Last updated 2026-08-02
How Curious Brand handles personal data in Curious Prospector. This covers both your own account data and the third-party business-contact data the product surfaces, because the two are treated differently.
First, data about you as a user: your name, email, the space you belong to, your role, and a log of what you did in the product. For this we are the controller.
Second, business-contact data about people at the companies you research — typically a name, job title, employer, a work email address and a public social handle, gathered from public web sources and from enrichment providers. We process this on your behalf as part of providing the service; when you decide who to contact and send outreach, you are the controller for that.
| Data | Why | Basis |
|---|---|---|
| Name, email, password (hashed), role, space | To create and secure your account | Contract |
| Business DNA, target lists, notes, pipeline | To run searches, scoring and drafts for you | Contract |
| Research briefs and prospect records | To deliver and store your results | Contract |
| Usage logs: actions, token counts, costs, credits | To meter usage, enforce limits, bill and prevent abuse | Contract / legitimate interests |
| Product emails: tips, trial reminders, follow-up digests | To help you use what you signed up for | Legitimate interests, with opt-out |
| Analytics (only if you consent) | To understand which pages and features are used | Consent |
We use the following providers. Relevant parts of your data are sent to them so the product can work. They process it on our instructions and are not permitted to use it for their own purposes.
| Provider | What it does | Where |
|---|---|---|
| Anthropic (Claude) | Research, scoring and drafting; web search | US |
| Google (Gemini) | Research and web search | US / EU |
| OpenAI | Fallback model when the others are unavailable | US |
| Hunter.io | Work email lookup for a named person at a domain | EU |
| Apollo (optional) | Richer contact source, only if your space enables it | US |
| Companies House | Public UK company registry checks | UK |
| Supabase | Database, authentication and file storage | EU |
| Railway | Application hosting | EU / US |
| Resend | Sending product email | US / EU |
| Google Analytics 4 | Website analytics — only with your consent | US / EU |
Some providers are outside the UK/EEA, mainly in the United States. Where that happens we rely on the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or an adequacy decision, as applicable to that provider.
When you analyse a company we fetch public pages from its website and run web searches, then send that material to the AI providers above to produce a brief and a score. We do not knowingly seek out special-category data, and you should not enter it.
Model output can be wrong. Treat contact details as unverified until you check them.
We use a small number of strictly necessary cookies to keep you signed in and to remember your interface preferences. These do not need consent.
Analytics runs only if you accept it in the cookie banner. Until you do, analytics is denied by default via Google Consent Mode, and no analytics cookies are set. You can change your choice at any time by clearing the banner's stored preference.
You can ask for a copy of your data, correct it, delete it, restrict or object to processing, and withdraw consent for analytics. Email seckin@curiousbrand.co.uk and we will respond within one month.
If you are unhappy with how we handle it you can complain to the Information Commissioner's Office at ico.org.uk.
If you have received outreach from a user of this product and want your details removed, contact that sender directly — they chose to contact you. You may also email us and we will pass the request on and remove the record from our systems where we are able to.
Curious Brand, a company registered in England and Wales. Full registration details are available on request. Contact: seckin@curiousbrand.co.uk.