Privacy Notice
Version 2026-09-17b · Automation Bureau
This notice explains how Automation Bureau handles personal data in connection with ProspectRadar. It covers two quite different things, and it matters which one applies to you.
| If you are… | Then… |
|---|---|
| A ProspectRadar customer or user - you hold an account | We are the controller of your account data. This notice applies to you in full. |
| Someone who received an email sent through ProspectRadar | We are only the processor. The business that contacted you (a recruitment business, or a business offering a product or service) is the controller and decides why you were contacted. See section 7 - it tells you how to stop it. |
1. Who we are
Automation Bureau operates ProspectRadar. For questions about this notice or to exercise your rights, contact info@automationbureau.co.uk.
2. What we collect about account holders
| Data | Why | Lawful basis |
|---|---|---|
| Username, email address, password (stored only as a salted hash) | To create and secure your account | Performance of a contract |
| Workspace name, plan, role, join and removal events | To provide the Service and control access | Performance of a contract |
| Usage records: sign-in times, actions taken against leads, volumes processed | Support, troubleshooting, abuse prevention, billing accuracy | Legitimate interests - running a reliable service |
| Technical logs: IP address, browser user agent, error traces | Security and diagnosing faults | Legitimate interests - securing the service |
| Record of your acceptance of these agreements: document, version, time, IP address | To evidence that the agreements were accepted | Legal obligation and legitimate interests |
| Credentials you provide - API keys, mailbox tokens, SMTP passwords | To operate the Service for you. Encrypted at rest. | Performance of a contract |
We do not collect special category data about account holders, and we do not use advertising cookies or third-party analytics trackers. The Service sets a session cookie and a CSRF cookie, both strictly necessary for it to work.
3. What we do not do
- We do not sell personal data.
- We do not market to the prospects in your workspace.
- We do not pool customers' contact data into a shared database. Each workspace is isolated.
- We do not use your data, or your prospects' data, to train AI models, and the AI providers we use are engaged under terms that prohibit training on our inputs.
4. Who we share account data with
- Hosting provider - where we host the Service for you.
- Payment provider - if and when paid plans are offered; card details are handled by the provider and never reach our servers.
- Professional advisers and authorities - where we are legally required to disclose.
The third parties involved in processing your prospects' data are listed in the Data Processing Agreement.
5. How long we keep it
- Account data: while your account is active, then deleted within 90 days of closure.
- Records of agreement acceptance: six years, because they evidence a contract.
- Technical and security logs: normally 90 days.
- Backups: deleted on the normal backup rotation, at most 90 days after the live data.
6. Your rights
You may request access to your personal data, correction of it, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Email info@automationbureau.co.uk and we will respond within one month.
You may complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We would prefer the chance to resolve it first.
7. If you received an email sent through ProspectRadar
We did not choose to contact you, and we are not the controller of your data in that context. The business named in the email decided to contact you and is responsible for that decision. Your name and job title will have come from your employer's public job advert, Companies House, or public search-engine results; your email address from your employer's own domain or a licensed contact-data provider. Nothing was taken from a social network directly.
To stop it: use the opt-out link at the bottom of the message. That immediately blocks any further contact from that business through ProspectRadar - to that address and to your whole domain if requested - and cancels anything already scheduled. You do not need to reply, and you do not need to speak to us.
If the link does not work, or you want your details erased rather than suppressed, contact the sender directly. If you cannot reach them, email us at info@automationbureau.co.uk and we will identify the controller and pass your request to them without undue delay.
One deliberate exception: if you opt out, a record of the email address or domain that objected is kept. That record exists only so the contact does not start again, and holds nothing beyond the address and the fact of the objection. Deleting it would defeat its purpose.
8. Connected mailboxes (Google and Microsoft)
When you connect a mailbox, ProspectRadar uses it as follows:
| Mailbox | Access | What it is used for |
|---|---|---|
| Any mailbox connected with a password or app password - including Gmail and Google Workspace | Send email as you, and read your inbox | Sending the outreach emails you approve, or that your workspace settings send automatically, from your own address, and finding replies to those emails in your inbox. Other messages are not stored. The password is encrypted at rest; deleting it, or revoking the app password in your account, ends access. |
| Continue with Google (where offered) | Send email as you, and your email address | Sending the outreach emails you approve, or that your workspace settings send automatically, from your own address. ProspectRadar cannot read your Gmail. Replies to those emails are addressed to ProspectRadar's reply inbox, recorded against the lead, and a copy is sent into your Gmail from your own address. |
| Continue with Microsoft | Send email as you, and read your inbox | Sending as above, and finding replies to those emails in your inbox. Other messages are not stored. |
A reply is used to mark the lead as replied, stop its follow-ups and save any phone number it gives.
- Access tokens are encrypted at rest. Disconnecting the mailbox in Settings deletes them, and you can also remove access at any time from your Google or Microsoft account.
- Mailbox data is used only to provide these features to you. It is not sold, not used for advertising, not used to train AI models, and not read by people except with your permission, for security, or where the law requires.
- ProspectRadar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
9. International transfers
Some of the providers used to deliver the Service operate outside the UK. Where personal data is transferred, it is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by adequacy regulations.
10. Changes
If we change this notice materially we will publish a new version and ask you to review it at your next sign-in. The version number appears at the top of this page.
Questions about this document? Contact info@automationbureau.co.uk.