Privacy Policy

1. Information we collect

• Account information — your name, email address, and password (stored as a salted hash), or your Google profile (name, email, avatar) if you sign in with Google.
• Content you create — campaigns, email templates, sequences, contact lists, and prospect data you import or generate within the platform.
• Sending credentials — if you connect an email account for sending, we store either your SMTP credentials or OAuth tokens (see Section 2). These are encrypted at rest.
• Email engagement data — delivery, open, click, bounce, reply, and unsubscribe events for emails you send through the platform.
• Usage and device data — log data such as IP address, browser type, and pages visited, used for security and to improve the product.
• Billing information — processed by our payment provider; we do not store full card numbers.

2. Google user data

ProspectNow offers two optional features that access Google user data through Google's OAuth consent flow:

• Sign in with Google — we receive your basic profile (name, email address, profile picture) to create and authenticate your ProspectNow account.
• Connect Gmail for sending — if you choose to connect a Gmail or Google Workspace account as a sending address, we request the gmail.send scope, which allows ProspectNow to send emails from your account only when you initiate sending through a campaign or test send. We also receive your email address to identify the connected account.

What we do with Gmail access:

• We use the gmail.send permission solely to send emails that you compose and schedule in ProspectNow, on your behalf, from your connected address.
• We cannot and do not read, browse, or download the contents of your Gmail inbox. The gmail.send scope does not grant read access to your mailbox.
• OAuth access and refresh tokens are stored encrypted (AES-128 via Fernet) in our database and are used only to authenticate send requests to Google's API.
• We do not transfer, sell, or share Google user data with third parties, except as necessary to provide the sending feature you requested, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We do not use Google user data for advertising, to train machine-learning or AI models, or for any purpose other than providing and improving the user-facing sending feature.
• Humans do not read your Google user data except with your explicit permission (e.g. a support request), where required for security or legal compliance, or where the data has been aggregated and anonymized.

ProspectNow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a Google account at any time from Settings → Sending Domains in ProspectNow, or revoke ProspectNow's access directly at myaccount.google.com/permissions. When you disconnect or delete your account, we delete the stored OAuth tokens.

3. How we use your information

• To provide, operate, and improve the ProspectNow platform.
• To send emails you compose, on your behalf, through your connected sending accounts or our managed sending infrastructure.
• To track delivery and engagement of your campaigns and show you analytics.
• To communicate with you about your account (verification, password resets, billing, product updates).
• To prevent abuse, enforce our terms, and comply with legal obligations.

4. How we store and protect your data

• Data is stored on secured servers hosted in the European Union (Hetzner).
• Sensitive credentials — SMTP passwords, OAuth tokens, and integration API keys — are encrypted at rest using Fernet (AES-128-CBC with HMAC).
• Passwords are hashed with bcrypt and never stored in plaintext.
• All traffic between your browser, our servers, and third-party APIs is encrypted in transit with TLS.
• Access to production systems is restricted to authorized personnel.

5. Data sharing

We do not sell your personal information. We share data only with service providers necessary to run the platform:

• Email delivery providers (e.g. Amazon SES, Resend, Brevo) — to deliver emails you send through managed domains.
• Infrastructure providers (e.g. Hetzner, Cloudflare) — hosting and DNS.
• Payment processors — to handle subscriptions.
• Integrations you connect (e.g. Calendly, Cal.com) — only as directed by you.

These providers process data on our behalf under their own contractual confidentiality and security obligations. Google user data is never shared with third parties for their independent use.

6. Data retention and deletion

• We retain your data while your account is active.
• You can delete your account at any time from Settings → Account. Deletion removes your account data, contacts, campaigns, stored credentials, and OAuth tokens from our production systems.
• Residual copies in encrypted backups are purged on our regular backup-rotation schedule (within 30 days).
• You may also request deletion or a copy of your data by emailing support@prospectnow.co.

7. Your rights

Depending on your jurisdiction (e.g. GDPR in the EU/UK, CCPA in California), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise these rights, contact us at support@prospectnow.co.

8. Cookies

We use cookies and local storage strictly for authentication (keeping you signed in) and core functionality. We do not use third-party advertising or cross-site tracking cookies.

9. Children

ProspectNow is a business tool and is not directed at children under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced via the platform or email, and the "Last updated" date above will be revised. Continued use of ProspectNow after changes take effect constitutes acceptance.

11. Contact

Questions about this policy or your data? Email support@prospectnow.co.