Privacy policy
Last updated 2026-11-05
This policy explains how [SiteScout legal entity] ([Registered postal address]) ("SiteScout", "we") handles personal data. It covers two groups of people: our customers (agencies and freelancers who use SiteScout) and the businesses our customers research and contact ("leads").
1. Who is responsible
- For customer accounts, signup and billing data, SiteScout is the controller.
- For lead data and outreach, each customer is the controller and SiteScout is their processor under our Data Processing Agreement. The customer decides which businesses to contact and approves every email.
Contact: privacy@sitescout.example
2. What we process and where it comes from
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Customer name, email, password hash, company, team members | You, at signup / invite | Provide the service, security, support | Contract |
| Billing status, plan, Stripe customer id (no card numbers) | Stripe | Subscriptions, invoices, dunning | Contract; legal obligation (tax records) |
| Business name, address, phone, website, rating, reviews (place_id) | Google Places API (official API only, no scraping) | Lead research, scoring, demo previews | Customer's legitimate interest (B2B prospecting) |
| Business email address + where and when it was found | The business's own public website | Outreach approved by the customer; proof of publication | Legitimate interest / inferred or implied consent where the law requires it |
| Website speed and mobile test results | Google PageSpeed Insights; our own browser test | Opportunity score | Legitimate interest |
| Sent emails, approvals, unsubscribes (audit log) | The service | Proof of compliance, abuse prevention | Legal obligation; legitimate interest |
| Suppression entries (a one-way hash of an email or domain) | Unsubscribes, objections, takedowns | Never contact that business again | Legal obligation |
We do not buy lists, scrape Google, sell data or use lead data to train AI models.
3. Retention
| Data | Kept for |
|---|---|
| Google Places content (other than place_id) | Cache TTL per the Maps terms, then re-fetched or dropped |
| Leads never contacted | 90 days, then deleted (place_id kept only to avoid duplicates) |
| Leads contacted with no reply | 30 days for EU/EEA, UK and Canada; 180 days elsewhere |
| Replied leads and won clients | While the deal or client is active, plus 24 months |
| Suppression entries (hashed email or domain + reason) | Indefinitely, so the opt-out keeps working |
| Demo preview sites | 30 days after they are built, unless the deal is won |
| Send and approval logs | 3 years (proof of compliance) |
| Customer account data after cancellation | 30-day export window, then deleted (billing records per tax law, held by Stripe) |
An automated job deletes data when its period ends.
4. Your rights
Depending on where you are (GDPR, UK GDPR, the Philippine Data Privacy Act, Australian Privacy Act, CCPA/state laws, PIPEDA), you can ask for access, correction, deletion, restriction, portability, and you can object to processing, including direct marketing, at any time.
- Businesses contacted through SiteScout: use the data notice page to opt out of all SiteScout customers' outreach or to have your data deleted. Every email also has a one-click unsubscribe link.
- Customers: email privacy@sitescout.example.
You can also complain to your data protection authority.
5. Sub-processors and transfers
- Hosting: [VPS provider and region]
- Stripe (billing)
- Postmark (account emails only, never cold outreach)
- Google (Places API, PageSpeed Insights; Gmail API when a customer connects Gmail)
- Microsoft (Graph API when a customer connects Microsoft 365)
- LLM provider for drafting emails (Anthropic or OpenAI, if enabled)
Transfers outside the EEA/UK use Standard Contractual Clauses / the UK IDTA where needed.
6. Security
Data is separated per customer with database row-level security. Passwords are hashed (scrypt). OAuth tokens and API keys are encrypted at rest (AES-256-GCM). Access is logged.
7. Changes
We will tell customers by email before material changes take effect.