MSProspector ("we", "our", "Marketopia") provides B2B sales-prospecting research and buying-signal intelligence to authenticated business users ("you", "user"). This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights. Drafted with AI assistance — please direct questions to privacy@marketopia.com.
WHAT WE COLLECT FROM YOU:
- Account data: email address, name, company name, hashed password (managed via Supabase Auth).
- Acceptance + audit metadata: Terms of Service acceptance timestamp, IP address, user-agent string at acceptance.
- Usage data: research reports you generate, prospects you research, integrations you configure (e.g. GoHighLevel sub-account location IDs and encrypted API keys), feedback you submit, Lead Signals territory and subscription preferences.
- Technical data: IP address and user-agent on each authenticated request, captured in error-tracking and audit logs.
WHAT WE COLLECT FROM RESEARCH SUBJECTS (the prospects you research):
- Public information from company websites you supply (publicly accessible web pages, press releases, blog posts, alumni publications).
- Licensed third-party business data (firmographics, technology stack, buying-committee names + titles + general locations) from licensed B2B data providers. We do not disclose the identity of specific data vendors.
- Public-domain information surfaced by AI-driven web search (news articles, podcasts, awards, professional bios published by the subject themselves or their employers).
- We DO NOT collect or infer protected-class information (religion, sexual orientation, health conditions, political affiliation unless publicly campaigned).
- We DO NOT scrape LinkedIn, social media beyond what is surfaced through licensed providers, or any source that prohibits automated collection.
SIGNALS — TERRITORY MONITORING (for Lead Signals subscribers):
- For Lead Signals subscribers, we compile buying-indicator profiles of businesses in the subscriber's selected territory from publicly available and licensed sources: licensed buying-intent and firmographic data from third-party B2B data providers, publicly disclosed breach and ransomware-incident notifications and breach-notification databases, technographic and internet-infrastructure indicators (DNS, mail, certificate, and exposed-service data drawn from public sources), public business filings, and AI-driven public web search.
- These are probabilistic indicators, not verified facts, and inclusion in a brief is not an allegation against any company or person.
- We DO NOT collect or infer protected-class information. Subjects may request removal or correction via privacy@marketopia.com (see "Rights of research subjects" below); data originating from licensed providers must also be addressed with the original source.
WEBSITE-VISITOR IDENTIFICATION PIXEL (optional, subscriber-controlled):
- If a subscriber enables the optional Lead Signals visitor-identification pixel on a website they own, it helps identify business visitors to that site. The SUBSCRIBER is the data controller for that collection and is responsible for all notices, disclosures, and consents required by their visitors' jurisdictions — including GDPR, EU/UK ePrivacy rules, CCPA/CPRA, Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23), Quebec Law 25, and any other applicable privacy or tracking law. In Canada, CASL may require express opt-in consent before the pixel is activated for each visitor. Marketopia acts as the subscriber's data processor and uses the data only to provide Lead Signals to that subscriber.
- The pixel can be disabled at any time in Lead Signals settings. Visitors may exercise their rights via privacy@marketopia.com or the operating site's own privacy contact.
HOW WE USE YOUR DATA:
- Provide the research service you requested.
- Authenticate your account, prevent abuse, enforce rate limits.
- Generate, deliver, and store reports and Lead Signal briefs for your account.
- Push report data to integrations you have explicitly configured (e.g. your GHL sub-account when you click "Send to GHL").
- Comply with legal obligations and respond to lawful requests.
- We do NOT sell your personal data. We do NOT use research subjects' data for purposes other than producing reports or briefs for the user who requested them.
LEGAL BASIS FOR PROCESSING:
- Account and usage data: processed on the basis of contract performance (to provide the service you signed up for) and legitimate interests (security, fraud prevention, product improvement).
- Research-subject data: processed on the basis of legitimate interests in supporting lawful B2B sales prospecting, with appropriate safeguards including data minimization, prohibition on protected-class inference, and subject-rights procedures below.
- For users in Canada: processing is conducted in compliance with PIPEDA and applicable provincial legislation. We collect, use, and disclose personal information only for the purposes identified in this policy, to which you consent by creating an account and using the service.
