Privacy Policy

1. Who we are and how to contact us

MIRA NOVUM LTD (“Mira Novum”, “we”, “us”) is the controller of the personal data described in this policy. We are a company registered in England & Wales under company number 17465260, whose registered office is at 128 City Road, London, United Kingdom, EC1V 2NX. ICO registration number: registration in progress.

For any question about this policy or your personal data, or to use your rights, email our compliance team at [email protected] or write to us at our registered office. For help with your Account, email [email protected].

2. What this policy covers

This policy explains how we collect and use personal data about: our customers and their users; visitors to our website; people who contact us or use our support desk; verified business owners and users of the collaboration network; affiliates; and people whose business details appear in our database.

It is our notice under Articles 13 and 14 of the UK GDPR. The section on people whose business details are in our database is expanded in our separate notice, Data Sources and Your Rights, which forms part of this policy.

3. Information we collect about customers and visitors

Account and profile details: name, email address, password (stored only as a secure hash), company, job title, phone number, business address, country, preferences, team members you invite and the two-factor settings you choose. If you use location auto-fill at sign-up, your browser shares coordinates only after you allow it, and we keep only the resulting address fields, not the coordinates.

Search location preset: if you choose to use your browser location to preset searches, your browser shares coordinates only after you allow it, we turn them into a country and region and keep only that on your Account, never the coordinates. You can switch it off in Settings, Notifications at any time, and the saved location is deleted straight away.

Orders and billing: the plans, orders, credits and invoices on your Account, and payment confirmations and references from our payment providers. We do not receive or store your full card number.

Use of the Service: searches, filters, baskets, unlocks, exports and downloads, saved searches and alerts, campaigns, connected accounts, API keys (stored only as a secure hash, and shown to you once), API calls and usage counts, credit transactions and the buyer confirmations you give.

Customer Content: suppression lists, email lists you upload for verification, campaign content, notes, call outcomes, and the encrypted credentials of mailboxes, CRM systems, messaging accounts and AI providers you connect.

Communications: support tickets and chat messages, the page you were on when you opened them, your time zone, ratings you give, and emails we send you and their delivery status.

Technical data: IP address, browser and device type, operating system, pages viewed, referring page, approximate location derived from the IP address, session and security signals, and the time of each request.

4. Where we get customer information

Most of it comes from you, when you register, place an order, use the Service or contact us. Some comes from others: a colleague who invites you to their team account; a third-party account you choose to sign in with, which shares your name and email address; our payment providers, which confirm payments and may flag suspected fraud; mailboxes, CRM systems and messaging accounts you connect, from which we read the replies, contacts and status information the features need; and an affiliate whose link or code you used.

Some information is needed to provide the Service, such as your email address and payment confirmation. If you do not provide it, we cannot create your Account or supply your Order. Other information, such as your job title or phone number, is optional.

5. How we use customer information and our lawful bases

To create and run your Account, take payment, supply data and credits, provide the features you use and give support. Lawful basis: performance of our contract with you (Article 6(1)(b)).

To keep the Service secure, protect it against automated copying, abuse and fraud, enforce our terms and usage limits, and keep evidence of orders, deliveries and confirmations so we can respond to disputes and legal claims. Lawful basis: our legitimate interests in protecting our business, our customers and the businesses in our database (Article 6(1)(f)).

To improve the Service, understand how it is used and measure demand, using aggregated or de-identified information where we can. Lawful basis: our legitimate interests (Article 6(1)(f)).

To send service messages, such as order confirmations, export notices, renewal reminders, security alerts and changes to our terms. Lawful basis: performance of our contract (Article 6(1)(b)) and our legitimate interests (Article 6(1)(f)).

To keep accounting and tax records, answer lawful requests from authorities and meet our other legal obligations. Lawful basis: legal obligation (Article 6(1)(c)).

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask for more information about that balance, and you can object at any time (see Your rights).

6. Automated security checks

To protect the website and our database against automated copying, we assess each search and form request automatically, using signals such as request rates, browser features and whether a security check was passed. If a request looks automated, we may slow it down, ask you to complete a security check or block it for a short time. Usage limits for your Plan are applied automatically in the same way.

To protect our database against copying, the website also uses signed links for deep pages of listings, links that people cannot see and that our robots.txt file tells automated tools not to follow, and a reference in the data we serve through our data files and API that encodes the day and a one-way hash of the network address that asked for it, so that a copy found elsewhere can be traced. A tool that follows one of those hidden links, or ignores our limits, may be blocked for 24 hours, using a hashed record of its network address and browser fingerprint that expires after those 24 hours. The reference is a label, never a false value, and we do not store a list of who received which reference. Lawful basis: our legitimate interests in protecting the Service and our database (Article 6(1)(f)).

