Your data is yours. We keep it that way.

What data ProductQuant Intel stores

The platform stores two categories of data: account data and prospect data.

Account data — your name, email address, billing information, and workspace preferences. This is the minimum needed to operate your account and process payments.

Prospect data — the lead lists, enriched contact profiles, and company signals you discover through the platform. This is the data you bring into the system or that the system discovers on your behalf. It includes business contact information (names, emails, phone numbers, job titles, company names) sourced from public business directories, company registries, and publicly available business profiles.

We do not store any personal social media content, private messages, health data, financial account numbers, or government IDs. The platform does not attempt to discover or store personal contact information for individuals outside a business context.

Where your data lives

Your data is stored across two infrastructure layers, both within the EU and UK:

• Cloudflare D1 (Edge Database) — Account metadata and configuration are stored in Cloudflare's global edge network, with primary processing in the European Union. Cloudflare is GDPR-compliant and SOC 2 certified.
• SQLite on EU-based VPS — Prospect data, lead lists, and enrichment results are stored in an encrypted SQLite database on a virtual private server hosted in the EU (Hetzner, Germany).

No data is stored on servers in Russia, the United States, or any jurisdiction outside the European Economic Area or the UK. Backups are encrypted and retained for a maximum of 30 days.

Who has access

Access to your data is strictly limited:

• You and your workspace members — Any data you bring into the system is visible only to users in your workspace. We do not share prospect data across tenants.
• Jake McMahon (founder, sole operator) — Has infrastructure-level access for support, maintenance, and incident response. He does not access your data unless you request support or there is a verified system issue.
• No third parties — We do not sell, license, or share your prospect data with any third party. We do not allow third-party analytics scripts that could read page content. We do not partner with data brokers.

Sub-processors used for infrastructure: Cloudflare (edge compute and database), Hetzner (VPS hosting). Both are GDPR-compliant. A full sub-processor list is available on request.

Data retention

We retain your data for as long as your account is active. If your subscription lapses:

• 30 days after non-payment — Your workspace is frozen. Data remains in place but the platform stops processing new signals and enrichment.
• 90 days after non-payment — All prospect data, lead lists, and enrichment results are permanently deleted. Account metadata (name, email) is retained for billing records.
• On account deletion request — Full deletion within 14 days. This includes all prospect data, account metadata, and backups. No residual copies are retained.

Data processing legal basis (GDPR)

ProductQuant Intel processes prospect data under the following GDPR legal bases:

• Legitimate interest (Article 6(1)(f)) — For processing business contact information sourced from public registries and directories. Business-to-business contact discovery is a recognised legitimate interest under GDPR recital 47 and guidance from most EU data protection authorities.
• Consent (Article 6(1)(a)) — For any enrichment sources that require opt-in (for example, if a data source requires verifiable consent before the contact can be stored in the platform).
• Contractual necessity (Article 6(1)(b)) — For processing your account data to provide the service you subscribed to.

We do not rely on "performance of a task carried out in the public interest" or "vital interests" for any processing activity.

How to request deletion

You can request deletion of your data at any time:

• In-app — Settings → Workspace → Delete workspace. This triggers a 14-day deletion process.
• By email — Send a deletion request to [email protected] from the email address associated with your account. We will confirm receipt within 48 hours and complete deletion within 14 days.

We do not charge a fee for data deletion requests. If you are an EU or UK resident, you also have the right to data portability (receive your data in a machine-readable format) and the right to object to processing based on legitimate interest.

Security practices

• Encryption at rest — SQLite database is encrypted using AES-256-GCM. Cloudflare D1 uses transparent encryption at rest.
• Encryption in transit — All connections to the platform use TLS 1.3. API endpoints are HTTPS-only.
• Access control — Infrastructure access requires SSH key authentication with passphrase-protected keys. No password-based SSH access is enabled.
• No third-party data sharing — The platform does not integrate any advertising networks, analytics trackers, or data-sharing partners that could access your prospect data.
• Regular backups — Encrypted daily backups with 30-day retention. Backups are tested quarterly for integrity.

GDPR scope

This policy applies to all processing of personal data of individuals within the European Economic Area and the United Kingdom, as defined by the GDPR (EU) 2016/679 and the UK GDPR. If you are based outside the EEA or UK, the same protections apply to your data — we do not differential-protect by jurisdiction.

Our Data Controller is Jake McMahon, ProductQuant, contactable at [email protected]. We do not have a registered establishment in the EU; we rely on Article 27 representation via our EU-based data infrastructure.

Changes to this policy

If we change how we handle your data, we will notify you by email at least 30 days before the change takes effect. We will also update the date below. Continued use after that period constitutes acceptance of the changes.

Last updated: May 9, 2026