01Who is responsible for your information
EntityReach is operated by Global Data Intelligence Limited, registered in England and Wales (company number 09410808). Registered office: Artisans’ House, 7 Queensbridge, Northampton, Northamptonshire, NN4 7BF, United Kingdom. We act as controller for account administration, service security, enquiries and our own business records. Where we handle your organisation’s account-plan content solely on its instructions, the applicable customer agreement defines our processor role. Contact nbuldumac@globaldatabase.com for privacy, support and legal requests. Include the email associated with your account and the scope of your request; do not send passwords or API keys.
02Information we collect and why
We receive your name, email, authentication identifier and workspace membership from WorkOS to sign you in and manage access. Before platform access, signup collects your company name, job title, phone number and intended use of the data to understand your business needs, support your account and reduce misuse. This applies to free and paid accounts. We store your saved company groups, labels, notes, account-owner fields, next actions and support requests to provide the workspace. Enquiries contain the name, email and message you submit. Signup profile answers and enquiry contact details are queued for our HubSpot CRM with EntityReach as the source and the first known EntityReach page. If you have not enabled source measurement, this page is the signup or enquiry submission page; earlier browsing is not recorded. Support and enquiry messages are queued for delivery to our team through Resend when email sending is activated, with delivery and retry status retained. Optional monitoring emails follow your notification choice. Connecting a CRM stores encrypted credentials for your workspace and allows the authorised company matching or creation actions; disconnecting removes those credentials. Stripe processes payment details; EntityReach retains customer and subscription identifiers, billing status and invoice information, not complete card details.
03Research inputs and company data
Company searches and AI questions are sent to Global Database to obtain results. Follow-ups include a bounded excerpt of the conversation. The conversation is held in the page; a research handoff is stored in browser session storage and can be saved in your account notes. We do not maintain a separate full chat transcript database. Company profiles and business contact data may originate from public registries, company sources and other provider datasets; source information varies by field. Do not put sensitive personal information into prompts or account notes.
04Lawful grounds
We use account and service information to perform our contract with you, or take steps you request before a contract. For business users acting for an organisation, we also rely on legitimate interests in delivering and securing the service, managing access, preventing abuse and answering enquiries. Legal obligations may require billing or compliance records. Optional browser measurement runs only if you enable it in Cookies & storage, and you can withdraw that choice. We also derive aggregate product-adoption reports from account activity and billing records, recording the first signup, group lookup, shortlist, checkout and paid activation for each workspace. These milestone records do not contain research questions, company names or contact details.
05Who can access your work
Authorised members of your workspace can access its saved research. Account briefs require sign-in to that same workspace, expire after 30 days and can be revoked. Service providers process information needed for hosting, authentication, billing and company research. We may disclose information when legally required or necessary to protect the service; we do not sell your account-plan notes.
06Retention and deletion
Saved groups and notes remain until deleted or the workspace is closed, subject to legal obligations and backup recovery. Brief links stop working after 30 days; expiry does not imply immediate deletion of every stored snapshot. Quota records carry expiry timestamps, but automatic expiry is not a guarantee of immediate physical erasure. We retain enquiry and support records while needed to resolve the request and maintain the business relationship, and billing records for applicable accounting obligations. Ask us to close a workspace or delete information; we will explain any records we must retain.
07International processing
Our hosting, authentication and billing providers may process information outside the United Kingdom, including in the United States. We use applicable contractual and legal transfer safeguards where required. No UK-only hosting or storage commitment is implied. For a proposed enterprise deployment, request the current processing locations, contracts and transfer information before entering restricted data.
08Your rights and complaints
Depending on the applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw optional consent without affecting earlier lawful processing. We may verify your identity and explain any legal limits. We normally respond to UK GDPR rights requests within one month, subject to permitted extensions. You can complain to the UK Information Commissioner’s Office at ico.org.uk, or your local supervisory authority.
09Children and changes
EntityReach is a business service intended for adults, not children. We update this notice when the product or processing changes and show the revision date above; material changes may also be communicated to account holders.