What we hold, why we hold it, who else touches it, and how to make us delete it. Including — unusually — data about businesses who never signed up.
Version 1.0 Last updated 1 August 2026
Scoutline is the controller for the personal data described here.
Scoutline is operated by Ehan Abrar, a sole trader based in Aberdeen, Scotland. That individual is the data controller.
For anything about your data — access, correction, deletion, or a complaint — email legal@scoutline.uk, or use the contact page and choose “Data, privacy or removal request”. If you need a postal address for a formal notice, ask at that address and we will provide one.
You always have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk/make-a-complaint — you do not have to come to us first.
| What | Why |
|---|---|
| Email address | Identifies the account, and is how we send service messages. |
| Password, hashed | Sign-in. Stored as a bcrypt hash, never as text — we cannot read it and cannot tell you what it is. |
| Role and plan | Determines access and allowances. |
| Session token | Keeps you signed in. Stored server-side; the cookie holds only an opaque reference. |
| Failed sign-in attempts, with IP address | Rate limiting, to make password-guessing impractical. Cleared on a successful sign-in. |
| Subscription and billing status | Set by Stripe when a payment succeeds or a subscription changes. We hold a Stripe customer reference, not card data. |
| Usage records | Which businesses you discovered, claimed and generated for; which territories you hold; token counts and costs per generation. This is what allowances are counted from. |
| Messages you send us | Contact enquiries and bug reports, with whatever you chose to put in them. |
If you only browse the public site, we do not ask you for anything. We use Vercel Analytics, which reports aggregate page-view figures and does not set an identifying cookie or build a profile of you.
This is the section most privacy policies would not need. Scoutline processes data about businesses that have not signed up and did not ask to be listed, because finding them is the product.
What we hold: business name, trade, town, address, phone number where published, website address where one exists, star rating, review count, photo count, and a score we calculate with the reasons for it. It comes from third-party business-listing providers, principally the Google Places API — not from the business.
Why this is a privacy matter at all. A limited company's details are usually not personal data. But a great many of the businesses this product is designed to find are sole traders and partnerships, where the business name is a person's name and the phone number is their mobile. That is personal data under the UK GDPR, and we treat it as such rather than pretending the “it's business data” label settles it.
Our lawful basis is legitimate interests (Article 6(1)(f)) — operating a business-to-business lead-generation service. We have weighed that against the interests of the people concerned, and it is why the following limits exist rather than being optional extras:
noindex, so they cannot compete with a real business in search results.Notification. Article 14 requires us to tell people when we obtain their data from somewhere other than them. We do not hold a verified contact route for these businesses, and using the listing's phone number to make an unsolicited privacy call would itself be intrusive. We therefore rely on the disproportionate-effort exemption in Article 14(5)(b), with this page as the public notice. If you are a business owner reading this because you found a preview site, section 12 is the part you want.
| Purpose | Lawful basis |
|---|---|
| Providing the Service to you | Performance of a contract |
| Taking payment | Performance of a contract |
| Keeping accounts secure, rate limiting | Legitimate interests — preventing unauthorised access |
| Service emails (welcome, receipts, account changes) | Performance of a contract |
| Holding and scoring business listing data | Legitimate interests — see section 5 |
| Handling your messages to us | Legitimate interests — answering you |
| Meeting tax and accounting duties | Legal obligation |
We do not sell personal data and we do not share it for anyone else's marketing. We use these processors to run the Service:
| Provider | What it does | What it sees |
|---|---|---|
| Vercel | Hosting and analytics | Requests to the site; aggregate analytics |
| Neon | Database | All stored data, at rest |
| Stripe | Payments | Your email and payment details, which it collects directly |
| Anthropic | Generating sites and email drafts | The business facts sent in a prompt — see section 8 |
| Business listings data | The search queries we make | |
| Resend | Sending service email | Recipient address and message content |
We may also disclose data where the law requires it, or to establish or defend legal claims.
Generating a site or a draft sends a prompt to Anthropic containing only the facts needed: the business's name, trade, town, phone number, rating, review count and photo count, plus any sender details you supply for an outreach draft.
Some processors above are based in, or process in, the United States. Where data is transferred outside the UK we rely on the safeguards those providers offer — the UK extension to the EU-US Data Privacy Framework where applicable, and the International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum otherwise.
Under the UK GDPR you can ask us to:
The right to object to direct marketing is absolute. If a business objects to being processed for that purpose, we stop and remove them. There is no balancing test and we will not ask for a reason.
Requests go through the contact page. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are a business owner who has been shown a Scoutline preview site, or found one, this section is for you.
Tell us through the contact page — choose “Data, privacy or removal request” — and include the business name and town, plus the preview link if you have it. We will:
You do not need to give a reason and you do not need an account. Note that we cannot stop a Scoutline subscriber who has already contacted you from contacting you again — they are a separate business and you should ask them directly, as their own opt-out duties apply.
We use as few as the Service can function with. There is no advertising or cross-site tracking cookie, so there is nothing here for you to consent to and no choice for you to make. You may see a short notice on your first visit stating exactly that — it is telling you what we do, not asking permission, and dismissing it changes nothing about what is stored.
| Cookie | Purpose | Life |
|---|---|---|
| Session cookie | Keeps you signed in. HttpOnly and SameSite=Lax, so it is not readable by scripts and is not sent from other sites. Strictly necessary. | 30 days |
The site also uses sessionStorage to remember that you have already seen the homepage intro animation, so it does not replay on every page load. That is a preference held only in your browser tab and is not sent to us.
No system is perfectly secure. If we suffer a breach affecting your rights, we will notify the ICO within 72 hours where required, and tell you where the risk to you is high.
The Service is for business use and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe we have, tell us and we will delete it.
Please raise it with us first — most things are quicker to fix directly. If you remain unhappy you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. Complaining to us first is not a precondition.
We will update this page when the Service changes. The version and date at the top tell you which version is current. Where a change materially affects how we use personal data, we will give notice rather than quietly editing the page.
Anything here unclear? The contact form reaches a person, not a queue.