Privacy Policy

Prospectlab is a service operated by Designbite Ltd, a company registered in England and Wales (company number 10223220), with its registered office at 26 Altenburg Avenue, London W13 9RN. In this policy, "we", "us" and "our" mean Designbite Ltd. We are the data controller responsible for the personal data described below. For any question about this policy or your personal data, contact us at martin@prospectlab.ai.

Account data: your name, work email address and password. Your password is stored only as a secure hash by our authentication provider (Supabase) and is never visible to us.
Account profile: an account name we create from your name when you sign up.
Security and usage data: your IP address and basic session information, recorded when you sign in or take security-relevant actions, so we can protect your account and the service.
Team data: if you invite colleagues, the email addresses you invite.
Prospect data you upload: the names, work email addresses, job titles and company details of the business contacts you choose to add to Prospectlab.
Billing data: your billing email and address. Card payments are handled directly by Stripe; we never see or store your card details.

To create and run your account and provide the service you signed up for. Lawful basis: performance of our contract with you.
To generate and personalise email sequences, including enriching prospect data through third-party providers. Lawful basis: our legitimate interests, and those of our customers, in carrying out business-to-business outreach.
To keep the service secure, prevent abuse and investigate incidents. Lawful basis: our legitimate interests in protecting the service.
To take payment and keep accounting records. Lawful basis: performance of our contract and compliance with our legal obligations.

We do not sell your personal data, and we do not use your data, or your prospects' data, to train artificial-intelligence models.

Designbite Ltd is the data controller for the personal data whose purposes and means we determine. This includes your account data and the enrichment processing we carry out on prospect data, for example when we send a prospect's details to an enrichment provider to add company information. When you upload prospect data and decide who to contact and what to send, you are the data controller for those targeting and outreach decisions, and you are responsible for having a lawful basis to contact them.

We use the following providers to deliver the service. Each operates under its own published data processing terms, and we share only the data each provider needs.

Supabase — Database, accounts and storage — All account data, uploaded prospect data, usage data — United Kingdom / EU (London region)
Stripe — Payment processing — Billing email and address (card data handled directly by Stripe) — United States
Anthropic — AI generation of email content — Prospect details included in prompts (company, role, enrichment excerpts) — United States
Smartlead — Sending email sequences — Prospect names, email addresses and companies; generated email subjects and bodies — United States
Apollo — Prospect enrichment — Prospect email address — United States
Perplexity — Company research — Company name and website domain — United States
Logfire — Performance and reliability monitoring — Service telemetry, which may include prompt and response content — EU
Sentry — Error monitoring — Technical error and diagnostic data — United States
HubSpot — CRM (only if you use our CRM integration) — Contact email and campaign details — United States / EU
Firecrawl — Company website research (disabled by default) — Company website addresses — United States

Anthropic does not train its models on the content we send through its API and retains it only as set out in its commercial terms.

Your account data and the prospect data you upload are held primarily in the United Kingdom and the European Union (Supabase, London region). Some of our providers are based in the United States. Where personal data is transferred outside the UK or EU, we rely on the UK International Data Transfer Agreement, the UK Addendum, or the EU Standard Contractual Clauses to protect it.

We keep your account data and the prospect data you upload for as long as your account is active. We do not run an automatic deletion schedule. When you ask us to delete your data, by emailing martin@prospectlab.ai, we delete it; and if you close your account we delete your personal data on request. We keep billing and transaction records for six years to meet UK tax and accounting law.

Under UK data protection law you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data deleted; restrict or object to how we use it; receive your data in a portable format; and, where we rely on consent, withdraw it. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. To exercise any of these rights, email martin@prospectlab.ai and we will respond within the time limits set by law.

We do not make decisions that have a legal or similarly significant effect on you using only automated processing. Email content is generated with AI, but you review it and decide whether to use it.

We use only strictly necessary cookies, which keep you signed in and protect the service. We do not use advertising or tracking cookies, so no cookie consent banner is required. For full details, see our Cookie Policy.

We will let you know by email if we make a material change to this policy. The "Last updated" date at the top of this page shows when it was last revised.