Privacy Policy

This Privacy Policy explains how Customer Finding Agent (“Customer Finding Agent”, “the Service”, “we”, “us”) collects, uses, shares and protects personal data. The Service helps business owners discover publicly listed prospective customers, send email outreach from their own connected mailbox, and audit Google reviews to prepare policy-violation removal claims. For any privacy question or request, contact info@customerfindingagent.com.

Who is the data controller

For your account and billing data, Customer Finding Agent is the data controller. For the business leads you discover, the recipients you choose to contact, and the reviews you audit, you are the controller and Customer Finding Agent acts as a data processor / intermediary on your behalf and under your instructions. You are responsible for having a lawful basis to process and contact those third parties.

Information we collect

Account data. When you sign up with Google or email/password we store your email address and, for Google sign-in, your name and profile picture.

Search & lead data. When you run a search we store the businesses we discover (name, category, address, public phone/website/email, ratings and reviews) and the fit scores we compute. This is business contact information sourced from public listings.

Outreach data. The email messages you compose and a log of what was sent (recipient, status, timestamp), plus your opt-out / unsubscribe list.

Review-audit data. For the Review Manager we store the public reviews we fetch (reviewer display name, rating, text, dates) and the policy classification and draft claims we generate for you.

Billing data. Your plan, credit balance and a ledger of credit grants/spends. Purchases are arranged offline; we do not store card numbers. If you send a purchase inquiry we store the name, email and message you submit.

Mailbox credentials. If you connect a mailbox to send from, we store its server address, port, username and password. The password is encrypted at rest and used only to send the messages you compose. Disconnecting the mailbox deletes it.

Technical data. Essential session/authentication cookies and a language preference cookie, plus standard server logs (e.g. IP, timestamp) needed to run and secure the Service. We do not use advertising or cross-site tracking cookies.

Google sign-in & your email mailbox

If you sign in with Google we request only openid, email and profile — enough to identify you and nothing more. We have no access to your Gmail account or its contents, and you can revoke the sign-in at any time at myaccount.google.com/permissions.

Outreach is sent from a mailbox you connect yourself over SMTP, which may be with Google, Microsoft, Zoho or any other provider. We store the server address and the password you supply, encrypted, and use them for one purpose: sending the messages you compose and explicitly choose to send. We do not read, store, or analyse the contents of your mailbox, we cannot receive mail on your behalf, and we never use this access for advertising or to train AI/ML models. Disconnecting the mailbox in your profile deletes the stored credentials.

Customer Finding Agent's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal bases

We process personal data under KVKK (Law No. 6698) and, where applicable, the GDPR, relying on: performance of a contract (to provide the Service you sign up for); your consent (e.g. connecting a mailbox); our legitimate interests (securing and improving the Service); and compliance with legal obligations.

How we use your information

• operate the discovery, scoring, outreach and review-audit features you request;
• send the messages you compose and record their delivery status;
• manage your account, credits and purchase inquiries;
• honor unsubscribe / opt-out requests; and
• secure, maintain and improve the Service.

Sharing & subprocessors

We do not sell your personal data. We use trusted subprocessors to run the Service: Supabase (database & authentication, EU region), Apify (business & review discovery), Google (sign-in), Resend (account emails such as confirmation and password reset, EU region) and Vercel (hosting). Each processes data only to provide its service to us. We may also disclose data where required by law or to protect our rights.

International transfers

Some subprocessors (e.g. Vercel) may process data outside Türkiye/the EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, or your explicit consent, as permitted by KVKK and the GDPR.

Retention & deletion

We keep your searches, leads, messages and settings until you delete them or close your account. To delete your account and all associated data, use the in-app Delete account option in Settings, or email info@customerfindingagent.com; we will erase your data within 30 days, except where we must retain limited records to meet legal, tax or security obligations. Mailbox credentials are deleted immediately when you disconnect the mailbox, without waiting for account closure.

Your rights (KVKK / GDPR)

Subject to applicable law, you may request access to, correction, export or deletion of your personal data, object to or restrict processing, and withdraw consent at any time. You may also lodge a complaint with the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu — KVKK) or your local supervisory authority. To exercise these rights, contact info@customerfindingagent.com.

People you contact or audit

The lead and review data in the Service concerns third parties and is sourced from public listings. If you are a business owner or reviewer and want your data corrected or removed from a user's workspace, contact info@customerfindingagent.com. Every outreach email includes an unsubscribe link, and opt-outs are honored on all future sends.

Security

Data is stored with row-level security so each account can only access its own records. Credentials are transmitted over TLS, and any mailbox password you give us is encrypted at rest with AES-256-GCM rather than stored in readable form. No method of storage or transmission is 100% secure, but we take reasonable technical and organizational measures to protect your information.

Children

The Service is intended for business use by adults (18+). It is not directed to children and we do not knowingly collect their data.

Changes

We may update this policy; material changes will be reflected by the “Last updated” date above.

Contact

Questions about this policy or your data: info@customerfindingagent.com.