moves through a form — and sends that recording to Microsoft. It sets its own cookies, and it does not load at all until you accept: decline, or simply ignore the banner, and no request is ever made to it. You can change your mind at any time under "Cookie choices" in the footer; declining after having accepted also clears the Clarity cookies set on this site, though one it sets on its own domain is beyond our reach and expires by itself. We do not use advertising cookies, and nothing on this site follows you around the rest of the web.
Changes to this policy
If this policy changes in a meaningful way, we'll update this page. Continuing to use DataFacilitator after a change means you accept the updated policy.
DataFacilitator is a trading name of Master Facilitator BV, registered in the Netherlands.
Master Facilitator BV · KvK 78023106 · VAT NL861236038B01