Privacy policy
Last updated
Short version: we collect what we need to run your account and bill you correctly. The leads a search returns are information businesses have already published about themselves — though for a one-person business that can still be personal data, which is why what you do with a results file is your responsibility as well as ours.
What we collect about you
To run your account: your email address and password (handled by our authentication provider — we never see or store your password in plain text). To process payments: your purchase amounts and credit balance; card details are handled entirely by Stripe and never touch our servers. To provide the service: the searches you run (industry, country, cities) and the results they produce. If you apply to the referral programme, we also collect the business and payout details you enter on that form, including the account holder's name and IBAN, so commission can actually be paid.
The business data a search produces
A search collects information businesses have already published about themselves: company name, address, phone number, category, and whatever contact details sit on their own website. For most results that is company information rather than information about a person. But not for all of them — a sole trader or a one-person business is a real individual, and a named address like firstname@company.com or a personal mobile number identifies someone. Data protection law treats those as personal data even when they are public, and we would rather say so than pretend otherwise.
Who is responsible for that data
We are responsible for collecting it and for the sources and methods we use. Once results are delivered to you, you decide what happens next, which makes you responsible for how you use them. That is not a formality: before you contact anyone in a results file you need your own lawful basis for doing so — usually legitimate interest for business-to-business outreach — and you must identify yourself, say where you got the details, honour any request to stop, and follow the marketing rules of the country you are contacting. Our terms require it, and it is the part customers most often skip.
Why we process your data
Account and payment data is processed because it is necessary to provide the service you signed up for (contractual necessity) — running searches, tracking your credit balance, and billing you correctly. The business data a search collects is processed on the basis of legitimate interest: supplying business contact information to companies for business-to-business use. We do not use your account data for advertising and we do not sell it.
Who else sees it
Vercel hosts the site and processes every request to it, and also provides the visitor counting and page-speed measurement described under Cookies — no new company sees anything as a result, because it already saw the request. Supabase provides the database, authentication and file storage. Stripe processes payments. Resend sends transactional email. Anthropic provides the AI behind the assistant on the site, which receives what you type into it. It receives nothing about your search results. Microsoft receives the session recordings described under Cookies, and only from visitors who accepted them — if you declined, or were never asked, it receives nothing. Google, Meta and OpenAI receive the advertising measurement described under Cookies, on the same terms: only from visitors who accepted it, and nothing at all from those who did not. Where a search needs to reach a website through a proxy provider, that provider handles the request but never your account data. Each only receives what it needs: Stripe never sees your search history, and Supabase never sees your card details.
Where your data is processed
The providers above are largely United States companies and some processing happens outside the European Economic Area, including in the United States. Where that is the case, transfers rely on the European Commission's standard contractual clauses in those providers' terms. If you need the specifics for a particular provider before you buy, ask us and we will point you at their current documentation.
How long we keep things
The ready-made result files (CSV/XLSX) are deleted automatically 48 hours after a search finishes. That is housekeeping, not deletion of your data: the underlying results stay in your job history for as long as your account exists, both so you can see what a past search returned and so the file can be rebuilt from them on demand at no charge. Your account, jobs and credit ledger are kept on the same basis. Ask us to delete your account and we remove that data; it does not retroactively un-charge past purchases (see our refund policy).
Your rights
You can ask us to access, correct, export or delete your data at any time, and to object to how we process it. Use the contact form or WhatsApp and we will handle it. If you are not satisfied with how we deal with a request you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the regulator in your own country.
Security
All traffic to DataFacilitator is encrypted (HTTPS). Customer records are separated in the database so one account cannot read another's, and payment processing is handled by Stripe, a PCI-compliant provider — we never store full card numbers. Referral payout details are stored where only the operator can reach them, never the browser.
Cookies
Some cookies are needed for the site to work: the session cookie that keeps you logged in, one recording your language if you choose it from the switcher, and one remembering your answer to the cookie banner. If you arrive through a referral link, a further cookie records who referred you so the right person is credited when you buy; that one lasts 90 days. We also set two cookies of our own that recognise this browser: one lasting 90 days recording only that it has been here before, and one lasting 30 minutes marking the visit you are on. Together they let us tell a first visit from a return, and see whether an advertisement led to a purchase days later. Neither holds anything about you — each is only a random number — and neither goes anywhere: this site alone reads them. We count visits and measure how quickly pages load using the analytics built into Vercel, who already host the site and see every request to it — it sets no cookies, does not store your IP address, and cannot single you out. Separately, and only if you accept, Microsoft Clarity records how the site is used — clicks, scrolling, how someone moves through a form — and sends that recording to Microsoft. It sets its own cookies, and it does not load at all until you accept: decline, or simply ignore the banner, and no request is ever made to it. You can change your mind at any time under "Cookie choices" in the footer; declining after having accepted also clears the Clarity cookies set on this site, though one it sets on its own domain is beyond our reach and expires by itself. When you arrive from an advertisement, a search result or a link on another site, a further cookie records which one — the campaign labels in the address you arrived at, the click identifier the advertising network itself added to it, and the name of the site you came from, never the full address of that page. It lasts 90 days, it is written only when there is something new to record, and it goes nowhere: this site alone reads it. Separately, and only if you accept, we load advertising tags from Google, Meta and OpenAI so that a purchase here can be matched to the advertisement that led to it. Those tags set their own cookies (_gcl_au, _fbp, _fbc and __obref), they are only present while we are actually running advertising, and like Clarity they make no request at all until you accept — declining clears them too. Where we report a purchase to one of them directly, from our own records rather than from your browser, anyone who declined is left out of that as well. The banner asks about these two things separately, and they are answered separately: you may accept the session recording and refuse the advertising tags, or the other way round. Changing either answer later under "Cookie choices" clears that choice's own cookies on this site and leaves the other's untouched.
Changes to this policy
If this policy changes in a meaningful way, we'll update this page. Continuing to use DataFacilitator after a change means you accept the updated policy.
DataFacilitator is a trading name of Master Facilitator BV, registered in the Netherlands.
Master Facilitator BV · KvK 78023106 · VAT NL861236038B01