Last updated: 2026-05-06 · This notice tells you how Prospera collects, uses and protects personal data.
"Prospera" (the "Service", "we", "our", "us") is a trading name of Paul Smith, operating as a sole trader in England & Wales. The proprietor (Paul Smith) is the data controller for personal data processed for our own purposes (running the Service, billing, security, marketing). For data you (as a paying customer) upload or save inside your tenant — we are the data processor and you are the data controller; our roles in that case are governed by our Data Processing Agreement.
Business address: Merchant House, 12 Merchant Court, NE31 2EX, United Kingdom.
Email: [email protected]
ICO registration: we are in the process of registering with the UK Information Commissioner's Office as a data controller. The registration number will be added here on completion. If you need our reference before then, email [email protected].
Note on legal entity: Prospera is currently operated by Paul Smith as a sole trader. If the business incorporates as a UK limited company, this page will be updated with the company's registered office and registration number, and we will give 14 days' notice of the change here. Your rights under this notice do not change with the operating entity.
This notice covers four groups of people:
| Category | Examples |
|---|---|
| Identity & contact | Name, business email, company name, role. |
| Authentication | Hashed password, login timestamps, IP address used to sign in. |
| Billing | Subscription plan, payment history, last 4 digits of card and card brand (full card details are held by Stripe, not by us). Billing address. |
| Service usage | Searches you run, leads you save, notifications, settings, API key activity, error logs. |
| Communications | Support emails, in-app messages, marketing preferences. |
| Cookies & analytics | See Cookie Policy. |
Where Prospera surfaces information about UK companies and their directors, the personal data we hold may include:
[email protected], [email protected]), phone numbers,
social-media links, publicly-listed staff names & roles where the company chose to publish them.firstname.lastname@
from a confirmed pattern), classification labels, AI-generated summaries / scores.We do not systematically scrape LinkedIn or any other site that prohibits automated access in its terms. Where we hold a LinkedIn page URL, it is identified via search-engine results and stored as a link, not as a data extraction. See Data sources & attribution for the full source list.
For account holders, we collect data directly from you when you sign up, use the Service, or contact us.
For prospects (Article 14 disclosure), the data is collected from:
| Purpose | Lawful basis |
|---|---|
| Provide the Service to account holders | Contract (UK GDPR Art 6(1)(b)) |
| Process payments and tax | Contract (Art 6(1)(b)) and legal obligation (Art 6(1)(c)) |
| Surface UK company & director data for B2B prospecting | Legitimate interests (Art 6(1)(f)) |
| Verify deliverability of business email addresses (Hunter) | Legitimate interests (Art 6(1)(f)) |
| Operate the demo, prevent abuse / fraud, secure the platform | Legitimate interests (Art 6(1)(f)) |
| Send service emails (password resets, billing, security) | Contract (Art 6(1)(b)) |
| Send marketing emails to account holders | Soft opt-in under PECR + legitimate interests; opt-out at any time |
| Send marketing emails to demo visitors who ticked the optional opt-in box | Consent (Art 6(1)(a)); withdraw any time |
| Comply with law enforcement / regulatory requests | Legal obligation (Art 6(1)(c)) |
Where we rely on legitimate interests for processing prospect data, we have considered the three-part test required by the ICO:
Conclusion: legitimate interests is an appropriate lawful basis for processing UK company-director data for B2B prospecting. We document this assessment internally and review it annually.
We use the following sub-processors. Full details — purposes, location, transfer safeguards — are on the Sub-processors page.
We do not sell personal data to third parties. We do not share data with advertising networks. We may disclose data when legally required (court order, regulatory request, or to protect the safety / rights of users or the public).
Some of our sub-processors are located outside the UK (notably the United States). When personal data is transferred internationally, we rely on the following safeguards as required by UK GDPR Articles 44-49:
The current locations are listed on the Sub-processors page.
| Data category | Retention |
|---|---|
| Account-holder profile + login history | Whilst the account is active, plus 6 years after closure for tax / accounting / legal-defence purposes. |
| Billing records | 6 years from the date of payment (UK statutory tax record-keeping requirement). |
| Demo capture (email + IP) | 24 months from submission, or until the user requests deletion. |
| Prospect data inside a customer's tenant | Whilst the customer's account is active. On account closure, deleted within 90 days unless the customer asks for a final export first. |
| Aggregated cache data (CH, web pages) | Up to 90 days for the cache itself; refreshed on demand. |
| Suppression / opt-out / "do-not-contact" list | Indefinitely — this is the legally-correct way to stop processing your data without losing the record that you asked us to stop. |
| Web-server logs | Up to 90 days. |
Under UK GDPR you have the following rights, all of which we honour without charge in the vast majority of cases. Statutory deadline: one calendar month from a complete request.
To exercise any right, email [email protected]. We may need to verify your identity before responding.
If you are a UK company director and you don't want your details surfaced inside Prospera, email [email protected] with the company name and your name. We will:
Note: information such as your name and director appointments will still appear on the Companies House public register itself. We can only control what's in our copy.
The Privacy and Electronic Communications Regulations (PECR) layer extra rules on top of GDPR for marketing emails, calls and texts. Our position:
Prospera uses AI (large-language models) to:
These are advisory outputs shown alongside source data; they do not constitute solely-automated decision-making producing legal or similarly significant effects on a data subject (UK GDPR Art 22). Account holders are required by our Terms to verify any AI-derived information against the underlying source before acting on it. AI outputs may be plausible-sounding but factually inaccurate; we explicitly do not warrant accuracy.
The Business Health Indicator and any score we surface are not credit ratings and are not regulated financial products. We are not a Credit Reference Agency.
We apply the following technical and organisational measures (UK GDPR Art 32):
In the event of a personal-data breach that poses a risk to data subjects, we will notify the ICO within 72 hours of becoming aware (UK GDPR Art 33). Where the breach is likely to result in a high risk to data subjects, we will also notify affected individuals without undue delay (Art 34).
Prospera is a B2B service for adult business users. We do not knowingly collect data from anyone under 16. Contact us if you believe we hold data on a minor and we will delete it promptly.
We may update this notice. Material changes will be notified by email to account holders at least 14 days before they take effect. The "last updated" date at the top of the page reflects the most recent revision.
Email: [email protected] for any privacy or data-protection question.
You also have the right to complain to the UK Information Commissioner's Office (ICO):
We would prefer to address concerns directly first — please contact us before raising a complaint.