Privacy policy

Effective [date of publication]

Buyerhint is run by [company legal name] ([country of registration and company number]), [registered postal address] (“we”, “us”). This policy explains what data we handle about four groups of people: the businesses and teams who use Buyerhint (“customers”), the people our customers find and contact through it (“prospects”), creators on our marketplace, and visitors to our website and free tools.

If you're here because someone contacted you, read Data about prospects and Your rights. To be removed right away, use the opt-out page.

Privacy questions and requests: [privacy contact email].

Our representative in the European Union (GDPR article 27): [EU representative name and address].

Our representative in the United Kingdom (UK GDPR article 27): [UK representative name and address].

Who decides what

For prospect data, the customer decides whom to look for, which records to keep and whom to contact. The customer is the controller of that data, and we process it on their behalf under our data processing agreement (in California terms, we are their service provider).

We are the controller of everything else in this policy:

• customer accounts, billing records and how customers use the product;
• creator accounts on the marketplace;
• our website, free tools and the emails we send ourselves;
• the opt-out list, which keeps an opted-out person out of every customer's workspace;
• security records that protect the service from abuse.

We are not a data broker. We don't keep a shared database of people, and we don't sell, rent or license prospect records. A prospect record exists only in the workspace of the customer who found it.

Data about prospects

Buyerhint helps customers find people who publicly showed interest in their field, for example by replying to a post about it, or whose job matches the customer's ideal customer profile in a licensed business contact database, and draft a message to them. We only use public data and work data from licensed providers, with four safeguards:

• We never collect profiles that are hidden, private or restricted.
• Every record is deleted automatically 12 months after the last public activity we recorded. New public activity restarts the 12 months. A record from a business contact database is deleted 12 months after we added it. Data from YouTube (comments and the commenter's channel) is deleted 29 days after we read it, unless the person comments again, as YouTube's API rules require.
• Every record keeps its source, so we can tell you where your data came from, and you can opt out at any time.
• We answer access, correction and deletion requests.

What a prospect record can contain

• Name, job title, company and country.
• Public profile links and handles, for example on X, Bluesky, Reddit, Hacker News, GitHub, YouTube and Stack Overflow.
• The public activity that made the person relevant (a reply, like, follow, mention or post), with a link and a short excerpt.
• A work email address, found through an email-finding provider or a licensed business contact database, only when the customer asks for one.
• A fit score and the reasons for it, notes and drafts the customer writes, and messages exchanged with the customer: emails, replies to and mentions of the customer's own X account, and LinkedIn conversations the customer pastes in.

We don't collect sensitive data, such as health, religion, political opinions or sexual orientation.

Where it comes from

• Public posts and activity on X, Bluesky, Reddit, Hacker News, GitHub, YouTube and Stack Overflow, read through those platforms' official APIs.
• Replies to and mentions of a customer's own X account, read through X's official API after the customer connects it. Posts from protected accounts are skipped.
• Files a customer imports, such as a CSV export of their own LinkedIn connections.
• LinkedIn conversations a customer copies from their own LinkedIn inbox and pastes in. We don't read LinkedIn ourselves.
• Job changes: the company and position in a CSV the customer re-imports, and the company field of a public GitHub profile.
• A licensed business contact database (Apollo), when a customer runs the prospecting agent: name, job title, company, country and LinkedIn profile link of people who match the customer's search, and a work email only when the customer asks for one. Apollo collects this data under its own privacy policy.
• Email-finding and business contact data providers (see Providers we use).

We don't scrape LinkedIn. We don't send automated messages on LinkedIn or X: the product drafts them and the customer sends each one by hand. We don't look up email addresses for people found on GitHub, because GitHub's rules don't allow emailing its users without their request.

Buyerhint uses YouTube API Services. Google's handling of that data is covered by the Google Privacy Policy.

Why, and on what legal basis

Customers use prospect data to find and contact people who may want their product, in a business capacity. Under the GDPR and UK GDPR the legal basis is the customer's legitimate interest in business-to-business prospecting (article 6(1)(f)). That interest is balanced by the safeguards above: only public or work-related data, a fixed retention period, the source kept with every record, and an opt-out that works across all customers. First emails sent through the product say who is writing and link to this policy and to an unsubscribe page. Cold emails the product drafts for a customer to send from their own mailbox carry the same footer: the customer's business name and postal address, how they found the person, and links to this policy and to our opt-out page.

Scoring

The fit score ranks prospects so the customer knows whom to look at first. A person always reviews the result and decides whether to write; no decision with legal or similarly significant effects is made about you by automated means.

Website visitors of our customers

Customers can add a small script to their own website to see which companies visit it. The script sends the page path; our server looks up the visitor's network address to find the company that owns it, then discards the address. We store the company only, never the address, a cookie or anything about a person, and this applies everywhere, including the European Union and the United Kingdom. The script doesn't run when the browser sends a Global Privacy Control signal. Customers are responsible for asking for consent where their local law requires it.