DATA RETENTION:
- Reports: retained as long as your account is active. You can delete a report at any time.
- Account data: retained until you delete your account.
- Audit logs (terms acceptance, login events, feedback): retained for legal compliance, typically up to 7 years.
- Feedback submissions: retained for product-improvement purposes; PII redacted on request.
- Lead Signal briefs: retained as long as your Lead Signals subscription is active or your account exists.
DATA SHARING:
- Service providers under contract: Supabase (database + auth), Vercel (hosting), Inngest (background processing), Anthropic (AI inference), licensed third-party B2B data providers, Sentry (error tracking), Stripe (billing), Resend (email). Each processes data only as needed to provide the service and is bound by their own privacy terms.
- Integration recipients you configure: when you push a report to GoHighLevel, that data goes to the GHL sub-account you configured. We do not control downstream use of data once it leaves our systems through your configured integration.
- Legal requirements: we may disclose data when required by applicable law, court order, or to protect the rights and safety of persons.
- We do NOT sell personal data to third parties.
CROSS-BORDER TRANSFERS:
Data may be stored and processed in the United States. Transfers of personal data from Canada or the EU/EEA to the US are made in reliance on appropriate transfer mechanisms (PIPEDA adequacy for commercial transfers, standard contractual clauses or other mechanisms for EU transfers). You acknowledge that the US may not provide the same level of data protection as your home jurisdiction.
ENCRYPTION:
- Data in transit: HTTPS/TLS for all connections.
- Data at rest: third-party API keys (e.g. GHL Private Integration tokens) encrypted with AES-GCM-256 using a master key stored in environment configuration.
- Authentication: bcrypt hashing via Supabase Auth.
YOUR RIGHTS:
- Access: request a copy of personal data we hold about you.
- Correction: request correction of inaccurate data.
- Deletion: delete your account and all associated reports + data.
- Portability: export your reports.
- Opt-out of marketing: contact privacy@marketopia.com.
- EU/EEA residents have additional rights under GDPR, including objection to processing and data portability.
- California residents have rights under CCPA/CPRA, including the right to know, right to delete, and right to opt out of sale (we do not sell personal data).
- Canadian residents (see below for details) have rights under PIPEDA and applicable provincial legislation.
CANADIAN RESIDENTS:
If you are located in Canada, you have the following rights under PIPEDA and applicable provincial legislation, including Quebec Law 25 (for Quebec residents), Alberta PIPA, and British Columbia PIPA:
- Access: request a copy of personal information we hold about you, along with an explanation of how it is used and to whom it has been disclosed.
- Correction: request correction of inaccurate or incomplete personal information.
- Withdrawal of consent: withdraw consent to our collection, use, or disclosure of your personal information, subject to legal and contractual restrictions; withdrawal may mean we can no longer provide the service.
- Complaint: lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) or your applicable provincial commissioner if you believe we have handled your personal information improperly.
- Quebec residents additionally have the right to be informed of any automated decision-making that has a significant impact on them, and the right to request that a human review such decisions.
Requests may be sent to privacy@marketopia.com. We will respond within 30 days (or up to 60 days for complex requests, with notice).
RIGHTS OF RESEARCH SUBJECTS:
If you are an individual who appears in a report or Lead Signal brief (e.g. an executive named in buying-committee data) and want your information removed or corrected:
- Email privacy@marketopia.com with your request and sufficient identification to locate your information.
- We will action requests within 30 days where the underlying source data permits removal.
- Note: information sourced from licensed third-party data providers must also be addressed directly with those providers for permanent removal across the broader data ecosystem. We are unable to disclose the identity of specific data vendors.
CHILDREN:
MSProspector is a B2B research tool intended for business users aged 18 and over. We do not knowingly collect personal data from minors.
CHANGES:
We may revise this policy. Material changes will require re-acceptance before continued use. The current version and effective date are shown at the top of this page.
CONTACT:
Privacy questions: privacy@marketopia.com
Legal: info@marketopia.com
Mailing: Marketopia, 3600 75th Terrace North, Pinellas Park, FL 33781, US