These checks do not have legal or similarly significant effects on you. If you think a check has blocked you in error, contact us and a member of our team will review it.

7. Marketing messages

We send product news and offers by email to people who have agreed to receive them, for example when they subscribe to our newsletter or switch on news and offers in their account settings. Where we choose to rely on it, we may also email existing customers about our own similar products (the “soft opt-in” in PECR), and only if they were given a simple way to refuse when their details were collected and in every message since. Lawful basis: consent (Article 6(1)(a)) or our legitimate interests (Article 6(1)(f)), together with PECR.

Every marketing email includes an unsubscribe link, and you can change your email preferences in Settings at any time. Browser push notifications are sent only if you allow them in your browser, and you can turn them off there or in Settings. Unsubscribing from marketing does not stop service messages.

When you subscribe, we email you first to confirm the address (double opt-in). We record the page you subscribed on and its type, the country your connection comes from (the country only, not your IP address; with your subscription we keep a keyed one-way hash of the IP address, used to send no more than one confirmation email to a network each day, and cleared once you confirm the address, or after 30 days if you never do), and the wording you agreed to. We use these, together with whether you have an account, have bought from us, manage a claimed business profile or are an affiliate, to put you in segments so that you only get relevant emails: for example, owners of claimed business profiles never receive offers to buy data. For customers, the number and value of paid orders and how long you have been a customer set a loyalty tier, which decides the value of an offer; it does not change our standard prices and has no other effect. Offers may carry a personal code linked to your email address. If you join the Maia Lumen waitlist, you receive its updates and our general newsletter, as the form says, and you can unsubscribe from both with one link. If you enter a prize draw, we use your email address to run the draw and tell the winner, and to send marketing only if you ticked the separate box; entry details are kept to run the draw and answer questions about it, and deleted 12 months after the draw, as the draw’s terms say. If you invite a colleague with your referral code, we link the two accounts only to give both of you the reward after their first paid order; we do not email the people you invite. Only if you tick the box in the cookie notice do we keep a first-party cookie with the type of the first page of your visit and your visit count, to choose relevant on-site messages. Lawful basis: consent (Article 6(1)(a)) for subscribers and the visit cookie, and our legitimate interests (Article 6(1)(f)) in keeping marketing relevant; you can object or unsubscribe at any time.

Seasonal messages, reminders and review requests: on-site messages and newsletters about seasonal, commercial and fiscal dates (for example a shopping season or the end of a tax year) are chosen by region, from the country you pick or the country of your connection. We never choose a religious festival by your country or connection and never infer anyone’s religion; messages about religious festivals are sent, if at all, the same way to everyone in a segment that has nothing to do with religion. Reminders about an account that is unused or about to end describe what the account offers and what happens to it, and never warn of losing anything you would not lose. We may also ask customers, and people who used our free tools and agreed to our emails, for a review of our service. We ask everyone in that group in the same way whatever their experience, offer nothing for a review, and do not filter who is asked by what they are likely to say.

8. Buyer confirmations and evidence records

Before you pay, unlock, export, start a campaign, create an API key, claim a business, send your first collaboration message, join the affiliate programme or connect an AI provider, we record the statements you confirmed, their version, the document versions they relied on, the time, your IP address and the action they covered.

We use these records to show what you agreed, to respond to disputes, payment reversals, complaints and regulator enquiries, and to defend legal claims. Lawful basis: our legitimate interests (Article 6(1)(f)) and, where relevant, legal obligation (Article 6(1)(c)).

9. Outreach, connected accounts and AI features

When you send campaigns from a mailbox you connect, sync records to a CRM, verify a list you upload or run an AI feature, we process the personal data in that content on your instructions as your processor, under the processor terms in our Data Sharing Terms. You are the controller of that data and are responsible for having a lawful basis for it.

Separately, we keep a small set of technical delivery results from campaigns sent through the Service, for our own purposes as a controller: whether the receiving side accepted a message, the bounce code with a short excerpt of the mail server’s error message, and whether an automatic or personal reply came back from the address. We do not keep message bodies for this. We use these results to keep our business database accurate: an address that its mail server reports as not existing is suppressed for every customer and marked invalid, and a reply records the date an address was last seen active. Where this is switched on, we may also read the signature of a reply (name, job title, business phone numbers, business address and profile links) and keep it as an unconfirmed suggestion for the business record, which is checked against our rules before anything is added and is never passed to other customers as it is. Lawful basis: our legitimate interests, and those of our customers and the businesses listed, in an accurate database (Article 6(1)(f)), supporting the accuracy principle (Article 5(1)(d)). We keep these results for 12 months.

