Skip to content
CFCustomerFinder
Log in Try it free

Privacy policy

1. Controller and contact

The controller for the processing carried out by CustomerFinder as described in this policy is the provider identified in the imprint. For privacy requests, contact datenschutz@customerfinder.de.

2. User and website visitor data

  • Registration and sign-in: Email address, password hash, account status and required authentication data; if you choose Google or Microsoft sign-in, the identifiers and profile data provided for authentication. Purpose: account access and management. Legal basis: GDPR Art. 6(1)(b); where relevant, security under Art. 6(1)(f).
  • Projects and usage: Search descriptions, regions, projects, workspaces, search runs, company and contact records, notes, usage limits and related metadata. Purpose: providing requested discovery and management features. Legal basis for user data: GDPR Art. 6(1)(b). For researched third-party personal data, see section 4.
  • Server and security logs: Depending on configuration, IP address, timestamp, requested resource, errors and security incidents. Purpose: delivering the service, diagnosing errors and preventing abuse. Legal basis: GDPR Art. 6(1)(f) (secure and reliable operation). These logs are deleted after one month.
  • Cloudflare Turnstile: On the login, registration, password-reset and confirmation-email forms, technical browser and connection information is processed by Cloudflare to identify bots. Purpose: protection against automated abuse. Legal basis for personal data: GDPR Art. 6(1)(f); requirements under section 25 TDDDG must be assessed separately.
  • Necessary service emails: For example, verification and password resets. Purpose: account operation and security. Legal basis: GDPR Art. 6(1)(b) and, where necessary, (f).
  • Payments and billing: No payments are currently processed through the service. Before paid searches are offered, we will add the payment provider, the billing and payment data processed, the recipients, the legal bases (GDPR Art. 6(1)(b) and (c)) and the statutory retention periods to this notice.

3. Cookies and local storage

Technically necessary cookies or comparable mechanisms are used for authentication and form protection. Your language selection, sender information for email drafts and selection states may be saved locally in your browser. Section 25 TDDDG applies to storing or accessing information on user devices. Consent is not required only where a statutory exception actually applies, particularly where access is strictly necessary to provide a service expressly requested by the user.

4. Publicly researched company and contact information

At users' request, CustomerFinder researches publicly available business information from search results and company websites. This may include company names, websites, business addresses, telephone numbers, generic or individual business email addresses, names and professional roles of contacts, source references and relevance assessments. Professional contact details can still be personal data. Sources include publicly accessible company websites and results from You.com. The accuracy and currency of individual details cannot be guaranteed.

The purpose is to research, display and manage companies and contacts relevant to a user's request. Where CustomerFinder acts as a controller for this processing, GDPR Art. 6(1)(f) can apply only subject to a documented balancing assessment that takes individuals' rights into account. Public availability does not, by itself, authorize unrestricted reuse. Users are responsible for their own additional processing and for ensuring that any contact they initiate is lawful.

Notifying data subjects: Where personal data is not obtained directly from the individual, the information duties and time limits in GDPR Art. 14 apply. Any applicable statutory exception must be assessed and documented, and appropriate safeguards implemented. Merely publishing this policy does not automatically replace required individual notices. Individuals can contact datenschutz@customerfinder.de to request information about their data and sources, correction, deletion or to object.

5. Email drafts, feedback and contact objections

CustomerFinder helps users prepare business email drafts. Under the current service model, users send messages through their own email applications; CustomerFinder does not send those prepared messages. Draft texts and subject lines are not stored on our servers; your sender details remain only locally in your browser.

If a recipient follows a link included in such a draft, CustomerFinder processes, depending on the option selected, the associated email address, the response (“do not contact again”, callback request or abuse report), timestamp and any optional phone number or message. Purposes are to associate and relay feedback, record and respect objections, and handle abuse reports. A legal basis may be GDPR Art. 6(1)(f) (preventing unwanted contact and handling complaints) or, where an actual legal obligation applies, Art. 6(1)(c). A callback request is not blanket consent to other marketing.

A contact objection received through CustomerFinder is taken into account within the platform to the extent actually implemented and made available to the associated user. CustomerFinder cannot technically prevent messages users send independently from external mailboxes. The block applies platform-wide to the email address concerned: no user can prepare an email for a blocked address any more, and the address is not collected again in new searches. Users who saved the company see the status (blocked, callback request, abuse report); a recipient's phone number and message are visible only to the operator. Only the minimum suppression information necessary to prevent renewed contact is retained for as long as necessary and proportionate, with periodic review.

6. Recipients, providers and international transfers

  • You.com: Search queries including industry, product and location information for company discovery; submitted search text may contain personal data depending on user input. We do not transmit your account data, saved contacts or project data to You.com; only the search text and the requested result count are sent. The search text is not intended to contain personal data; users are told so at the point of entry.
  • OpenAI: Search descriptions, results and potentially excerpts of public websites for search planning or analysis; these may contain personal business contact details.
  • Google or Microsoft: If you choose an optional sign-in provider, the required authentication data is exchanged.
  • Cloudflare: Technical information for Turnstile.
  • Hosting: IONOS SE, Montabaur, Germany. Transactional email: IONOS SE. Payment: not currently in use; will be added before paid searches are introduced.

Where providers act as processors, the required data processing agreements are concluded. Transfers of personal data outside the EEA require a specifically applicable safeguard under GDPR Chapter V, such as an adequacy decision covering an actually certified recipient or appropriate standard contractual clauses and any necessary additional measures. Information about applicable safeguards can be requested using the contact in section 1.

7. Retention and erasure

Account and project data is generally needed while the account is in use. After an account or project is deleted, related data is removed in accordance with the deletion process actually implemented, except where statutory retention rules, justified security or evidence needs, or other authorized users' rights require otherwise. Backups are kept for 30 days; data deleted from the live system may therefore remain in backups for up to 30 days before it is overwritten or deleted. Invoices and accounting records are kept for applicable statutory periods. Minimum suppression records may be retained for longer where necessary and proportionate to respect an objection.

When an account is deleted, workspaces used only by that user are deleted completely. In shared workspaces, the user's membership and own searches are removed; the data of the other members remains. Company and contact records that are then no longer assigned to any project are deleted. Suppression records are retained.

Searches and saved companies remain in your project until you delete them, the project or your account. We keep objections (do-not-contact entries) permanently so that an address that has objected is not contacted again. We keep complaints, call-back and abuse reports and privacy requests only as long as needed to handle them and to demonstrate compliance.

8. Data subject rights

Subject to applicable conditions, individuals may request access (GDPR Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and object (Art. 21). Where processing relies on consent, consent can be withdrawn at any time for the future. Individuals may object at any time to processing for direct marketing; their personal data must then no longer be processed for that purpose.

For privacy requests, including when you do not have a CustomerFinder account, contact datenschutz@customerfinder.de. You may also complain to a data protection supervisory authority, particularly where you normally live, work or where an alleged infringement occurred. The authority responsible for the provider's seat is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. AI-assisted evaluation

CustomerFinder uses AI to develop search queries and assess researched companies and contacts. Outputs are research aids and may be incomplete or inaccurate. On the described feature set, CustomerFinder does not make solely automated decisions with legal or similarly significant effects on individuals within GDPR Art. 22.

10. Updates and date

This policy is updated when actual processing or applicable law changes. Last revised: 4 November 2026.