Privacy policy
Buscalid is a tool that helps small businesses and people selling a product or service find companies that might need it, and write to them. This policy explains what data we process, why, on what legal basis and what rights you have. It is written to be read, not just to tick a compliance box.
1. Who this policy covers
It deals with two different situations:
- Buscalid users: anyone who signs up and uses the platform (sections 2 to 5).
- Companies that appear as "leads": businesses whose website we analyze because they might fit what a user sells (section 6).
2. What data we process about users
| Data | Purpose | Legal basis |
|---|---|---|
| Email and password (the password is stored hashed by our authentication provider; we never see it) | Create and protect your account | Performance of the contract (Art. 6.1.b GDPR) |
| Your business profile: what you sell, to whom, your name, signature and pitch for messages | Find suitable leads and draft the messages you review and send | Performance of the contract |
| The Gmail address and app password you connect to send email | Send the emails you approve from your own account. The app password is stored encrypted and only decrypted at the moment of sending | Performance of the contract; you can disconnect it at any time |
| Usage log: searches run, leads generated, messages sent, cost of the services consumed | Apply your plan limits, invoice, detect abuse and improve the service | Performance of the contract and legitimate interest (Art. 6.1.f) |
| IP address at sign-up and when using the public demo | Prevent repeated sign-ups to exhaust the free trial and limit demo usage | Legitimate interest (abuse prevention) |
| Opens and clicks on the emails you send (tracking pixel) | Show you whether your message was opened. You can turn it off for each send | The user's legitimate interest; see section 7 on your responsibility towards your recipients |
We do not process special categories of data or make automated decisions with legal effects on you. We do not sell your data.
3. Who else accesses your data (processors)
We use providers that process data on our behalf, under data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and running the service's code | European Union (Frankfurt) |
| Vercel | Hosting of the website and the application | United States, under EU standard contractual clauses |
| Google (Gemini API) | Analysis of lead websites and drafting of messages. Google does not use this data to train its models under its paid-API terms | United States, under standard contractual clauses |
| Serper.dev | Google searches to find candidates. It only receives search queries, not your account data | United States |
| Google (Gmail) | The emails you approve go out from your own Gmail account, using your app password | Depends on your Google account |
| Paddle | Payment processing, taxes and invoicing for paid plans. Paddle acts as merchant of record and as an independent controller of the payment data you give it; we only receive your plan status and billing identifiers, never your card details | United Kingdom / European Union |
| Resend | Sending your account emails (sign-up confirmation and password reset) | European Union (Ireland) |
| Google Fonts | Typefaces for the public website. When loading them, your browser sends your IP to Google | United States |
4. How long we keep your data
- Account and profile data: while the account is active. If you delete it, we delete your account, profile, leads, drafts and sending credentials within 30 days at most.
- Usage and billing records: 5 years, for tax obligations, in the case of paying users.
- Sign-up and demo IPs: 90 days.
- Suppression list (addresses that asked not to receive more emails): indefinitely, precisely so we never write to them again.
5. Your rights
You can access, rectify and erase your data, object to its processing, request restriction and portability, and withdraw consent where that is the legal basis. Write to david@buscalid.com from your account email and we will reply within one month at most. If you believe we have not responded properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to your local supervisory authority.
6. Companies that appear as leads
This is the section we care most about explaining well, because it is what the product does.
What we collect
- Public information from the company's website: its domain, what it does, approximate size, country and language, its public social media profiles and its contact page.
- Where one exists, a company email address published on its own website and of a generic type: info@, hello@, contact@, sales@ and similar.
- Where the company has announced its launch on a public forum (for example, Hacker News), the link to that post.
What we deliberately do not collect
- Any email that identifies a person (first.last@company, first@company) or addresses from personal providers (Gmail, Outlook…), even if published. If our system detects one, it discards it and does not store it.
- No mobile phone numbers, no personal LinkedIn profiles and no data from third-party contact providers. We do not use people-enrichment services.
A company's data (name, domain, generic mailbox) is generally not personal data. Where some of it could be (for example, a sole trader whose name matches their brand), we process it on the basis of legitimate interest (Art. 6.1.f GDPR and Art. 19 of Spain's LOPDGDD): to allow an individual, relevant, professional contact about their activity, with the possibility of immediate objection. We keep the company record as long as it is useful for the service and update or delete it when its website stops being available.
If your company appears in Buscalid
You can ask us not to show it to any user or contact it again by writing to david@buscalid.com with your domain. We will do it within 10 days at most, with no need to justify it. Every email sent through Buscalid also includes a one-click unsubscribe link that applies instantly.
7. Your responsibility as a user who sends emails
Messages go out from your own account, with your name and your pitch: you are responsible for those communications and Buscalid acts as a processor to help you draft, send and measure them. So by using the service you commit to contact only companies for which your offer is relevant, to honor unsubscribes and to comply with the rules on commercial communications (in Spain, Art. 21 of Law 34/2002, LSSI; elsewhere, the equivalent such as CAN-SPAM or PECR). Buscalid helps you technically: it only delivers company mailboxes, includes the unsubscribe link in every send, blocks addresses that have unsubscribed and limits the number of daily sends.
8. Security
Connections are encrypted (TLS). Gmail app passwords are stored encrypted with a key that never leaves the server. Each user can only see their own leads, messages and data; the service's internal functions verify the identity of whoever calls them. If we detected a breach affecting your data, we would tell you without delay and notify the Spanish Data Protection Agency within 72 hours where required.
9. Changes
If we change this policy in a material way, we will tell you by email or inside the application before it takes effect. The date above shows the current version.