Privacy Policy

1. INTRODUCTION

This Privacy Policy explains how SPHERESCOUT PTE. LTD. ("SphereScout", "we", "our" or "us"), a company registered in Singapore (UEN 202520317R), collects, uses and protects personal information.

It covers two groups of people: our users, who use our website, dashboard, API and MCP connector (the "Service"); and the people whose business contact details appear in our business database (section 4). For both, SphereScout is the controller of the personal information described here.

2. INFORMATION WE COLLECT ABOUT OUR USERS

Account information

  • Email address and name
  • Password, stored in hashed form (never in plain text)
  • If you sign in with Google: the name and email address of your Google account
  • Profile information you choose to provide

Billing information

Payments are processed by Stripe. We do not store your card details; we receive your subscription status, invoices and payment history.

Usage information

  • Your searches and filters, exports and download history
  • Login and activity logs, IP address, device and browser information
  • How you use our website and dashboard (product analytics)

Security and fraud prevention

To prevent abuse of free trials and automated sign-ups, we use bot protection (Cloudflare Turnstile) and device identification (Fingerprint) when you sign up or sign in, and we check the domain of your email address against lists of disposable email providers.

Communications

Messages you send us by email or through our website chat (Crisp), and whether you open or click our emails.

3. AI ASSISTANTS (MCP CONNECTOR)

When you connect SphereScout to an AI assistant such as Claude or ChatGPT through our MCP server:

  • We receive only what the assistant sends to our tools: the categories, places and filters of your searches, and your export requests. We do not receive your conversation with the assistant.
  • You sign in with OAuth. We store access tokens in hashed form; they expire after one hour, and refresh tokens after 90 days. You can disconnect an assistant at any time from the AI & API page of your dashboard, which revokes its access immediately.
  • Searches and exports made through an assistant are recorded in your account, including your export history, like those made in the dashboard.
  • We record how the connector is used (the tool, a summary of its search parameters, and the assistant's name) to operate and improve the Service.
  • The assistant's provider processes what the assistant reads to answer you, such as counts or rows you ask it to show, under its own privacy policy.

4. BUSINESS DATA IN OUR DATABASE

SphereScout provides a database of local businesses. Most of it describes businesses rather than people, but some details can relate to an identifiable person, for example a sole trader's name, or an email address or phone number that includes a person's name.

What we hold

Business name, address, categories, phone numbers, email addresses, website, social media profiles, opening hours, ratings and review counts, and whether the business is still operating.

Where it comes from

Publicly available sources: online business listings (including Google Maps), businesses' own websites and public social media profiles, and official business registries.

Why and on what basis

We make this information available to our customers so they can contact businesses for professional purposes (business-to-business prospecting). We rely on legitimate interests, ours and our customers', in that processing; it concerns contact details that businesses publish so that they can be reached.

Our customers must use the data lawfully, including anti-spam, direct-marketing and opt-out rules, under our Terms of Service.

Your choices

If your details appear in our database, you can object to this processing or ask us to remove them through our privacy request page (https://www.spherescout.io/privacy-request/) or by emailing contact@spherescout.io with the business name and address. We remove the business and keep a minimal record (such as its identifier, domain or phone number) on a suppression list so that it is not added again.

5. HOW WE USE INFORMATION AND OUR LEGAL BASES

  • To provide the Service, your account, searches and exports (performance of our contract with you)
  • To process payments and keep billing records (contract and legal obligations)
  • To keep the Service secure and prevent fraud and abuse (legitimate interests)
  • To understand how the Service is used and improve it (legitimate interests, or consent where the law requires it)
  • To send service emails, such as export-ready notices, and product news and offers (legitimate interests; you can unsubscribe from marketing emails at any time)
  • To comply with legal obligations and respond to lawful requests

6. SHARING AND SERVICE PROVIDERS

We do not sell our users' personal information. We share personal information only with the service providers that help us run the Service, under contracts that limit their use of it, or when the law requires it.

