Privacy Policy

Last updated: 2026-10-28

This policy explains how GH CONSULTANCY DEV LLP ("Scrap.io", "we", "us"), registered in England and Wales under number OC442871, 32 Kinburn Street, London, SE16 6DW, United Kingdom, processes personal data. For any question or request, write to [email protected]. Our representative in the European Union under Article 27 of the GDPR is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. You can also contact our representative through https://app.prighter.com/portal/15604909101.

Scrap.io processes personal data in three different contexts, with a different role in each:

1. our business database, which we build and supply to our customers: we are the controller;
2. files that our customers upload for enrichment: we are a processor acting on our customer's instructions;
3. our customers' accounts, billing and support: we are the controller.

1. Our business database

What data and where it comes from

Our database describes businesses. It combines:

• information shown on the Google Maps listing of the business, which may be supplied by the business, by Google or by other contributors: name, category, address, phone number, website, opening hours, rating and reviews count, photos and similar listing details;
• contact details that we collect from the public website of those businesses: email addresses, social media profile links and similar contact points published by the business itself.

Most of this data concerns legal entities and is not personal data. Some of it is personal data, for example when a business is run by a sole trader under their own name, or when a website publishes a named person's professional email address or phone number. We do not look for private information about individuals and we do not collect data from social networks' private areas.

Why we process it and on what legal basis

We process this data to provide a business directory and prospecting service to professional customers, who use it to identify and contact businesses. Our legal basis is our legitimate interest, and our customers' legitimate interest, in business to business prospecting (Article 6(1)(f) of the UK GDPR and of the EU GDPR). We have assessed that this interest is not overridden by the interests of the people concerned, because the data is professional and is available in public business listings or on business websites, and because we offer a simple way to object at any time.

Who receives it

Our customers, through the application, exports, the API and the MCP server, and anyone who uses our free browser extension, which shows the contact details of the Google Maps listings they view. Each of them then uses the data as an independent controller and is responsible for complying with the law when contacting you, in particular the rules on electronic marketing. A customer may pass the data on or resell it to other businesses, which must respect the same restrictions, under our Terms and Conditions.

How long we keep it

We keep a business record while it remains available at its public source and necessary for the service. We refresh our data periodically, and a record that is no longer available at its source is removed from our database through our refresh process. Files that we generate for our customers (exports) are deleted automatically at most 3 years after they are removed from the customer's account. If you object by writing to [email protected], a member of our team reviews your request and we answer within one month, or within three months for complex or numerous requests, in which case we tell you within the first month. Once your request is accepted, we delete the data from our database and add it to our block list so that it is not collected again. Files already generated for our customers are not rewritten (see section 5).

Information to the people concerned

Because this data is not collected from you directly, Article 14 of the GDPR applies. Informing each person individually would involve a disproportionate effort, given the number of records and the fact that the data is limited to professional contact details that the business itself has made public in order to be contacted. We therefore make this information public in this policy and on our transparency page, and we make objection simple and free, without an account (Article 14(5)(b)).

2. Files uploaded by our customers

Our customers can upload files (for example lists of phone numbers, email addresses, websites or business identifiers) so that we match them with our database and return enriched results. For this processing we act as a processor on behalf of the customer, who is the controller. We process these files only to provide the enrichment, under our Data Processing Agreement.

Uploaded files, the rows we extract from them and the enrichment results are deleted when the customer asks for it, and when the customer's subscription is cancelled while they hold no active pass. If you are a person whose data appears in a customer's file, please contact that customer first; we will help them answer your request.

3. Customer accounts, billing and support

What data

• Account data: name, email address, password (stored in hashed form), company name, language, country.
• Billing data: billing address, VAT number if provided, invoices and payment history. Card details are entered directly with our payment provider; we only keep the card brand, its first six and last four digits, its expiry date, the cardholder name, country and postal code, the email address and IP address used when the card was registered, and a reference to the card at the payment provider.
• Usage data: searches, exports, enrichments, credits consumed, API and MCP usage, technical logs, IP address and its reputation (hosting or anonymising service), kept 180 days.
• Support data: your messages to our support and their history.
• Marketing and analytics data: how you found us, pages visited, emails opened.
• Affiliate data, if you take part in our affiliate programme: identity, contact and bank details, invoices, tax information and commissions.

Account and billing data are required to use the Service. The other data is collected as you use it.