When you use your own AI key (for example for OpenAI, Anthropic, Google Gemini, Mistral, Groq, Cloudflare Workers AI or OpenRouter), the content the feature needs is sent to the AI provider you chose, under your contract with that provider. We never send the personal data of your prospects to an AI provider unless you choose a feature that does so, and the feature tells you what is sent. We record the number of tokens used, the time, whether the call succeeded and the rate limit figures the provider returns with its reply, so you can see your usage and so your caps and limits can be applied.

AI overviews and opportunity summaries on our public pages are generated by us in the background from aggregated business information. They do not contain contact details.

Messenger, Instagram and WhatsApp connections: when you connect a Facebook Page, an Instagram professional account or a WhatsApp Business number through our Meta app, we receive from Meta an access token (stored encrypted), the id our app sees for your Facebook account (used only to act on a deletion request), the id and name of the Page, account or number, and the messages people send to it, with the sender’s id and the name their profile shows, and the replies you send. We process these messages as your processor, to show them in your inbox and send the replies and approved templates you choose. We do not add the people who write to you to our business database, do not use the messages to train models, and close a conversation when the person asks you to stop. If you remove our app in your Facebook settings, Meta sends us a deletion request and we delete the connection and the conversations it brought in straight away; the confirmation code can be checked at /data-deletion, which also sets out the other ways to delete. When you write to our own Facebook Page, Instagram account or WhatsApp number, our team reads and answers you in our staff inbox; we keep the conversation for 24 months after its last message, then delete it. Lawful basis: our legitimate interests in answering you (Article 6(1)(f)).

Email reply sorting: when reply sync is on for a mailbox you connect, we read only the replies, bounces and automatic replies in threads of the campaign emails you sent through the Service; we never read or store anything else in the mailbox. For Gmail, replies are read over IMAP with an app password you create; your Google sign-in is used only to send. Each human reply is given a label (interested, not interested, remove me, follow up later, question, referral or other) with a confidence, a one-line reason and a snippet of up to 240 characters. Clear cases are sorted by fixed rules; the rest are sent to the AI provider you connected with your own key, or, only where we allow it, to an AI provider we engage as our processor. We do this as your processor. A "remove me" reply adds the address to your Do not contact list. We delete the snippet after 30 days and keep the label and reason with the conversation. We never use reply content to train models, never sell it, never use it for advertising, and our staff do not read it except for security or with your consent. Google user data is handled under the Google API Services User Data Policy, including its Limited Use requirements.

Reply tracking: where we offer it and you switch it on by connecting an account, we use the messages Meta sends to your own connected Page, Instagram professional account or WhatsApp Business number to show you who replied to the messages you sent from your own browser. We keep only the conversation id, the sender’s handle, name or number, the times, a snippet of up to 160 characters and a label (interested, not interested, unsubscribe, question, automatic reply or other) with a short reason. The label is set by fixed rules or by an AI model on your own AI connection, or on ours only where we allow it, from the snippet alone; you can change it. We process this as your processor, never use it to train models, never share it, and delete it 90 days after the reply arrived, or straight away when Meta sends us a deletion request. A reply asking you to stop puts the contact on your opt-out list.

Email replies and their labels: when you connect a mailbox, we look for replies only in the threads of emails you sent through the Service (a Google mailbox over IMAP with the app password you create, because we connect to Google for sending only; a Microsoft mailbox with the permission to read mail you grant when you connect it; other mailboxes over IMAP), and we do not read, keep or use any other message. For each reply we keep the thread, the sender, the times and a snippet of the reply, and we sort it into a label (interested, not interested, remove, follow up later, question, referral or other) with a short reason and a confidence. Fixed rules decide first; replies they cannot decide are sent, as the snippet only and in small batches, to an AI model on your own AI connection under your contract with that provider, or on ours only where we allow it. A remove label adds the address to your Do not contact list; a referral label can add the referred contact to your notes. We process this as your processor, only to show and label replies for you: replies never go into our business database, our crowdsourced records or any training data. We keep the snippet for 30 days and the label with the thread while your Account keeps it,, and delete them with the thread or when your Account closes. If you change a label, we keep the earlier label as a correction; where the business is part of a Vela Novum objective for which you ticked the training option, the correction (the labels, never the text) can be part of that run’s training record.

