Privacy policy
Last updated 12 October 2026
- Company
- GETSCOUTA LTD
- Company number
- 17011270
- Registered office
- 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom
- Contact
- [email protected]
Who we are
Scouta is run by GETSCOUTA LTD, a company registered in England and Wales (company number 17011270). Our registered office is 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.
We decide how and why the personal data on this page is used, so we are its controller. For any question or request, email [email protected]. We reply within one month.
This policy covers scouta.si and our emails to businesses. Paid client work is covered by its own agreement.
The short version
- We email people at businesses about work Scouta could help with. Reply "no" and we stop for good.
- We measure visits to this site from the moment a page loads. Decline in the banner and it stops.
- We set no advertising cookies and we never sell personal data.
- We keep data only for the periods in the table below.
Visiting the website
Hosting: the site runs on Cloudflare Pages. Cloudflare handles every request, so it processes your IP address and browser details to deliver pages and block attacks.
Fonts are served from our own site. Some pages show company and software logos loaded from logo.dev (img.logo.dev). Your browser asks logo.dev for each logo, so logo.dev sees your IP address and the address of the page.
Bot checks. When you book a call or join the waitlist, Cloudflare Turnstile checks that you are human. Cloudflare receives your connection details for that check. We then keep a session token in your browser for up to 30 minutes so the check runs once.
Abuse limits: to stop abuse we count requests in short-lived counters. They are keyed by a one-way keyed hash of your IP address (and, for the booking form, of your email address), never the address itself. They expire within a day.
How we measure visits
From the moment a page loads, we record which pages are viewed, the kind of site that sent you (for example a search engine or an AI assistant), how far you scroll, and clicks on key buttons such as booking and pricing. We never record what you type.
We use two tools. PostHog, on its EU servers, receives these events and your IP address. PostHog keeps a random visitor ID in this tab's session storage, so it sets no cookies and forgets you when you close the tab. Our own event log keeps events in a Cloudflare D1 database that stores no IP address, browser fingerprint or free text. Each browser tab gets a random ID that ends when the tab closes. A coarse region (UK, US, EU or elsewhere) comes from Cloudflare's country lookup.
Why: we rely on our legitimate interest in knowing which pages help people and which do not. The data is limited to page and button labels, and it is never used for advertising.
Your choice: decline in the banner, or in Cookie settings in the footer, stops both tools at once and we remember it for 180 days. If your browser sends Global Privacy Control or Do Not Track, both stay off without you asking. Declining stops future measurement. It does not delete events already received, but you can ask us to.
Product examples
The interactive product examples run in your browser. They use illustrative data and do not send the example work to AI models or connected tools. Approving an example does not send a message or document.
If you describe your own goal in the booking or waitlist form, it is handled as explained below. Please leave out personal or confidential details, such as client names.
Booking a call
The booking form asks for your name, your work email and, if you like, a note on what you'd like us to look at. These go to our server and are emailed to our team through Resend, along with what the page already knows, such as the kind of team a page is for or the team size you picked on the pricing page. We do not keep any of this in a database. If you came to us from one of our emails, we also note on your lead record that you booked a call.
The calendar is Cal.com. When you book, Cal.com receives your name, your email, your note and the time you pick, and sends the invitation.
Why: these are steps you ask us to take before a possible contract.
Joining the waitlist
The early access form asks for your work email and, if you like, your name, company, team size and the goal you would start with. We store this in a Cloudflare D1 database with the page you sent it from, any campaign tags in the link, and the code from our email link if you came from one.
Resend sends you a confirmation and sends our team a note. Only our team can see the list, on a private admin page behind a login.
We use Resend to record delivery, bounces and link clicks for these emails. Links include campaign and link labels so we can understand which emails lead to visits and enquiries. We do not use email-open tracking pixels.
Why: you asked to hear when early access opens, so we rely on your consent. Withdraw it at any time by emailing us and we will remove you.
Our emails to businesses
We email people at businesses in the UK, the US, Ireland, the Netherlands and the Nordic countries (Denmark, Finland, Iceland, Norway and Sweden). We do not email anyone in other countries. We write to people whose role makes our service relevant to their work, usually a director, partner or owner, and only at work email addresses. In the UK we write only to limited companies and LLPs.
Where the contact details come from
- Companies House: a firm's name, number and status, and the names of its active directors or LLP members. This is a public register.
- The firm's own website: what the firm does. An AI model, through OpenRouter, reads the public pages to write one line of the email and the firm's private page. It may only use words that appear on the site.
- Hunter (hunter.io): the firm's web address and the likely work email address of the person.
- MillionVerifier: checks that the address can receive email. We only send to addresses marked valid.
What we keep and where
For each person we keep a lead record: name, work email, company, website domain, sector, campaign, which email in the sequence they are on, country and the date added. We also keep the line we wrote for them and the page it came from. The record lives in Cloudflare KV.
We use Instantly (instantly.ai) and the Salesforge tools (Salesforge, Primeforge and Warmforge) to send and manage our emails. The sending tool holds the same lead record and the email history. The emails go from Google Workspace mailboxes on our sending domains, and Warmforge checks that they reach the inbox. Open tracking and click tracking are switched off. A sequence is at most three emails, and it stops when you reply.