Why and on what legal basis

• To provide the Service and manage your account and subscription: performance of our contract with you.
• To invoice you and keep accounting records: our legal obligations.
• To secure the Service, prevent fraud and abuse, and prove what was delivered in case of a dispute: our legitimate interest.
• To send you service emails (payment failed, export ready): performance of the contract.
• To send you product news and offers about our own service: our legitimate interest where the law allows it, and your consent where it is required; you can opt out at any time through the link in each email.
• To measure our audience and our advertising: your consent where the law requires it (section 7), and otherwise our legitimate interest.
• To detect accounts created to circumvent our limits: our legitimate interest. Automated checks compare technical signals between accounts; an account they flag may be suspended, and you can ask a member of our team to review that decision at [email protected].
• To run our affiliate programme and pay commissions: performance of the affiliate contract and our legal obligations.

How long we keep it

• Account data: for as long as your account exists.
• Billing data and invoices: 6 years after the end of the financial year concerned, as required by accounting law.
• Your exports: removed from your account when your subscription is cancelled while you hold no active pass, and deleted at most 3 years after that removal. They are kept for that period to prove what was delivered in case of a dispute. For 30 days after the end of your subscription, we send you the files of your exports on request, under the conditions of section 10 of our Terms and Conditions.
• Your file enrichments and exclusion lists: deleted when your subscription is cancelled while you hold no active pass, or on request. If you only hold a pass, they are deleted on request.
• Support conversations: for as long as necessary to handle your requests and keep a history of our exchanges with you.
• Usage data: for as long as your account exists.
• Technical logs: 12 months.
• Affiliate data: 6 years after the end of the financial year of the last payment.

4. Service providers and transfers

We use the following providers, who process personal data on our behalf under contracts that require them to protect it:

The current list is published on our subprocessors page. Some providers are located outside the United Kingdom and the European Economic Area, in particular in the United States. These transfers are covered by an adequacy decision (such as the EU US Data Privacy Framework and the UK extension to it, for certified providers, or the adequacy decisions for Canada) or by the standard contractual clauses approved by the European Commission and the UK International Data Transfer Addendum. You can obtain a copy of these safeguards by writing to [email protected].

5. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to data portability where applicable. You can object at any time, without giving a reason, to the use of your data in our business database.

To exercise your rights, write to [email protected]. No account is needed. Tell us what to remove: an email address, a website or a Google Maps listing (removing a listing also removes its phone number and other contact details). To protect you, we may ask you to prove that you control the email address or website concerned. A member of our team reviews every request, and we answer within one month, or within three months for complex or numerous requests, in which case we tell you within the first month.

You can also exercise your rights through our representative in the European Union, Prighter EU Rep GmbH, on its portal: https://app.prighter.com/portal/15604909101. Requests made there reach us the same way as an email to [email protected].

When we accept your objection or deletion request, we delete the data from our database and add it to our block list, so that it is no longer collected or served: it no longer appears in any search, export, API or MCP result, or enrichment, once our temporary caches have expired. We keep the blocked identifier (the email address, the domain or the listing identifier) so that it is not collected again. Files generated for our customers before your request are not rewritten. Copies that customers already downloaded are out of our control: we cannot delete them, but you can contact those customers directly. Files still hosted by Scrap.io remain available to the customer who generated them while they are in its account, and on request for 30 days after its subscription ends, under the conditions of section 10 of our Terms and Conditions. Results already prepared for a customer before your request may still be delivered to them.

When you ask for access, we tell you what data we hold about you, its source, and the customers who received it. When we accept your objection, we inform those customers.

You also have the right to lodge a complaint with a supervisory authority: the Information Commissioner's Office in the United Kingdom (ico.org.uk), or the authority of your country in the European Union, such as the CNIL in France (cnil.fr).

6. Security

We protect personal data with appropriate technical and organisational measures, including encryption of all traffic in transit, encryption at rest of the files we store, access restricted to the staff who need it, and monitoring of our systems.

7. Cookies

Our website always loads the cookies that are necessary for it to work, the Crisp support chat, and a cookie that records the source of your visit, kept for 13 months. Google Analytics and Mixpanel (audience and product analytics), Customer.io (emails and activity tracking), Satismeter (satisfaction surveys), and the LinkedIn, X and Google Ads tags (advertising measurement) are loaded only after you accept them in the cookie banner if you visit from the European Economic Area or the United Kingdom. From elsewhere, they are loaded unless you refuse them. In both cases you can change your choice at any time through the "Cookie settings" link at the bottom of each page. Your choice is kept for 6 months. Independently of cookies, our servers send your account, subscription and payment events to Mixpanel and Customer.io once you have an account, for product analytics and for the emails described in section 3. For the LinkedIn Insight Tag, LinkedIn and we are joint controllers of the collection, and LinkedIn is responsible for its further use, as described in LinkedIn's privacy policy.

8. Changes

We may update this policy. We will publish the new version on this page with its date, and notify our customers by email of any material change.