Where a feature uses Mira Novum AI (for example Ask AI, Quick find in Vela Novum, Outreach Intelligence, plans, the automatic first answer to a support ticket, reply drafts for our team, and AI assistance for our staff), the content the feature needs is sent to an AI model provider we engage as our processor, under a contract that limits its use to providing the model to us. AI output can be wrong or invented; automatic support answers are labelled as written by AI and a member of our team follows up. Replies to support tickets that our team sends after AI drafted them are checked by a person first. Our staff also use AI to summarise the health, performance and finances of the Service from our own figures and logs, and to suggest actions, which run only when a member of staff approves them.

Developing our models: we may use aggregated and de-identified information about how features are used and their outcomes (for example whether an approved draft received a reply), with identifiers replaced by one-way hashes and without message text, recipient addresses or business names, to develop our own models. Lawful basis: our legitimate interests in improving the Service (Article 6(1)(f)). Our staff choose, check, export and delete training files in a training data centre, which keeps a record of each export; files are kept in our own training storage and deleted under our retention schedule. A registry that would let people send us model updates trained on their own computers exists but is switched off; if we ever switch it on, it will accept only model updates, never data, under its own terms.

Optional Vela Novum training pairs: when you create or edit an objective (a brief), you can tick an option to let us use it as a training example for our own models, including Maia Lumen. It is off unless you tick it. If you do, we keep for that objective: the objective and how it was read, the ids of the evidence used, the scores, the plan, the AI draft of a message next to your edited version, and the reviews you give (good fit, bad fit, won with an optional value, or a complaint). For an objective whose opt-in was given to the wording in use since 29 October 2026, which names how the objective was read, its results and plan, your edits and your reviews, we also build from those items a record of each run from objective to outcome: the stages and how long each took, the questions asked and your answers, the documents you added (as counts and kinds), the businesses proposed and approved, your review choices and approvals, the labels of outreach and replies, unsubscribes as events (never addresses), results in coarse value bands and your feedback. Account, objective and business ids are replaced by one-way hashes, business names never appear, places are kept at district level, and message text appears only as your own drafts and edits, minimised. Without the option, the record of a run stays in your Account as its history, under our contract with you (Article 6(1)(b)), and is never used for training. Training files are built from these with contact details, personal names, web addresses and full postcodes removed and identifiers replaced by one-way hashes, and are used only to develop and test our own models. We record the version of the wording you agreed to: an opt-in given before 29 October 2026 covers only the objective and its plan, and the reviews, drafts and scores are kept for it only if you agree to the current wording on the objective’s page. Lawful basis: your consent (Article 6(1)(a)). You can withdraw at any time by editing the brief and unticking the option, by deleting the brief, or by asking us at [email protected]; the brief is then left out of every later training export. Withdrawing does not affect use before you withdrew.

10. Browser extension

Our browser extension works mostly in your browser. We receive information from it only when you use a feature that needs our server: the connection token that links it to your Account; records you save to a list or send to your CRM; the number of domains in a domain list run, to apply your limits; the domain of a website when you open the company badge, and the domain of each secure website you visit while the optional corner badge is on (used to answer the lookup and apply rate limits, not kept as a history); addresses you send for a mailbox check, handled as a verification job; records you send for AI clean-up; and, only if you opt in to sharing, the business values, page addresses, access results and technology signals described in the Browser Extension Terms, together with the fact that you shared them, which we use to check the values, count your limits and rewards and prevent abuse, and never show to other customers.

Sharing as a condition of the free extension and desktop app: on a free account, signed-in use of the browser extension and the desktop app includes sharing the published company details they read, as the Browser Extension Terms and the Desktop Scraper Terms explain; paid Plans can switch sharing off, and without an account the extension shares nothing. We do not rely on your consent for this. Your side of it is a licence under the contract (Article 6(1)(b)); for any personal data inside a shared record, such as a named business email address or a sole trader’s details, we rely on our legitimate interests in keeping accurate business records (Article 6(1)(f)), with the safeguards in our legitimate interests assessment, and the people concerned keep every right described in this policy. We count the export rows you download from the extension each day, to apply your limit.

AI site finder and second AI check: if you ask the extension to find websites, the words and place you enter go with our fixed prompt to the AI provider you connected, under its terms; we do not receive them. The optional second AI pass, which re-reads a record against the pages it came from and removes values the pages do not support, also runs on your own AI connection. The extension has no feature that records the websites you visit. Where it offers a health check and you switch it on, it sends us once a day a report on how well it read a sample of sites (the sites, the pages, the fields, short evidence from the page and its version), with email addresses and phone numbers replaced by their kind; bug reports you choose to send reach our support desk as a ticket.

