TrawlPrivacy Policy
LAST UPDATED 18 AUGUST 2026
This Privacy Policy describes the personal data Trawl collects, the purposes for which it is processed, the parties who receive it, and your rights. The controller of your personal data is Rax, an unincorporated sole proprietorship based in Florida, USA, reachable at [email protected]. A postal address is available on request.
Summary
- We collect the minimum needed to operate the product: your email address, the content you enter, and your usage of the results.
- We do not sell personal data and we use no advertising or analytics tracking. There are no analytics or advertising cookies on Trawl.
- Business data is sourced from Google and deleted after 30 days, in accordance with Google’s licensing terms.
- You may delete your account and its data at any time from Settings. A copy of your data is available on request.
1. Data we collect
Account information
Your email address and a securely hashed password; or, if you sign in with Google, the email address and name Google provides. We do not receive your Google password and do not collect your profile photo.
Optionally, a full name and a display name.
Usage data
The searches you run (search text, radius, and a centre point rounded to approximately one kilometre), the businesses you save as leads, and your work on them: pipeline stage, reminders, notes, and call outcomes.
Location data
If you use the “near me” feature, your browser requests your permission and transmits your coordinates for that search. Coordinates are rounded before storage. Location is never collected in the background. The feature is optional; a place name may be typed instead.
Payment information
For paid plans, card details are submitted directly to Stripe and do not pass through our servers. We store only a Stripe customer reference, the plan, and the subscription status.
Technical data
Our hosting and database providers keep standard server logs, including IP addresses, for security and debugging. We do not build profiles from them.
If you run the one free search available without an account, we store a keyed hash of your IP address — not the address itself — together with the search text, for up to seven days. Its only purpose is to keep that search to one per connection per day; it is not linked to any account and it is not analytics.
2. Legal bases for processing
| What | Why | Legal basis (UK/EU) |
|---|---|---|
| Email, password, profile | To create and secure your account | Performance of a contract |
| Searches, leads, pipeline | To deliver the product and enforce plan limits | Performance of a contract |
| Location, when you use near-me | To search around you | Consent — withdrawable in your browser |
| Payment and subscription status | To take payment and provide the correct tier | Performance of a contract |
| Server logs | Security, fraud prevention, debugging | Legitimate interests |
| Service emails | Receipts, password resets, changes to terms | Performance of a contract |
3. Cookies and local storage
Trawl sets no advertising or analytics cookies. The following strictly necessary storage is used:
- A session token from our authentication provider, so you stay signed in.
- Preferences kept in your browser’s local storage — which screen the app opens on, whether the sidebar is open, whether you have chosen a search location, whether you have dismissed the one-time welcome tour, and whether this browser has used its free search. These do not leave your device.
4. Business data and the 30-day rule
Most of the data shown in Trawl concerns the businesses you search for, not you. It is sourced from the Google Maps Platform, which licenses it on terms that permit retaining a business’s permanent Google identifier but permit retaining the details — name, category, phone, rating, review count, opening hours, street address and website address — for a maximum of 30 days.
We therefore delete those details on a 30-day cycle. A business saved as a lead is retained, together with everything you added to it; the Google-sourced details show as expired until the business is searched for again. Website performance measurements are derived from Google PageSpeed Insights and constitute our own analysis; they are not affected by this deletion.
Some businesses shown in Trawl are sole traders, for whom a business phone number may also be personal data. Such persons may request removal of their business from Trawl by emailing [email protected]. The underlying source is Google: corrections made to a Google Business Profile propagate to Trawl.
5. Recipients of your data
We use a small number of providers, each for a single function:
| Provider | What it does | What it gets |
|---|---|---|
| Supabase | Database and sign-in | Your account and all your Trawl data |
| Cloudflare | Hosting and delivery | Request logs, including IP |
| Google Maps Platform | Business search | Your search text and radius. Sent from our servers, never your browser, so Google does not receive your IP address. |
| Google PageSpeed Insights | Website analysis | The prospect’s website address. Nothing about you. |
| Stripe | Payments | Your email and payment details |
| Resend | Sends account email — sign-up confirmations and password resets | Your email address |
| Anthropic | Writes the cold opener when you request one | The prospect business’s public listing details and our measurements of its website. Sent from our servers, never your browser. Nothing about you. |
This is the complete list. We do not sell personal data, we do not share it for advertising, and we do not disclose it to any other party except as required by law or at your request.
6. Where your data lives
Our providers operate globally and your data may be processed outside your country, including in the United States. Where data leaves the UK or EEA, transfers rely on the safeguards those providers have in place, such as Standard Contractual Clauses.
7. Retention
- Account and pipeline data — retained while your account is open.
- Google business details — 30 days, as described in section 4.
- Leads never worked on — deleted automatically after 60 days of no activity. Leads you have worked on are retained.
- Deleted accounts — account and pipeline data are deleted immediately on deletion.
- Invoices and tax records — retained with our payment processor for the period required by law, typically six to seven years, including after account deletion.
8. Your rights
Depending on where you live, you have the right to access, correct, delete, or restrict the processing of your personal data. In the UK and EEA these are rights under the UK GDPR and GDPR; in California, under the CCPA as amended. We do not discriminate against you for exercising them.
Account deletion is self-service: deleting your account from Settings removes your leads, call history, reminders and search history without contacting us. For a copy of your data, a correction, or any other request, email [email protected]; we respond within 30 days.
You are entitled to lodge a complaint with your data protection regulator. In the UK this is the Information Commissioner’s Office at ico.org.uk.
9. Security
Passwords are stored only in hashed form. Traffic is encrypted in transit. Data is segregated per account at the database level by row-level security. API keys are held only on our servers and never reach your browser.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant regulator as the law requires.
10. Children
The Service is a business tool and is not directed at persons under 18. We do not knowingly collect data from children; data found to have been collected from a child is deleted.
11. Changes
If we change this policy, the date at the top is updated. For material changes, we notify you by email before they take effect.