Privacy Policy
How Curiously Branded Ltd handles personal data in Curious Prospector. This covers both your own account data and the third-party business-contact data the product surfaces, because the two are treated differently.
Two kinds of personal data
First, data about you as a user: your name, email, the space you belong to, your role, and a log of what you did in the product. For this we are the controller.
Second, business-contact data about people at the companies you research — typically a name, job title, employer, a work email address and a public social handle, gathered from public web sources and from enrichment providers. We process this on your behalf as part of providing the service; when you decide who to contact and send outreach, you are the controller for that.
What we collect and why
| Data | Why | Basis |
|---|---|---|
| Name, email, password (hashed), role, space | To create and secure your account | Contract |
| Business DNA, target lists, notes, pipeline | To run searches, scoring and drafts for you | Contract |
| Research briefs and prospect records | To deliver and store your results | Contract |
| Usage logs: actions, token counts, costs, credits | To meter usage, enforce limits, bill and prevent abuse | Contract / legitimate interests |
| Product emails: tips, trial reminders, follow-up digests | To help you use what you signed up for | Legitimate interests, with opt-out |
| Analytics (only if you consent) | To understand which pages and features are used | Consent |
Who we share it with
We use the following providers. Relevant parts of your data are sent to them so the product can work. They process it on our instructions and are not permitted to use it for their own purposes.
| Provider | What it does | Where |
|---|---|---|
| Anthropic (Claude) | Research, scoring and drafting; web search | US |
| Google (Gemini) | Research and web search | US / EU |
| OpenAI | Fallback model when the others are unavailable | US |
| Hunter.io | Work email lookup for a named person at a domain | EU |
| Apollo (optional) | Richer contact source, only if your space enables it | US |
| Companies House | Public UK company registry checks | UK |
| Supabase | Database, authentication and file storage | EU |
| Railway | Application hosting | EU / US |
| Resend | Sending product email | US / EU |
| Google Analytics 4 | Website analytics — only with your consent | US / EU |
International transfers
Some providers are outside the UK/EEA, mainly in the United States. Where that happens we rely on the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or an adequacy decision, as applicable to that provider.
Prospect research and AI
When you analyse a company we fetch public pages from its website and run web searches, then send that material to the AI providers above to produce a brief and a score. We do not knowingly seek out special-category data, and you should not enter it.
Model output can be wrong. Treat contact details as unverified until you check them.
Cookies and analytics
We use a small number of strictly necessary cookies to keep you signed in and to remember your interface preferences. These do not need consent.
Analytics runs only if you accept it in the cookie banner. Until you do, analytics is denied by default via Google Consent Mode, and no analytics cookies are set. You can change your choice at any time by clearing the banner's stored preference.
How long we keep it
- Account data: for as long as the account is open, then deleted or anonymised on closure.
- Research, prospects and pipeline: until you or your space delete them, or the account closes.
- Usage logs: retained for billing, abuse prevention and capacity planning.
- Email records: retained while needed to run product email and honour opt-outs.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to processing, and withdraw consent for analytics. Email hello@curiousbrand.co.uk and we will respond within one month.
If you are unhappy with how we handle it you can complain to the Information Commissioner's Office at ico.org.uk.
If you have received outreach from a user of this product and want your details removed, contact that sender directly — they chose to contact you. You may also email us and we will pass the request on and remove the record from our systems where we are able to.
Security
- Data is held in a managed Postgres database with row-level security, and each space's data is scoped to that space.
- Access to production data is limited to staff who need it to operate the service.
- Passwords are handled by our authentication provider; we never see them.
- Third-party API keys you provide are stored write-only and are never returned to the browser.
Contact
Curiously Branded Ltd, company number 13644728, registered office 2-4 Petworth Road, Haslemere, Surrey, England, GU27 2HR. Contact: hello@curiousbrand.co.uk. ICO registration: C2034924.