Lawful basis: performance of our contract with you for the features you choose (Article 6(1)(b)), and our legitimate interests in keeping our business records accurate, improving our software and protecting the Service against abuse (Article 6(1)(f)). The optional webmail badges read recipient addresses in a message you are writing only in your browser; an address reaches us only if you ask for a mailbox check. The Browser Extension Terms describe each feature in full.

Your own AI keys stay encrypted in your browser and are never sent to us; when you use them, your AI provider processes the page text under its own terms. For runs you share, we receive the AI-filled values with the provider and model. Only if you also tick the separate page collection box, we receive the text of up to 20 public pages of each shared site and a structural outline of each page, with the record the extension produced, to train and test our own models. Email addresses and telephone numbers are removed from that text; named people the website publishes for business purposes may be listed in the record, kept with our other contact data and never shown to customers from this copy. Pages behind a login and sites that opt out are never collected. We keep these copies for 24 months and then delete them, and we keep a record of what was collected and when. Lawful basis: our legitimate interests in building and testing our own models (Article 6(1)(f)); you can untick the box at any time, and anyone named in a copy can object or ask for deletion at the address below.

11. Desktop email verifier

The Mira Novum Email Verifier is a free app for Windows that checks email lists on your own computer. Your files, the addresses and names in them, the results and your settings stay on your computer. Without a connected account the app sends us nothing; it contacts the mail servers of the addresses you check, directly from your computer, and no message is ever sent to those addresses.

If you connect the app to your account (with a connection code, of which we keep only a one-way hash), we process: the addresses you ask our verifier to check when your network blocks the mailbox check, in the same way as a list you upload for verification (we act as your processor for them, under our Data Sharing Terms); your account details, allowance and credits; and the app version.

Record matching: only if you tick the separate record matching option in the app (it is off until you do, version 2026-10-29), for company email addresses with a definite result (the mailbox exists, does not exist, or the domain accepts every address), the app sends a SHA-256 hash of the address, the result, the reason and the time of the check. We compare the hash with the business email addresses we already hold. If it matches, we update that record's verification status and date, unless we hold better or newer evidence; if it does not match, we discard it immediately and keep no record of it. We use this to keep the business data we already hold accurate. Lawful basis: our legitimate interests (Article 6(1)(f)) and the accuracy principle, and only while you have chosen to take part. Records updated this way can earn you verification credits, counted in steps so that no single check shows whether we hold an address. Without your opt-in no hash is sent. You can switch record matching off in the app at any time.

Company-level signals: only if you tick the separate sharing option and accept our data sharing terms (version 2026-10-27), the app sends, for company domains, whether the domain accepts mail, whether it is a catch-all, its email address format as a shape and a count (for example "name.name, 12 addresses", never the names), and generic role addresses such as info@ that the mail server accepted. They go to a review area and are used only after our checks and independent confirmations; accepted signals can earn verification credits. You can switch sharing off at any time.

Results for Mira Novum records (from 1 November 2026): when you verify a list you sent to the app from your dashboard or our browser extension, or an export file from your account with its Record ID column, the app sends the result, reason and time for those rows back to your account, so they appear on your Email verifier page. We accept a result only for a business you exported or unlocked, or a record you saved with the extension, and only for an address that record already holds; everything else is refused and not stored. These results are kept in your account like other verification lists (30 days) and do not change our database. Rows from any other list are never sent.

We never take named personal addresses from your lists into our database, and we never use the app to collect the contents of your files.

12. Mira Novum Desktop

Mira Novum Desktop is a free app for Windows that finds the websites of businesses in the industries and places you choose, reads their public pages from your computer and builds business records in our data standard. It does not read search engines, maps, social networks or any page behind a login, and it obeys each site's robots.txt.

What stays on your computer: your choices and settings, your own AI keys (encrypted, and sent only to the AI provider you chose), your SMTP password for notices, and the records waiting to be sent. The words and places you search for go with our fixed instructions to your AI service, under its terms, and not to us. The app needs a Mira Novum account. With sharing on, exports from the app are unlimited; on a paid plan with sharing switched off, records stay on your computer and you can export 50 rows a day, which we count on our server.

What the app sends us once you connect it to your free account: the business records it built (company details and the business contact details the websites publish, with the page each value came from), the gatekeeper's decision for each website (live or not, archive history, the kind of site), the results of the email checks, the app's version and its running statistics (heartbeats, so you can see your computers in your dashboard and we can tell you when one stops). Before the account is connected it sends only requests for its signed instructions, town lists and the block list check, which works with partial hashes and never with the domain itself.

