← Back to home

Privacy Policy

Last updated: April 8, 2026

1. Who we are

Prospectyx SAS (hereinafter "Prospectyx", "we") operates the B2B prospecting platform accessible at prospectyx.com. As the data controller, we are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR).

2. Data collected

2.1 Data you provide to us

  • Account information: first name, last name, email address, password (hashed)
  • Billing information: payment details (processed by Stripe, never stored by us)
  • Prospect data you import: emails, names, companies, job titles
  • SMTP configuration: your email account credentials (encrypted with Fernet AES-128)

2.2 Data collected automatically

  • Activity logs: actions performed on the platform
  • Technical data: IP address, browser, operating system
  • Session cookies: required for authentication
  • Email metrics: opens and clicks on prospecting emails you send

3. Purposes and legal bases

PurposeLegal basis
Service delivery (account, campaigns, enrichment)Contract performance
Billing and subscription managementLegal obligation
Transactional emails (confirmation, invoices)Contract performance
Follow-up emails (trial end, newsletters)Legitimate interest / consent
Service improvement, analyticsLegitimate interest
Fraud prevention and securityLegitimate interest

4. Sub-processors

We use the following sub-processors, all subject to GDPR-compliant DPA agreements:

Sub-processorRoleLocation
SupabaseDatabase, authenticationEU (Frankfurt)
AnthropicAI content generationUSA (DPA signed)
StripeOnline paymentsUSA / EU (DPA signed)
ResendTransactional emailsUSA (DPA signed)
SentryError monitoringUSA (DPA signed)
VercelFrontend hostingUSA / Edge
RailwayBackend hostingUSA (DPA signed)

5. Data retention

  • Account data: for the duration of the subscription + 30 days after closure
  • Prospect data: until explicit deletion or account closure
  • Activity logs: maximum 90 days
  • Billing data: 10 years (French accounting obligation)

6. Your rights

Under GDPR, you have the following rights:

  • Right of access: obtain a copy of your data (response within 30 days, automated within 24h)
  • Right to rectification: correct inaccurate data from your profile
  • Right to erasure: deletion of your account and all your data within 72h
  • Right to data portability: export your data in CSV from settings
  • Right to object: object to processing for commercial prospecting
  • Right to restriction: restrict processing in certain cases

To exercise your rights, contact our DPO at: privacy@prospectyx.com

7. Security

  • TLS 1.3 encryption on all communications
  • SMTP passwords encrypted with Fernet (AES-128-CBC)
  • Data access restricted by Row-Level Security (Supabase)
  • Strict multi-tenant isolation: each organization only sees its own data
  • Regular security audits

8. Cookies

We use only strictly necessary cookies for the operation of the service (Supabase session cookies). No third-party advertising cookies are placed without your consent.

9. Transfers outside the EU

Some sub-processors (Anthropic, Stripe, Resend) are based in the United States. These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Contact and complaints

For any questions regarding your personal data: privacy@prospectyx.com

You have the right to lodge a complaint with the CNIL (French data protection authority): www.cnil.fr

TermsLegal noticeHome