Privacy Policy

Last updated 1 October 2026

SectorScan (“SectorScan,” “we,” “us”) is operated by Niall O’Neill, trading as SectorScan, from Ireland. This policy explains what data we process, why, and what rights you have — both as a SectorScan customer and as someone whose business contact details appear in a list a customer builds.

Open item for legal review: SectorScan currently operates as a sole trader; CRO business-name registration for “SectorScan” is pending. A registered trading address for service should be added here once confirmed.

Two kinds of data we process

Account data — your email and workspace details when you sign up (with a password, or via Google sign-in where enabled), plus billing details handled by Stripe (we don’t store card numbers ourselves).

Lead data — business contact details (name, role, company, email address) that SectorScan derives or finds on a customer’s behalf, about people at organisations the customer is researching for B2B outreach. If you are one of those people, SectorScan is very likely processing your business contact details without your having signed up — see “Your rights,” below, for how to object or ask us to stop.

Where lead data comes from

Depending on the segment, SectorScan sources contacts from: a known, publicly documented roster for that sector (for example, GAA club conventions); OpenStreetMap for local businesses; live detection of a business’s own e-commerce store; or by reading a business’s own public website for a listed contact. We honour each site’s robots.txt and do not scrape directories or sites that actively block automated access — where a directory blocks us, we don’t evade that block; we look for the same business’s own site instead.

Why we can process this (our legal basis)

For business contact details processed on a customer’s behalf, we rely on legitimate interests (GDPR Article 6(1)(f)): enabling reasonable, opted-out-able B2B outreach to role- or business-level addresses, sourced from information the organisation itself has made public. We do not derive or find personal (non-business) email addresses.

Responsibility for the onward outreach — having a lawful basis to actually contact someone, honouring opt-outs, and complying with e-privacy/marketing rules in the recipient’s jurisdiction — sits with the customer running the campaign, not with SectorScan. This is stated on our public FAQ today and should be confirmed in the Terms of Service, below.

Open item for legal review: confirm whether SectorScan should be framed as a data controller (we decide how contacts are discovered and verified) or a processor acting on each customer’s instructions, or a hybrid — the answer affects several clauses on this page.

Suppression & opt-outs

Every workspace maintains a suppression list. Anything on it is dropped from every export automatically, so a customer can never accidentally re-contact someone who has opted out. If you want an address suppressed across SectorScan, email us (below) and we will add it.

How long we keep data

Account and lead data is kept for as long as the customer’s workspace is active, or as needed to provide the service. Suppressed addresses are kept indefinitely — deleting a suppression entry would defeat its purpose. Open item: a specific retention schedule (e.g. lead data deleted N months after a workspace closes) should be set with legal input rather than left undefined.

Who else sees data (sub-processors)

We use the following providers to run SectorScan. Each processes data only as needed to provide their part of the service:

• Supabase — database, authentication, and row-level security (EU region).
• Stripe — subscription billing and payment processing.
• Google — sign-in (OAuth).
• Resend — transactional email and, where a customer opts in, pushing an exported list to their own Resend audience.
• Anthropic — AI segment discovery and campaign copy (receives your campaign brief, not your exported lead list).
• Apollo, Hunter, Brave Search, BuiltWith, StoreLeads, and an email-verification provider — the “find” and verification vendor stack, used only for segments with no free derivation path.

Open item for legal review: several of the above are US-based. Standard contractual clauses or an equivalent transfer safeguard should be confirmed and listed here per provider.

Security

Data is encrypted in transit. Supabase row-level security scopes every workspace’s data to that workspace. We don’t store payment card details ourselves — Stripe does.

Cookies

SectorScan does not currently use analytics or advertising cookies. We use only the essential session cookies Supabase authentication requires to keep you signed in.

Children

SectorScan is a B2B tool and is not directed at, or knowingly used to process data about, children.

Your rights

Under GDPR, you can ask us to access, correct, delete, or stop processing data about you, or ask us to add your address to every workspace’s suppression list. Email the address below and we’ll respond within a reasonable time.

Changes to this policy

We’ll update the date at the top of this page when this policy changes, and post a notice for material changes.

Contact

privacy@sectorscan.net or support@sectorscan.net. Open item: confirm privacy@sectorscan.net is a real, monitored inbox before this page goes live — support@ is the one verified inbox today.