A daily health report, sent once and then deleted from your computer: counts of the day, up to five sample records with the page text their values came from, and the findings of the health check your AI ran on them. Email addresses and phone numbers are replaced by their kind before it leaves your computer. A problem report is sent only when you send one, with the text you write and the app's version and recent log, and reaches our support desk as a ticket.

How we use what the app sends: records go first to a checkpoint where our filters, suppression lists and removal requests are applied, then to review before anything reaches the shared business data. Company-level values that match businesses we already hold go to the review area under our data sharing terms (version 2026-10-27). You can see and download the records your computers sent in your dashboard.

Sharing: on a free account, sharing the records the app builds is a condition of using the app, which you accept before you connect it; on a paid plan you can switch sharing off in your dashboard. It is a term of the licence, not a consent, so we do not rely on consent for it. Lawful basis: for the business records, including any personal data in them such as a named business email address or a sole trader's details, our legitimate interests in providing accurate business data (Article 6(1)(f)), with the safeguards in our legitimate interests assessment, and the people concerned keep every right in this policy; for your account, your app data, the health report and problem reports, our contract with you (Article 6(1)(b)) and our legitimate interests in keeping the app working (Article 6(1)(f)). You can disconnect a computer or delete your account at any time.

13. Job applicants

If you apply for a vacancy through our job board, we process your name, email address, phone number if given, message, any CV you upload, the vacancy and the time, and a hashed network address used to prevent abuse. We pass the application to the employer who posted the vacancy, who becomes a separate controller of it and is responsible for how it handles your application. For our own vacancies, we are the employer. Lawful basis: steps you ask us to take before a contract (Article 6(1)(b)) and our legitimate interests in running the job board safely (Article 6(1)(f)).

Applications and CVs held on our platform are deleted after the retention period set for the job board, 180 days by default, as the confirmation email you receive explains. Copies the employer has received are under the employer’s control.

14. Brand ambassador and investor enquiries

If you apply to be a brand ambassador or send an investor enquiry, we process the details you give (name, email address, company, role, website, channels and topics, country and message) to consider and answer your enquiry. Lawful basis: our legitimate interests in answering enquiries and building partnerships (Article 6(1)(f)), and steps you ask us to take before a contract (Article 6(1)(b)). We delete an application or enquiry 24 months after our team last reviewed it, or 24 months after we received it if it was never reviewed, unless it has led to a contract with you.

15. People whose business details are in our database

The business records in our database come from public business websites, the structured data published on those websites, official business registers and AI analysis. They contain business-context information such as business names, categories, business addresses, business phone numbers, business email addresses, websites, links to official social profiles, opening hours, website technology, AI summaries and lead scores. Some of this is personal data, for example a named email address, the details of a sole trader or partnership, or the name of a person shown in a business role.

We process this data on the basis of our legitimate interests and those of our customers (Article 6(1)(f)): helping businesses find and contact other businesses for relevant B2B purposes, including trade, supply, partnerships and collaboration. We have carried out a legitimate interests assessment and apply safeguards: business-context data only, masked contact details on public pages, buyer confirmations and a licence that limits how buyers use the data, suppression lists, sales exclusions chosen by verified owners, and a free verified removal process. A summary of the assessment is published on our website.

Recipients are registered customers who unlock or export a record or receive it through our API, under a licence that limits their use and requires them to comply with data protection and electronic marketing law; our processors; and the other recipients listed under Who we share information with. Full details of the categories of data, sources, retention and your rights are in our notice Data Sources and Your Rights.

Some records also hold details particular to that kind of business that the business publishes about itself on its own website, such as a menu, a product range, vacancies, treatments or courses, and the names, roles and business contact details of staff the business publishes for business purposes. We do not record biographies, personal social media accounts, photographs, home details or personal registration numbers, or the names of directors, trustees or people with significant control. Staff details are masked on public pages like all contact details. So that these details can be checked again and our models improved, we keep a copy of the public website pages they come from, encrypted and open only to the systems that build our records and train our models. These copies are never published or supplied to customers, and they are deleted under our retention schedule and when the business record is removed.

We use automated processing and AI to classify businesses, summarise the information they publish, check that email addresses and websites respond, and calculate indicative lead scores (such as the Mira Novum Score, Commercial potential, Completeness, Verification, Freshness and Lead priority). These scores describe business records for comparing and prioritising leads; they are not decisions about any person and have no legal or similarly significant effect on anyone. AI-generated fields are labelled in the product.

