Privacy Policy for Scoutbot

Last updated: June 2025

Scoutbot is a B2B company scouting platform operated by Tobias Schneider. This privacy policy informs you about the processing of personal data on our platform in accordance with the General Data Protection Regulation (GDPR).

1. Controller

2. Scope and Purpose of Processing

We collect and process personal data only to the extent necessary to:

• Register and manage user accounts
• Process subscriptions
• Enable and improve the company scouting functionality
• Communicate with users
• Analyze user behavior and improve our service

The data is collected directly from users during registration and use of the service.

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Art. 6(1)(b) GDPR – to fulfill a contract or take steps prior to entering into a contract
• Art. 6(1)(f) GDPR – for our legitimate interests in operating and improving Scoutbot
• Art. 6(1)(a) GDPR – based on your consent (e.g. for analytics, chat)

4. Categories of Personal Data

We may process:

• Full name
• Email address
• Company name
• Subscription and billing information
• IP address and browser/device metadata
• Search queries submitted by the user (not intended to contain personal data)

5. Processors and Data Transfers

We use the following processors and services:

Bubble Group, Inc.
Used for hosting, frontend logic, and user management
Legal basis: Art. 6(1)(b) GDPR
Data processed: email address, login metadata, session info
Transfer safeguard: EU–US Data Privacy Framework (DPF), SCCs
Privacy Policy: https://bubble.io/privacy
Data Processing Addendum: https://bubble.io/dpa
Bubble acts as a data processor under our instructions. Its Data Processing Addendum (DPA) includes Standard Contractual Clauses (SCCs), which provide legal safeguards for any data transferred outside the EU. Bubble commits to processing personal data in accordance with GDPR and to implementing appropriate technical and organizational security measures.

Stripe, Inc.
Used for subscription management and payment processing
Legal basis: Art. 6(1)(b) GDPR
Data processed: name, email address, payment details, IP address
Transfer safeguard: EU–US DPF, SCCs
Privacy Policy: https://stripe.com/privacy

OpenAI, Inc.
Used to process search queries via API to translate them into our internal logic
We do not transmit personal data to OpenAI intentionally. However, if users voluntarily include personal or confidential information in their query, this may be processed.
Legal basis: Art. 6(1)(f) GDPR
Transfer safeguard: EU–US DPF
Privacy Policy: https://openai.com/policies/privacy-policy

Google Analytics
Used to analyze visitor behavior and improve our website performance. Google may collect device and usage data including IP address, browser type, pages visited, and time spent. We use IP anonymization to avoid storing full IP addresses.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent)
Transfer safeguard: EU–US DPF, SCCs
Privacy Policy: https://policies.google.com/privacy

Umami Analytics
Used for privacy-focused website analytics to understand visitor behavior and improve our website performance. Umami collects anonymized data including page views, referrers, session data, and basic device information using cookies for session tracking.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent)
Privacy Policy: https://umami.is/privacy

6. Data Subject Rights

You have the following rights under GDPR:

• Right to access your data (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise any of these rights, please contact: tobias@scoutbot.net

7. Retention Period

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected or to comply with legal obligations (e.g. tax retention periods). When the data is no longer required, it is deleted or anonymized.

8. Data Security

We use HTTPS encryption, user authentication, access control, and modern cloud infrastructure (Bubble.io) to safeguard your data. All third-party services are carefully vetted for GDPR compliance.

9. Cookies and Analytics

Scoutbot uses cookies to ensure essential functionality and to improve the user experience through analytics.

Types of cookies:

• Essential cookies: Required for login, authentication, and core functionality.
• Analytics cookies: Used to track how users interact with the platform.

Consent:
Analytics cookies and third-party tracking tools (like Google Analytics) are only activated with your explicit consent via our cookie banner.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG.
You can revoke your consent at any time.

10. ChatGPT Integration (Customer Interaction)

Scoutbot uses ChatGPT (OpenAI) for customer interaction and search refinement. We do not transmit user names or email addresses to OpenAI. Any personal data shared by users via the chat is processed under Art. 6(1)(f) GDPR (legitimate interest in efficient support). Consent is obtained where legally required.

11. Changes to This Privacy Policy

We reserve the right to amend this policy to reflect changes in legal requirements or our services. You will be notified of major updates via the platform.

Contact: hello@scoutbot.net