Who is responsible
ProspectPilot is run by the seller below, who decides how the personal data described here is used (the controller):
- Diana Buinovskaja, trading as CosmicLabs
- Valtarkiemio g., LT-06238 Vilnius, Lithuania
- hello@prospectpilot.eu
This policy covers two groups of people: our customers, the agencies and freelancers who use ProspectPilot, and the people at the businesses ProspectPilot finds and checks.
Our customers
| What | Why | Legal basis |
|---|---|---|
| Name, email address, password (stored only as a hash) or Google sign-in | To run your account | Contract |
| Agency details you enter: name, website, sender name, signature, services | To write and send your emails and show them in your concepts | Contract |
| Plan, payments, invoices, the brand and last four digits of your card | To charge you and keep accounting records. Card numbers are held by Stripe, never by us. | Contract, legal obligation |
| A connected Gmail or Outlook mailbox: its access tokens (stored encrypted), the emails you send and the replies to them | To send the emails you approve and sort the replies | Contract |
| Actions in your workspace and the IP addresses of requests | Security, preventing abuse, investigating problems | Legitimate interest |
People at the businesses we check
ProspectPilot lists local businesses from OpenStreetMap, the open map maintained by its contributors, and visits their public websites. It keeps what businesses publish about themselves: the business name, address, phone number, public email addresses, website, social profiles and opening hours, and the results of checking the website. Where a business is run by one person, some of this may be personal data.
We use it so that our customers can find businesses whose websites they could improve and contact them about it. The legal basis is legitimate interest: the details are ones the business published for customers to reach it, they are used only for business-to-business contact about its website, and opting out is simple.
If you receive an email sent through ProspectPilot, the unsubscribe link in it stops that sender from emailing you again. To have your business removed from ProspectPilot altogether, write to hello@prospectpilot.eu. Our crawler, ProspectPilotBot, follows robots.txt; how it works and how to block it.
Who else receives data
We use these service providers, each bound by a data processing agreement and only for the purpose shown:
| Stripe Payments Europe (Ireland) | Payments, invoices and saved cards |
| Anthropic, PBC (USA) | Writes report summaries, website concepts and email drafts from the data in your workspace, and searches the web for a business's website |
| Google (Ireland, USA) | Google sign-in, Gmail when you connect it, and speed measurements of public websites |
| Microsoft (Ireland, USA) | Outlook when you connect it |
| Our hosting provider | The servers and database ProspectPilot runs on |
| OpenStreetMap services | Receive the city and trade you search for, never your personal data |
Where a provider is outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
How long we keep it
- Your account data: while your account is open. Deleting your account in Settings deletes it, and the workspaces only you own, straight away.
- Invoices and payment records: ten years, as Lithuanian accounting law requires.
- Business details in a customer's workspace: until that customer deletes them or closes the account.
- Opt-outs: for as long as needed to keep honouring them.
Cookies
ProspectPilot sets one cookie, pp_session, which keeps you signed in. It is strictly necessary, so it needs no consent. We use no analytics or advertising cookies.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. Write to hello@prospectpilot.eu; we answer within one month. You can also complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or the authority where you live.
Security
Data travels encrypted, passwords are stored only as hashes and mailbox tokens are encrypted at rest. Access to production data is limited to the people who run the service.
Changes
When this policy changes in a way that matters, we tell customers by email before the change applies. The date at the top shows the current version.