16. Verified owners, the collaboration network and affiliates

If you claim a business, we process the verification code, DNS record or file used to verify it (for an officer claim, the officer name you give, the company number and the result of our register check), a log of each DNS check we run for the claim, any photos you upload (stored without location or camera details), the time and method of verification, the labels, text and for-sale details you add, and our moderation decisions. In the collaboration network we process your messages, the businesses you contact, blocks, reports, notes, and whether you chose to share your contact details. Lawful basis: performance of our contract with you (Article 6(1)(b)) and our legitimate interests in keeping the network safe and spam-free (Article 6(1)(f)).

Collaboration messages are visible to the businesses in the conversation. Our team reads a conversation only when it is reported, for that review, or where the law requires it. Your email address and phone number are shared with another business only when both of you choose to share them.

If you are an affiliate, we process your application, links and codes, referral clicks, the accounts and purchases attributed to you, commission and payout records and your encrypted payout details. Referred customers’ details are not shared with you beyond what your dashboard shows. Lawful basis: performance of our contract with you (Article 6(1)(b)), our legitimate interests in preventing fraud (Article 6(1)(f)) and our legal obligation to keep financial records (Article 6(1)(c)).

17. Who we share information with

Processors that help us run the Service, under contracts that require them to protect the data and use it only on our instructions: hosting and storage, database, email delivery, payment processing, security and bot protection, email verification, AI model providers, error monitoring and customer support tools. Our Data Sharing Terms name the providers we use today and say how we tell customers about changes.

Meta, for the Messenger, Instagram and WhatsApp connections you choose and for our own Page, account and number, which processes messages under its own terms; the European Commission’s VIES service and HMRC, for the VAT and EORI checks you ask for; and the UK company register, which receives the company numbers we look up. Keys and passwords our team saves for these and other services are kept encrypted and used only for the connection they belong to.

Payment providers, which also act as independent controllers for their own fraud prevention and regulatory obligations. Providers you connect yourself (such as your mailbox, CRM, messaging account or AI provider), which receive data from us on your instructions.

Professional advisers, insurers and auditors; the police, regulators, courts and other authorities where the law requires it or where it is needed to prevent fraud or protect rights; and a buyer or successor of all or part of our business, under the same protections as this policy.

We do not sell or rent customer personal data. The business database we license to customers is described in the section on people whose business details are in our database.

18. International transfers

Some of our processors store or access personal data outside the UK. Where we transfer personal data outside the UK, we make sure it is protected: either the destination is covered by UK adequacy regulations, or we use the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses approved under UK law, with any additional measures the transfer needs. Where EU law applies, we rely on an adequacy decision or the EU standard contractual clauses. Several of the AI model providers and other services we use are based in the United States; for those we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the International Data Transfer Agreement or the UK Addendum. When you connect your own AI key, mailbox or messaging account, the transfer to that provider happens on your instructions, under your contract with it.

You can ask for more information about these safeguards by emailing [email protected].

19. How long we keep information

Account data is kept while your Account is open. When you close it, we delete the Account, its exports, campaigns and lists, and keep invoices and accounting records for 6 years after the end of the financial year they relate to, as tax law requires.

Export files are deleted 90 days after the export is completed; the record of which businesses an export delivered is kept with your Account so you are never charged twice and so files can be rebuilt on request. Per-address results of email verification are deleted 30 days after the verification job finishes; the job summary is kept with your Account.

Search logs and activity events are deleted after 180 days. Logs of the emails we send are kept for 540 days, because payment disputes can be raised up to that long after a payment. Requests to resend data are deleted after 90 days. Web addresses and HTML you give our web and HTML capture tools, which our servers open or render, are deleted with the files they produce 24 hours after the job starts. Our server-side check tools (such as the SSL, redirect, security header, broken link and website health checks) fetch the address you enter from our servers and show you the result; we keep the result in memory for up to an hour so a repeat check is quick, keep only counts of use against the rate limits (with a keyed hash of your network address when you are not signed in), and do not store the address you checked. A VAT number you enter in the live VAT check is sent to the European Commission’s VIES service (EU and Northern Ireland numbers only), and an EORI number to HMRC’s Check EORI number service, to get the answer; each receives it as an independent controller under its own terms. Anonymous feedback on our free tools (the rating, any reasons, comment and tool suggestion you send, the page language and your browser family, never your full browser details, plus a salted hash of your network address used only to prevent abuse, and an email address only if you ask us to reply) is deleted 24 months after you send it.

