Privacy Policy
Last updated: July 2026
At BasedOnBusiness, we value your privacy. This policy explains what data we collect when you use our service and how we use it.
Data We Collect
For accounts we collect your name, email address and optional company name. For searches we store parameters and results. Results can include public business listings and email addresses explicitly published on business websites, together with their source pages and role/person classification. We also record privacy-minimized account, scrape, export, checkout and payment events without search terms or lead contents. With Analytics consent, campaign source and landing-page attribution are attached to account events. Stripe processes card details; we do not store card numbers.
Published Business Contacts
Email enrichment is website-only. We do not guess addresses, probe mail servers or scrape private profiles. A named work email can still be personal data even when publicly published. Public availability does not by itself authorize unsolicited marketing.
Legal Basis and Responsible Use
We process account data to provide the contracted service and may rely on legitimate interests for proportionate collection of public business contact data. Users must independently determine a lawful basis for outreach and comply with transparency, objection, ePrivacy and local anti-spam requirements.
How We Use Your Data
Collected data is used for service delivery, account management, payment processing, support, and aggregate product-funnel measurement such as signup, first export and paid conversion. We do not share your data with third parties for marketing purposes.
Third-Party Services
We use Supabase (authentication and database), Stripe (payment processing), Google Maps API (data collection), Tawk.to (live support), and Vercel (hosting and cookieless, aggregated site analytics). Vercel Web Analytics sets no cookies and does not track individuals across sites. Each of these services operates under its own privacy policy.
Cookies
We use essential cookies for session management. When you consent to Analytics, we store a first-touch campaign attribution record in first-party browser storage and enable anonymous product usage events. Visit statistics are measured cookie-free by Vercel Web Analytics. We do not use advertising cookies. If you arrive through an affiliate partner's link, two additional strictly necessary cookies are set. See the Affiliate Programme section below.
Affiliate Programme
If you arrive through a partner's referral link, we store two first-party, HttpOnly cookies for up to 90 days: an opaque visitor identifier and the partner's public slug. Neither holds personal data, and both are deleted as soon as an account is created. Their only purpose is to credit a referral to the correct partner and to prevent self-referral fraud, so we treat them as strictly necessary rather than marketing cookies. The click itself is recorded with a salted, irreversible hash of the IP address and a country code, never the address itself. Partners can see how many people signed up through their link, but never who: we do not disclose your identity, e-mail address or company to them.
Security and Access Logs
To protect accounts and prevent abuse we record the IP addresses your account is used from, together with a country code and a hashed browser identifier. The lawful basis is our legitimate interest in account security and fraud prevention, not consent. A security log that disappears on withdrawal would not protect anyone. These records are kept for 180 days and then deleted automatically. They are read only by our systems and by authorised staff investigating a specific incident.
Your Rights (GDPR)
Account holders may request access, correction, deletion and portability. If an email address in our business-contact data belongs to you, send the removal or objection request from that exact address to the privacy contact below so we can verify control. After verification, we remove it from existing results and add it to our suppression list to prevent future collection.
Data Retention
Account data is retained while the account is active and removed within 30 days after account deletion, subject to legal obligations. Public business records are refreshed over time and valid correction, deletion or objection requests are applied to the relevant contact data.
Contact
For privacy and verified email-removal requests: ilyasyildirim@boztekno.com