Privacy Policy for Scoutbot

Last updated: 10/2026

Scoutbot is a B2B platform that finds and analyzes companies in a market. This privacy policy explains which personal data we process when you visit our website, use the Scoutbot platform, or appear in the company data the platform provides, and which rights you have under the General Data Protection Regulation (GDPR).

1. Controller

For data that our customers enter into the platform (Customer Content, such as search queries, criteria, notes, lists and assistant chats), the customer is the controller and we process it on the customer's behalf (Art. 28 GDPR). This processing is governed by our terms and our data processing agreement with the customer, not by this policy. Customers receive the list of our sub-processors on request.

2. Website

Hosting and server logs. Our website and platform are hosted on servers in Germany. When you open a page, the server processes your IP address, the requested address, the time and your browser's user agent to deliver the page and to protect the service against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and working website). Server logs are deleted after 90 days at the latest.

Cookies and analytics. We use PostHog for website and product analytics, with data stored in the EU. In your browser, it runs only if you accept analytics in our cookie banner. PostHog then receives pseudonymous usage data: pages viewed, clicks, technical errors, device and browser information and, in the platform, an internal user ID without name or email address. You can change your choice at any time with "Cookie Settings" in the website footer. Legal basis: Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive (consent). Strictly necessary cookies, such as the session cookie after you sign in, do not need consent.

Contact form. When you send us a message, we process your name, email address, company and message to answer you. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (answering inquiries).

Demo booking. "Book a demo" opens Cal.com, an external scheduling service (Cal.com, Inc., USA). Cal.com processes the data you enter there under its own privacy policy: https://cal.com/privacy.

3. Platform accounts

Access to the platform is by invitation. For each user account we process:

• name, email address, password (stored only as a hash), and the organization and role in it
• two-factor authentication settings (stored encrypted)
• sessions: IP address, browser user agent and sign-in times
• a log of security-relevant and administrative actions
• for owners and admins: billing details, invoices, credit history and requests sent to us, including an optional phone number

Purpose: to provide the platform under the contract with your organization, to secure it and to bill it. Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (security and the contract with your organization, where you are not the contract party yourself) and Art. 6(1)(c) GDPR (tax law for invoices).

Sign-in with Microsoft. If you sign in with your Microsoft work account, Microsoft Entra ID sends us your name, email address and account identifiers. We do not keep Microsoft access tokens.

Emails. We send service emails (invitations, password resets, notifications, warnings before data deletion) through an email service provider in the EU, which keeps users with a confirmed email address in a contact list with their name until the account is deleted.

Support chat. The support chat loads only when you open "Help & support" in the user menu. The chat provider (located in the EU) then receives your name, email address, your messages and basic device information, and sets cookies to keep the conversation. Legal basis: Art. 6(1)(b) and (f) GDPR (support).

Usage events. To operate and improve the platform, our server sends pseudonymous events about its use to PostHog, such as "search completed", with the internal ID of the user or organization but no name or email address. This needs no cookie and no consent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working and improving product).

AI features. The platform uses AI models and web search to find, classify and describe companies. No decision with legal or similarly significant effect on a person is made by automated means. The platform scores companies, not people. Please do not enter special categories of personal data (Art. 9 GDPR) into the platform.

4. Persons in company data (Art. 14 GDPR)

The company profiles the platform provides can contain personal data of people who work at those companies:

• name, job title or role
• business email address, where publicly available
• the link to a public professional profile (e.g. LinkedIn)
• names of people mentioned in public company websites, news and funding information (for example founders or investors)

Sources: public company websites, public news and registers, web search results and public professional profiles, obtained through data providers.

Purpose and legal basis: our customers use the platform for business research, for example to find suppliers, partners or acquisition targets and the right contact at a company. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, and that of our customers, is B2B market research with business contact data that the persons themselves have made public in a professional context.

Recipients: the customers in whose results the company appears. Each customer is an independent controller for its further use of the data, for example when it contacts a person.

Retention: the data is kept as long as the company is part of a customer's results or lists, and is deleted with them.

Your right to object: you can object to this processing at any time (Art. 21 GDPR), and request access or deletion, by email to hello@scoutbot.net.

5. Recipients and data transfers

We use service providers in the following categories. Where they process personal data on our behalf, we have concluded data processing agreements with them.

• hosting, databases and backups (Germany)
• AI model providers (EU and USA; the provider in the USA keeps inputs without a fixed period and does not train on them)
• web search, website reading and data providers (EU and USA)
• email service provider (EU)
• support chat provider (EU)
• product analytics (data stored in the EU)
• the hosting provider of the previous version of Scoutbot (USA), until its data is deleted after the move to the current platform

Some providers are located in, or have parent companies in, countries outside the European Economic Area, in particular the USA. Where personal data is transferred there, the transfer is based on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework and the decision for the United Kingdom) or on the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards and the names of the recipients by email to hello@scoutbot.net.

When a customer connects its own AI agent (MCP) or sends data to its own systems by webhook, the customer chooses those recipients and is responsible for them.

6. Data security

We encrypt all connections, store passwords only as hashes, offer two-factor authentication, encrypt our backups and keep the data of each organization separate from the others.

7. Retention

• Account data: as long as the account exists.
• Data of an organization (Customer Content, results, lists, members): deleted 90 days after the subscription ends. The owners receive a warning email 7 days before.
• Server logs: 90 days at the latest.
• Backups: up to 90 days. Deleted data disappears from backups when they expire.
• Invoices and billing records: as long as tax law requires, usually ten years.

8. Your rights

You have the following rights under the GDPR:

• access to your data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• withdrawal of a consent at any time, with effect for the future (Art. 7(3) GDPR)
• a complaint to a supervisory authority (Art. 77 GDPR), for example the Portuguese Comissão Nacional de Proteção de Dados (CNPD) or the authority where you live or work

To exercise your rights, write to hello@scoutbot.net. For Customer Content, we forward your request to the customer responsible for it.

9. Changes to this policy

We update this policy when our services or the law change. We inform users of the platform about material changes.