Collaboration conversations are deleted 730 days after their last message. Verification data for a business claim (the email address or DNS record used and the code or token) is deleted 12 months after the claim is revoked or released, or after an unfinished claim expires; the log of DNS checks for a claim is deleted after 30 days. Records of reports and moderation decisions, and an audit entry that a claim was verified or revoked, are kept for 6 years as evidence.

Records of the buyer confirmations you give are kept for 6 years after your Account closes, as evidence of what was agreed. Support tickets are kept while your Account is open and for up to 6 years afterwards where they relate to an order, a complaint or a dispute.

Removal and correction requests, including how they were verified, are kept for 6 years. When a business asks to be deleted, a suppression entry holding only the identifiers needed to recognise it (its domain, email addresses and phone numbers) is kept for 5 years so it is not collected or sold again. Entries made after quality checks (for example an expired or parked domain) last 90 days.

So that a business or person who was removed, or who objected, never enters our database again, we also keep a permanent exclusion entry: keyed hashes of its domains, company number and country, email addresses, phone numbers and a fingerprint of its name and postcode, with the reason, the date and the request reference. It holds no readable contact details, is used only to recognise and refuse those details from every source, and is kept for as long as the request must be honoured (UK GDPR Articles 17 and 21). If you later want your business listed again, you can opt back in yourself when you add it; that choice is recorded.

We may keep information for longer where we need it for an open dispute, legal claim or regulator enquiry, and delete or anonymise it when it is no longer needed.

20. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest of connection credentials and other secrets, hashed passwords and API keys, two-factor authentication, role-based access for staff, audit logs of administrative actions, rate limits and bot protection, and regular deletion under the retention periods above.

No system is completely secure. If a personal data breach is likely to result in a risk to your rights, we will notify the ICO, and where the risk is high, we will tell you without undue delay.

21. Your rights

You have the right to: be told how your personal data is used (this policy); access a copy of it; have it corrected; have it erased; restrict its use; receive it in a portable format where we process it by automated means under contract or consent; object to processing based on legitimate interests, and object at any time to its use for direct marketing; and withdraw consent at any time, where we rely on it. Some rights have exceptions, which we will explain if they apply.

To use a right, email [email protected]. We may ask for information to confirm your identity. We respond within one month, which can be extended by up to two further months for complex or numerous requests, in which case we will tell you why. We do not charge for requests unless they are manifestly unfounded or excessive.

If your details appear in our database, the quickest way to remove, hide or correct them is our verified removal process at /data-removal, described below.

22. Removing or correcting business details

Anyone can ask us to remove, hide or correct a business record, free and without an account, at /data-removal. To stop competitors removing a business, we send a six-digit code to an email address on the business’s own website domain, or to an address we already hold for it, and ask for a second detail we hold, such as the postcode district or the last four digits of a listed phone number. The code is valid for 15 minutes.

You can then choose to delete the record (it is removed and its identifiers are suppressed for 5 years so it is not collected again), to hide the full street address or phone numbers (they stay hidden on every update), or to send a correction, which our team reviews. People who cannot use a business email can email [email protected] and we verify the request by hand.

We action verified requests within 30 days, usually within two working days. Removed records are excluded from search, profiles, exports and the API from the time the request is actioned. Copies a customer obtained earlier are under that customer’s control as an independent controller; you can ask them directly to stop using your details. Our customers must apply the removals and objections we tell them about within 7 days and delete the records we tell them were removed, and we tell the customers who received a record when it is erased, unless that proves impossible or involves disproportionate effort.

23. Cookies and similar technologies

We use strictly necessary cookies and browser storage to keep you signed in, protect sign-in and forms against forgery and automated abuse, remember your basket and a location you choose, and remember your choices. We set two optional cookies only if you agree: a referral cookie when you arrive through a partner’s link, and a visit cookie when you tick “Remember my visits” in the cookie notice. We do not use advertising or cross-site tracking cookies. Our Cookie Policy lists each one.

24. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

25. Changes to this policy and complaints

We may update this policy to reflect changes to the Service or the law. We will publish the new version with its date and, for material changes, tell Account holders by email or in the dashboard.

If you have a concern or complaint about how we use personal data, please tell us first so we can try to put it right: in your dashboard choose Help and support and the category “Data protection request or complaint”, or email [email protected]. You do not need an account to email us. We acknowledge every data protection complaint within 30 days, investigate it, and tell you the outcome and what we have done without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, website ico.org.uk. If you live in the European Union, you can also complain to the data protection authority in your country.