Privacy policy
Last updated: 25 October 2026
Who is responsible
Scoutstone LLC, registered in Delaware, USA, 3000 Biscayne Blvd, Suite 210A, Miami, FL 33137, United States, is responsible for your personal data (the controller). Privacy questions: [email protected]. We have not appointed a data protection officer, because the law doesn’t require one for what we do.
Where we got your email address
If we emailed you without your asking, we found your work details in public business sources: your company’s website, public licence registers (such as the Florida and Texas contractor licence files), business listings and professional networks. We may use email-finding and verification services to check that an address works. We contact people only in their business role, at most one address per business.
What we hold, why, and for how long
| You are | What we hold | Why | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Someone we email about our services | Name, job title, work email, company, its website and location, public facts about the company, what AI assistants say about it, your replies, and whether you opted out | To offer our service to your business | Our legitimate interest in direct marketing to businesses (art. 6(1)(f) and recital 47) | Deleted 90 days after our last email if you don’t reply. If you opt out, we keep only your email address and company domain on a do-not-contact list, so we never email you again |
| Someone who sends a request through our site (a free check, an audit or a question) | Your email, your business name or website, the plan you ask about, the page and campaign link you arrived from, and what you tell us | To answer your request, prepare what you asked for and follow up about it | Steps you asked for before a contract (art. 6(1)(b)) | 12 months after our last contact, unless you become a client |
| A client’s contact person | Name, work contact details, billing details, our correspondence and the work we deliver | To deliver the service, bill and keep records | Contract (art. 6(1)(b)); legal duties on invoices and accounts (art. 6(1)(c)) | For the contract, then 6 years for accounting records (Spanish Commercial Code, art. 30) and as long as tax law requires |
| A website visitor | Technical data our host needs to run and protect the site, such as IP address, browser and pages requested | Security and basic statistics without cookies | Our legitimate interest in a secure, working site (art. 6(1)(f)) | As long as our host keeps its logs. We build no profiles |
You don’t have to give us your data. Without it, we can’t prepare a free check or deliver a service.
Most of what we analyze is information about businesses, such as websites, listings and AI answers. Where it names a person, for example an owner named in an AI answer, we use it only for the audit.
We don’t sell personal data, we don’t build advertising profiles, and we make no decisions about people by automated means.
Who receives it
Service providers that work for us under contract:
- our website host (Cloudflare), our form service (Web3Forms), which delivers site requests to our inbox, and our payment processor (Stripe)
- email and outreach tools
- data-collection and email-verification services
- AI providers that help us analyze answers and draft reports
- our accountant
Some of them are in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.
Your rights
You can ask to see, correct or delete your data, to restrict or object to our use of it, and to receive it in a portable format. To stop marketing emails, reply “no” to any of them, use the unsubscribe link or write to [email protected]; we stop at once. We answer requests within one month. If you live in the EU or the UK, you can also complain to the data protection authority where you live or work.
Cookies
This site uses no advertising or tracking cookies, only what is strictly needed to run and secure it. If that changes, we will ask for your consent first.
Security
We use access controls, encrypted connections and established providers, and we keep only what we need.
Changes
We post any update here with a new date.