  • Stripe: payments
  • Twilio SendGrid: email delivery
  • OVHcloud: application hosting and databases
  • Google Cloud: storage of export files; Google sign-in
  • Vercel: website and dashboard hosting
  • Cloudflare: content delivery, security and bot protection
  • PostHog (EU): product analytics
  • Crisp: website chat
  • Fingerprint: device identification for fraud prevention

7. INTERNATIONAL DATA TRANSFERS

We are based in Singapore and our service providers process data in Singapore, the European Union and the United States. When personal information from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. DATA RETENTION

  • Account information: while your account is open, then deleted on request or after closure, except what we must keep by law
  • Billing records: for as long as tax and accounting laws require
  • Export files: their download links expire; your export history stays in your account while it is open
  • AI assistant access tokens: one hour; refresh tokens: 90 days, unless you disconnect earlier
  • Logs and security records: for a limited period, to keep the Service secure
  • Business data: refreshed regularly; businesses that close are marked as closed; removed when removal is requested

9. DATA SECURITY

We protect personal information with encryption in transit, hashed passwords and access tokens, access controls and monitoring. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the relevant authorities of a data breach when the law requires it.

10. YOUR RIGHTS

Depending on where you live, you have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Delete your information
  • Restrict or object to certain processing, including direct marketing at any time
  • Receive your information in a portable format
  • Withdraw your consent where we rely on it, without affecting earlier processing
  • Lodge a complaint with a data protection authority, such as your local authority in the EU or UK, or Singapore's Personal Data Protection Commission

To exercise these rights, use our privacy request page (https://www.spherescout.io/privacy-request/) or email contact@spherescout.io. We may need to verify your identity, and we respond within one month.

11. US STATE PRIVACY RIGHTS (INCLUDING CALIFORNIA)

This section applies to residents of California and other US states with consumer privacy laws, and adds to the rest of this policy.

Personal information we collect

We collect it for the purposes in section 5 and disclose it to the service providers in section 6. Business contact details from our database are disclosed to our customers.

  • Identifiers: name, email address, IP address and account identifiers (from our users)
  • Commercial information: subscriptions, purchases, searches and exports (from our users)
  • Internet activity: how users use our website and Service
  • Professional information: business contact details in our database, such as a business's name, address, phone numbers, email addresses, website and social profiles (from public sources, see section 4)
  • Account login credentials, used only to provide and secure your account

Sale and sharing

We do not sell or share our users' personal information, and we do not share personal information for cross-context behavioral advertising. Making business contact details from our database available to our customers may be considered a "sale" under California law. You can opt out at any time through our privacy request page (https://www.spherescout.io/privacy-request/), linked as "Do Not Sell or Share My Personal Information" at the bottom of every page. We do not knowingly sell the personal information of anyone under 16.

Your rights

  • Know what personal information we hold about you, its sources, and who we disclose it to, and get a copy
  • Delete your personal information
  • Correct inaccurate personal information
  • Opt out of the sale or sharing of your personal information
  • Not be treated differently for exercising these rights

How to exercise them

Use our privacy request page (https://www.spherescout.io/privacy-request/) or email contact@spherescout.io. We confirm requests by email and may ask for more information to verify your identity. An authorized agent can make a request for you with your written permission. We respond within 45 days (extendable once by 45 days, with notice) and handle opt-outs within 15 business days.

If we decline your request, you can appeal by replying to our response; we will answer in writing within the time your state's law requires. If your appeal is denied, you can contact your state's attorney general. We keep a record of requests and how we handled them for 24 months.

12. AUTOMATED DECISIONS

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

13. COOKIES

We use cookies and similar technologies for authentication, security, analytics and website chat. See our Cookie Policy for details and how to manage them.

14. CHILDREN'S PRIVACY

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy. We will post the new version here with its date, and tell users about significant changes by email or in the Service.

16. CONTACT US

For privacy questions or requests, contact our Data Protection Officer, Raphael Canyasse:

Email: contact@spherescout.io

Address: SPHERESCOUT PTE. LTD., 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914

Last Updated: 23 October 2026