Why we think this is fair
We rely on legitimate interests. In plain words, this is how we weigh it.
- Our interest: finding businesses that could use our service. UK and EU law accept direct marketing as a legitimate interest.
- What we need: a name and a work email to reach the right person, plus public facts about the firm, and nothing more.
- Your side: the data is your work identity, already public on a register or your firm's site. The email is about your firm's work and never your private life. You get at most three emails, each says who we are, and one word stops them.
- Your control: you can object at any time and we will not contact you again. This right is absolute for direct marketing.
The private page for your firm
Our emails link to scouta.si with a random code (?lt=…). The code stands for one person on our list. It never contains a name or email address.
With the code, the page can show your company's name and a short note for your firm: facts quoted from your firm's own website with links to the source, one to three example processes, and sometimes how AI models did on a sample document of the kind your sector produces. If you answer "Did we pick the right three?", we keep your answer for 90 days.
Your browser receives only your first name, company, sector and a masked email address, for example s•••@firm.co.uk. Your full email address is used only if you tap "That's me" to fill in the booking form. If the link was forwarded to you, choose "Not you?" and enter your own details.
The note is never in the page's HTML, never in a sitemap and marked noindex, so search engines do not list it. The code is removed from the address bar after the page loads, kept only for that browser tab, and stops working 90 days after we sent the email.
If you open the page, we record which parts of it you look at and whether you start or finish booking a time. We never record what you type. We use this only to decide which follow-up email to send you next, choosing from emails Ed has already written, or to suggest that Ed sends you a short personal note, which he reads before it goes. No other decision is made about you. To stop our emails, reply "no". To stop the page recording visits, choose Decline in the cookie bar or turn on Global Privacy Control.
When you reply
Our sending tool passes your reply to our reply desk. It stores the thread (your name, email, company, the messages and our notes) in Cloudflare KV. An AI model, through OpenRouter, reads the reply to sort it, for example "interested", "not now" or "stop", and suggests a draft from our templates.
A person reads and approves every reply before it is sent. The only exceptions are short acknowledgements of out-of-office messages and opt-outs. We never make a decision about you based only on automated processing.
Opting out
Reply "no" to any email, use your email app's unsubscribe button, or write to [email protected]. We stop every email in progress the same day.
We then keep only your email address and the date on the block list in our sending tools, so that you are never contacted again. We delete the rest of your lead record.
Who we share data with
We use these providers to run the site and our outreach. They act on our instructions. We share nothing with anyone else unless the law requires it.
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Hosting, databases, bot checks | Global network, US company |
| PostHog | Visit measurement | EU |
| logo.dev | Company and software logos | US |
| OpenRouter and model providers | AI for outreach lines and reply sorting | US |
| Resend | Form emails and confirmations | US |
| Cal.com | Booking calendar | US |
| Instantly | Sending outreach emails | US |
| Salesforge | Sending outreach emails | EU, with some of their suppliers outside the EU under standard contractual clauses |
| Primeforge | Setting up our sending mailboxes | EU, with some of their suppliers outside the EU under standard contractual clauses |
| Warmforge | Warming up our sending mailboxes and checking delivery | EU, with some of their suppliers outside the EU under standard contractual clauses |
| Google Workspace | Sending mailboxes and our inbox | US company |
| Hunter | Finding work email addresses | US |
| MillionVerifier | Checking email addresses | Hungary (EU), with some subprocessors outside the EEA |
Transfers outside the UK
Some providers are in the US or process data there, and some suppliers of MillionVerifier and of the Salesforge tools are outside the EEA. For a US provider certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the UK's data bridge. Otherwise we rely on the standard contractual clauses with the UK Addendum, or the UK International Data Transfer Agreement, in that provider's data processing terms. The EU and EEA countries have UK adequacy, and the UK has EU adequacy.
How long we keep it
| Data | Kept for |
|---|---|
| Our event log (D1) | 13 months, then deleted automatically |
| PostHog events | 13 months |
| Abuse counters (hashed) | Up to 1 day |
| Bot check token | 30 minutes |
| Demo tasks | Not stored |
| Booking briefs and Cal.com bookings | 24 months after the call, unless you become a client |
| Waitlist entries | Until early access opens, plus 12 months, unless you join |
| Outreach lead records | 12 months after our last contact |
| Email link codes and firm pages | 90 days after the email |
| Reply threads | 180 days after the last message |
| Opt-out list | Your email address and date only, for as long as we send outreach |
Your rights
You can ask for a copy of your data, ask us to correct or delete it, restrict or object to its use, or receive it in a portable form. Where we rely on consent, you can withdraw it. Some rights depend on the circumstances. Your right to object to direct marketing has no conditions.
Email [email protected]. It is free, and we reply within one month. We may ask you to confirm who you are.
Complaints
Please tell us first and we will try to put it right. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU or EEA, you can complain to your own data protection authority.
Changes to this policy
When we change this policy we update the date at the top. If a change matters to you, we will tell you before it applies.
See also our website terms. You can change your analytics choice in .