ProspectVerity Privacy Policy

1. Scope

This Policy applies to the internal ProspectVerity application and its supporting operational systems. The Service is invitation-only and is not currently offered for public customer registration.

Third-party websites and services have their own privacy practices. This Policy does not replace their notices.

2. Information we handle

Account and authentication information

We handle an authorized user's email address, display name, workspace membership and role, invitation status, authentication events, and passwordless sign-in state. Authentication credentials, one-time codes, and session tokens are processed for authentication and are not intended to appear in product records, analytics, or ordinary logs.

Application and audit activity

We handle campaign settings, accountable membership and review actions, execution state, usage records, audit events, and other activity needed to operate and secure the Service.

Business and prospect information

We handle business names, public locations, business categories, provider identifiers, website and contact evidence, source observations, classifications, review states, and internal prospecting decisions. This information may concern businesses, sole proprietors, or people whose information is published in a business context.

Business information may constitute personal information when it identifies a sole proprietor, individual professional, home-based business operator, or business contact.

Device, log, and error information

We handle limited technical information such as request and correlation identifiers, timestamps, route or operation names, duration, outcome, release version, safe error categories, and security events. The Service is configured to avoid recording raw provider payloads, authentication secrets, or unnecessary personal information in logs and error reports.

3. How we use information

We use information to:

• authenticate authorized users and enforce workspace access;
• identify, organize, review, prioritize, and export business prospects for authorized business-development and outreach activities;
• apply provider, cost, retention, and security controls;
• maintain accountable audit history and investigate operational or security problems;
• monitor availability, diagnose errors, and improve the internal workflow; and
• comply with applicable law and enforce the Terms of Use.

Contact information discovered through the Service does not establish consent for every outreach method, and users are responsible for evaluating applicable channel-specific legal requirements.

ProspectVerity's internal product-analytics abstraction currently has no external analytics destination. If an external analytics provider is enabled later, this Policy will be reviewed and updated before transmission begins.

4. Cookies and sessions

The Service uses strictly necessary cookies or equivalent browser storage to establish and protect authenticated sessions, complete passwordless sign-in, and preserve safe navigation. We do not currently use advertising cookies or an external product-analytics cookie.

5. Service providers and disclosures

We disclose information only as reasonably needed to operate the Service, comply with law, protect rights and security, or complete a transaction involving the Service. Current supporting providers include:

• Supabase for managed database and passwordless authentication infrastructure;
• Render for application hosting and operational logs;
• Sentry for sanitized error monitoring;
• an uptime-monitoring provider for availability checks; and
• Google Maps Platform for Places API business discovery when the provider is explicitly enabled.

Authentication email delivery and future service-provider integrations are used only when configured and enabled. Provider access is limited to the information needed for the applicable function.

6. Google Maps Platform and Places data

When enabled, ProspectVerity uses Google Places API content under the Google Maps Platform Terms of Service, applicable service-specific terms, and Google Privacy Policy.

Google-derived content is kept separate from independently collected evidence, displayed with required attribution, and handled according to provider-specific storage, caching, use, and export restrictions. Temporary Google content is retained only for the period permitted by the applicable Google Maps Platform terms and the Service's configured retention controls. Google Place IDs may be retained where permitted for identity and deduplication.

7. Data retention

We retain information for only as long as reasonably needed for the internal workflow, security, auditability, provider obligations, and applicable legal requirements. Retention varies by record type. Temporary provider content follows its configured provider-specific limit; operational logs, audit records, account records, and independently collected business evidence may follow different periods.

The current product does not provide a general self-service deletion workflow. Authorized users may submit a request using the contact method below, and the operator will evaluate it against technical, contractual, security, and legal obligations.

8. Security

We use access restrictions, invitation-gated authentication, workspace authorization, provider execution gates, secret separation, structured logging controls, and other administrative and technical safeguards appropriate to the current internal validation stage. No system can guarantee absolute security.

9. Processing locations

The Service is operated from the United States, and information may be processed and stored in the United States and other locations where our service providers operate.

10. Choices and requests

Authorized users may request correction of their profile information or ask questions about information handling by contacting the operator. Requests concerning business or prospect information are evaluated in light of the information's source, provider terms, audit requirements, and applicable law.

The Service does not currently sell personal information or share personal information for cross-context behavioral advertising as those terms may be defined under applicable law. Jurisdiction-specific rights may apply depending on the requester and circumstances; this Policy does not promise rights where they do not apply.

11. Children

The Service is an internal business tool and is not directed to children. Authorized access is intended for adults acting in a business capacity.

12. Changes to this Policy

We may update this Policy when the Service, providers, or information practices change. The revised effective date will be posted here. Material changes will be communicated to authorized users through a reasonable internal channel before they take effect when practicable.

13. Contact

Privacy questions and requests may be directed to privacy@prospectverity.com or: