Privacy Policy

HuntSales ("we", "our", "us") is a B2B sales outreach platform operated by BizGrants Consulting Pte. Ltd., headquartered in Singapore. We help sales teams discover prospects, run cold-email campaigns, and manage their pipeline. Our website is huntsales.io.

This Privacy Policy explains what personal data we collect - both from you (our customer) and about the business contacts you research - how we use it, who we share it with, and the rights you have under applicable law including the Singapore Personal Data Protection Act 2012 (PDPA), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA) where applicable to your use.

From you as a customer

• Account data: name, email address (a work address or a personal one), organisation name, job role, team size, industry, and how you found out about us. Collected during signup.
• Business verification details: when a workspace is set up with a personal email address, what we collect to verify its business. See "Business verification" below.
• Billing data: handled by Stripe. We never see or store full card numbers - only Stripe customer IDs, the last 4 digits, brand, and expiry. See Stripe's privacy policy at stripe.com/en-sg/privacy.
• Connected mailbox credentials: if you connect a Gmail, Outlook, or SMTP mailbox, we store the credentials (OAuth tokens or SMTP passwords) encrypted at rest. Used only to send emails from that mailbox on your behalf and to read replies and bounce notices back into your workspace.
• Usage data: pages visited, features used, errors encountered, IP address, browser type, device type, and timestamps. Used for product analytics + abuse prevention.
• Communications: support emails, chat messages, and feedback you send us.

About prospects (the people you search for)

• Contact data: name, work email, phone number, job title, company name, location, LinkedIn URL, and similar business-context fields. Compiled from public business records, licensed third-party business data, and contacts customers find through HuntSales search (see "Shared business contact data" below).
• Engagement data on your sent emails: opens, clicks, replies, bounces, and unsubscribes. Used for campaign analytics. Tracking pixels and link-wrapping are described in the "Email tracking" section below.

• To provide the HuntSales service: signup, billing, search, sending, analytics.
• To improve the product: aggregated usage analysis, A/B testing, debugging.
• To prevent abuse: spam detection, sender-reputation monitoring, rate limiting.
• To communicate with you: transactional emails (account, billing, security), product updates, support replies.
• To comply with legal obligations: tax, audit, fraud prevention, valid law-enforcement requests.

We do not sell your personal data, your prospect data, or your sent-email content to any third party.

HuntSales holds a set of shared business contact data. Other HuntSales customers can find records in it and add them to their own CRM. This data comes from:

• Publicly available business records.
• Licensed third-party business data.
• Contacts customers find through HuntSales search. When anyone in a customer's organisation finds a person through People Search, Add all or Account Map, that person's business contact details, including any work email we find for them, are added to this data. This applies to contacts found from 8 October 2026.

Never added: contacts a customer uploads, imports or enters themselves; the details of people who contacted a customer, for example through a form on its website or by email; and a customer's own contact lists, campaign content and sent-email logs. These are never visible to other customers. The shared business contact data consists of business contact and profile details, such as name, work email, job title, company, location and LinkedIn URL.

Anyone whose details are in this data can ask us to remove them by emailing hello@huntsales.io. See "Your rights" below.

We do not sell or rent this data to anyone outside HuntSales. Aggregated and de-identified statistics may be published (e.g. "average reply rate by industry") but never in a form that identifies any individual.

When you send a campaign email via HuntSales, we inject a small invisible image (a "tracking pixel") and wrap any links so we can show you opens and clicks. Recipients see a normal email; the pixel only fires when their email client loads images. Some clients (e.g. Apple Mail Privacy Protection) pre-load all images, which can make the open rate appear higher than the true engagement.

We also automatically append an unsubscribe link to every campaign email, as required by CAN-SPAM, CASL, GDPR, and PDPA. Recipients who unsubscribe are added to the suppression list and will not receive future campaign emails from your organisation.

You can sign up with a work email address or a personal one (such as Gmail or Outlook.com). A workspace set up with a personal address is unverified until its business is verified by a paid plan, a confirmed company email address or a business registration document we approve. For this we collect and keep:

• The company register check: for a Singapore company, we look up the UEN you give in our copy of Singapore's public company register, to confirm the company is live and to name the workspace as the register names it. For a company registered elsewhere, we keep the country and company registration number you give. Until the workspace is verified, that number is kept as a claim that does not reserve the company.
• A company email address, if you choose it: the address at your company's own domain that we email a one-time link to, when the link expires and when it was confirmed. We keep only a one-way fingerprint of the link's code, not the code itself.
• A business registration document, if you choose it: the document a Super Admin uploads, such as the ACRA business profile (BizFile) or a certificate of incorporation. It names the company's officers or owners, with the details the register shows for them.
• Our decision: whether the name on the uploader's account, or of the account owner named at sign-up, matches an officer or owner on the document, the decision, any note we give with it, and who decided and when.

Why: to confirm that the person setting up a workspace may act for the business it names, so that nobody can use a real company's name or registration number, search and add from the shared business contact data, or send email in its name without showing the business is theirs.

Who sees it: only the HuntSales platform owner, who reviews it for verification. Documents are stored privately and opened only through links that expire after two minutes. They are never shared with other customers. The workspace's Super Admins see the decision, and our reason when a document is not approved.

How long we keep it: a document still waiting for review is deleted when a newer one replaces it. A document we have decided on is kept, with the decision, as the record of how the workspace was verified for as long as the workspace exists. When the workspace is deleted, we delete every verification document and record held for it. If the documents cannot be deleted at that moment, the workspace is not deleted, so the deletion can be tried again.

Before a workspace can buy a calling number, its owner completes a calling verification. For it we collect and keep:

• The business: its legal name, UEN or company registration number, registered address, and a copy of its business registration document.
• The authorised person: their name, role and contact details, the type of identity document, and a copy of their NRIC or passport.
• The signature record: the full name typed as an electronic signature, the version of the Calling Terms accepted, the date and time of signing, the IP address and browser details it was signed from, and the account that submitted it.

Why: to verify the business and the person responsible for its calls before we enable calling, and to meet our telecommunications obligations.

Who sees it: only HuntSales staff who review the application. Documents are stored privately and opened only through links that expire after two minutes. They are never shared with other customers.

How long we keep it: when an application is resubmitted, we delete the documents it replaces. When the workspace is deleted, we delete the application and every verification document held for it, including any replaced document that was not removed earlier. If the documents cannot be deleted at that moment, the workspace is not deleted, so the deletion can be tried again.

Before we run our managed calling service for a client, the client completes a setup form, and we then invoice the service each month. For this we collect and keep:

• The business: its company details and a copy of its business registration document, and the names of its directors and of shareholders owning 25% or more.
• The authorised signatory: their name, title and email, the type of identity document, and a copy of their NRIC or passport.
• Billing: the billing contact's name and email, and the invoice address.
• The campaign: the campaign brief, any lead list and sample consent evidence the client uploads, the email addresses of the people who receive the weekly report, an email address the client may create for its telemarketer, and, when we find the people to call, the search details the client gives us (industries, company sizes, places, roles, companies to leave out and example companies).
• The signature record: the full name typed as an electronic signature, the version of the agreement accepted, the date and time of signing, and the IP address and browser details it was signed from.
• The signed agreement: a copy of the agreement exactly as it was signed, with the client's company details, the signatory's name, title and email, the boxes ticked and the signature record above.
• Invoices and payments: each invoice, the date a payment was received and the bank reference given with it.

Why: to check the business before we provide the service, set up the client's workspace and its logins, run the calls, invoice the service and keep a record of what was agreed.

Who sees it: only HuntSales staff who review, set up and bill the service. Documents are stored privately and opened only through links that expire after two minutes. Invoice links are private links sent to the client's billing contact, with a copy to the authorised signatory. The signed agreement link is a private link sent to the authorised signatory, with a copy to the billing contact. None of it is shared with other customers. A client's list stays in that client's workspace and is never added to our shared database.

People we find for a client: when a client asks us to find the people we call, we source them from our own business contact data, and they stay our data while our telemarketers call them from the client's workspace. The client's logins see the company, the outcome and the date of each call, and see a person's name and contact details only once that person is interested or books a meeting, so the client can follow up. We do not export or hand over that list.

How long we keep it: when a file is replaced, we delete the file it replaces. When the workspace is deleted, we delete the setup form and every document and list held for it. If they cannot be deleted at that moment, the workspace is not deleted, so the deletion can be tried again. A setup that never becomes a workspace is deleted 90 days after its link expired, the invite was withdrawn or the business check was declined, with any agreement signed for it. Invoices and payment records are kept for 5 years as accounting records, and the signed agreement for 5 years as the record of what was agreed, also after the workspace is deleted.

• Account data: for as long as your account is active. Deleted within 90 days of account closure (some financial records retained per tax/audit requirements, typically 5 years under Singapore law).
• Contacts you import or add to your CRM: retained while your account is active. Deleted when you delete the record or close your account.
• Email sends + engagement logs: retained for 24 months for analytics and compliance.
• Saved search results: pages of People Search results you open are kept for 7 days, so re-opening one is free, and then deleted.
• Shared business contact data: retained while the record remains useful, and refreshed when a lookup or verification touches it rather than on a fixed schedule. Individuals may request removal at any time via the opt-out below.
• Backups: rolling 30-day backups, encrypted, then purged.

Subject to applicable law (PDPA, GDPR, CCPA), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion ("right to be forgotten" under GDPR; equivalent rights under PDPA / CCPA).
• Object to processing for direct marketing.
• Restrict processing in certain circumstances.
• Data portability - receive your data in a machine-readable format.
• Withdraw consent at any time, where processing is based on consent.

For individuals in our shared business contact data: if you are an individual whose business contact details appear in this data and you would like to be removed, please email hello@huntsales.io with the email address you would like removed and, if you have one, your LinkedIn profile link. We will remove it within 30 days and confirm by reply. We also add you to our exclusion list: wherever our data matches the email address or profile link you gave us, your details are not added back to the shared business contact data or to any customer's CRM from our data. Sending both helps us match you. For that list we keep only a one-way fingerprint of each (a hash made with a secret key), not the details themselves.

For customers: to exercise your rights, email us at hello@huntsales.io.

We use cookies that are strictly necessary for the service to function (authentication, security, preferences).

We also use the following third-party tools, which may set their own cookies or identifiers:

• Microsoft Clarity (product analytics, heatmaps, and session recordings) across our website and the logged-in app. We use it to see where people get stuck and to fix usability problems.
• Google Analytics 4 on our public marketing and signup pages (not inside the logged-in app), with IP anonymisation enabled. We use it to measure traffic and how our marketing pages perform.
• A Google Ads conversion and remarketing tag on our public marketing pages (not inside the logged-in app). We use it to measure which ads lead to signups and to show our ads to people who have visited our site. This is an advertising tag and it does share marketing-page visit and conversion signals with Google.

We do not run social-media pixels (for example Meta, LinkedIn, or TikTok), and we do not sell or rent your personal data, your prospect data, or your sent-email content to anyone outside HuntSales. Google Analytics and the Google Ads tag run only on our public pages and never see anything inside your workspace. Because Clarity also records sessions inside the app, a recording can capture what was on your screen at the time, including CRM records you were viewing; we use those recordings only to diagnose usability and technical problems. You can block any of these tools with your browser or ad-blocker settings without affecting your ability to use HuntSales.

On our marketing pages we additionally use our own first-party analytics pixel that sets a first-party cookie and records pageviews, the page URL, referrer, any UTM campaign parameters, device and browser type, and IP address (used to derive approximate location). We use this to understand how our marketing and campaigns perform.

The same first-party analytics is available to customers as our Website Visitors feature. If you add our tracking snippet to your own website, visits are recorded in your workspace, and a visitor only becomes "identified" when they submit a form with their email address (or you identify them). When you do this you are the data controller for those visitors and are responsible for your own cookie notice and for obtaining consent where the law requires it.

We use industry-standard security: TLS-encrypted transport, encrypted storage of credentials, Row-Level Security on multi-tenant data, role-based access control, and regular security reviews. No system is perfect; in the event of a data breach we will notify affected customers without undue delay, in line with PDPA + GDPR obligations.

When you connect a Google account to a HuntSales workflow automation (for example to add calendar events or export rows to Google Sheets), HuntSales's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google account data we access, and why

We request the narrowest scopes needed for each feature, and only after you explicitly connect an account:

• Sign-in (userinfo.email): to identify which Google account is connected.
• Calendar events (calendar.events): to create calendar events, such as booked meetings, in the calendar you connect.
• Google Sheets (spreadsheets): to append rows to a spreadsheet you choose, for the export and automation features you set up.

Limited Use commitments

HuntSales affirms that:

• Our use of Google user data is limited to providing and improving the user-facing features described above.
• We do not transfer or sell Google user data to third parties for advertising, market research, or other purposes.
• We do not use Google user data, including raw, aggregated, or derived data, to train, develop, or improve generalized or foundational artificial intelligence or machine learning models. Where HuntSales uses AI features, they operate only on the data needed to perform the task you requested and are never used to train models on your Google data.
• We do not allow humans to read Google user data unless you give specific consent, it is necessary for security or to comply with applicable law, or the data has been aggregated and anonymised for internal operations.

HuntSales is a B2B product not intended for use by anyone under 18. We do not knowingly collect data from minors.

We may update this Privacy Policy from time to time to reflect changes in our service, sub-processors, or applicable law. We will post the new version with an updated "Last updated" date and, for material changes, notify customers by email at least 30 days before the change takes effect.

Privacy questions or requests: hello@huntsales.io.