Data about customers

• Account: name and email address, workspace name, team members and their roles.
• Billing: Creem sells the subscription to you as merchant of record and is the controller of your payment data. We receive a customer id, the plan and the subscription status; we never see card details.
• Connected mailboxes: an encrypted access token. To show replies we read only new messages in conversations started from Buyerhint. Buyerhint's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Other services you connect, such as Slack or HubSpot, receive only what you send them.
• Launch videos: the web address you give us, the screenshots and text we capture from its public pages, files you upload, the script, and the clips, voiceover, music and videos made from them. They stay in your workspace until you delete them or the workspace.
• Usage: which features you use and how many monthly units you have used, so plan limits work.

Data about creators

• Public profile, audience statistics and post performance: read through X's, LinkedIn's, Instagram's and TikTok's official login, through YouTube API Services for YouTube channels (public data only, no Google sign-in), or entered by you for newsletters and YouTube and checked against an analytics screenshot you upload.
• For YouTube channels, we read your channel's public statistics and recent videos, and the one-time code you put in your channel description to confirm the channel is yours. We refresh this data daily, delete it if it hasn't been refreshed for 30 days, and delete it at once when you remove the channel.
• For Instagram and TikTok, after you connect your own account: your account id, username and follower count, and on Instagram professional accounts with at least 100 followers, the share of your followers by country, age and gender. When you deliver a paid post for an order, we read that post's caption and publish time to check its label. Your username and follower count show on your public profile; audience shares only to signed-in brands. We refresh this data daily. We delete it when you disconnect the account, when you remove our app in Instagram or TikTok, when you ask Meta to have us delete it (you get a link to check the request's status), when the account's access can't be renewed, or after 29 days without a refresh.
• For newsletters, we store its address, the platform it's hosted on, your subscriber count, open and click rates, and your screenshot. To check that a sponsored issue is labeled, we read that issue's public web page.
• An authenticity score that checks for signs of bought or fake audiences, so brands can trust the numbers. You can ask us to review it.
• Orders, messages with brands, and the posts made for a campaign, including whether they carry a sponsorship label.
• Clicks on your tracked campaign links: time, referring site and country, never your followers' network addresses.
• Payout details, held by our payment provider; we keep the payout records tax law requires.

Our website and free tools

• Text you type into a free tool is scored in your browser. It reaches our servers only when you ask for a share link, an emailed report or AI help, and isn't stored. AI help (the rewrite and the launch post writer) sends it to Anthropic. A share link contains only the tool and the score.
• If you ask us to email you a report, we store your email address, the consent you gave and the report's scores, and send up to three tips about the free tools and our product over the next 10 days. They stop when you unsubscribe (one click in any email, which also deletes what we stored and adds a one-way hash of your address to our opt-out list, so we stop emailing you and our customers can't add your address in the product) or create an account.
• We count how often each free tool is used per day, as a number per tool. We don't record who used it and set no cookie for it.
• If you start a trial from a free tool's page, we note on your account which tool you came from. It's deleted with your account.
• Cookies: only the ones the site needs to work, such as keeping you signed in and remembering which workspace you chose. We don't use advertising or analytics cookies.
• Security: to stop abuse of public forms we count requests per network address. We store a one-way hash of the address, never the address itself.

Legal bases for our own processing

Providers we use

Each provider gets only what its job needs and is bound by a data processing agreement.

We may also disclose data when the law requires it, or to a buyer if the business is sold, under this policy. We don't sell personal data or share it for cross-context behavioral advertising, and we don't use it to train AI models. Anthropic doesn't train its models on content sent through its commercial API.

International transfers

Our main database is in Germany. Some providers, and our own team, work from outside the European Economic Area and the United Kingdom. Where a country has no adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK addendum to them, or on the EU–U.S. Data Privacy Framework where the provider is certified. You can ask us for a copy of the safeguards.

How long we keep data

Your rights

Depending on where you live, you can ask us to tell you what data we hold about you and where it came from, give you a copy, correct it, delete it, restrict its use, or move it to another service. You can object to its use for prospecting at any time, and we will stop. Where we rely on your consent, you can withdraw it.

• Fastest: the opt-out page. It deletes matching prospect records from every customer's workspace at once and blocks the identifier from being added again.
• For a copy, a correction or anything else, use the request form on the same page or write to [privacy contact email].

We may ask you to confirm you control the email address or profile in question. We reply within one month (45 days for California requests); if a request is complex we may extend that once and will tell you why. When a request is about a customer's prospect data, we carry out opt-outs and deletions ourselves and pass other requests to the customer, who is the controller.

You can complain to the data protection authority where you live or work. In the United Kingdom that is the Information Commissioner's Office.

California

In the last 12 months we collected these categories of personal information about prospects: identifiers (name, handles, work email), professional information (job title, company), internet activity (public posts and the interactions in them) and inferences (the fit score). The sources, purposes and retention periods are listed above. We don't sell or share personal information and don't use sensitive personal information. California residents have the right to know, delete and correct their personal information and won't be treated differently for using these rights. An authorized agent can make a request for you with your written permission.

Security

Data is encrypted in transit and at rest. Each customer's data is kept apart by row-level security in the database. Mailbox tokens are encrypted, and opt-out identifiers are stored only as one-way hashes. Access to production data is limited to staff who need it for their work, and their actions are logged. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

Children

Buyerhint is for businesses and isn't meant for anyone under 18. We don't knowingly collect data about children.

Changes

We will post changes here with a new effective date. If a change matters, we will email customers before it takes effect.