Privacy Policy

This Privacy Policy explains how Bulk Buyer Scout ("Bulk Buyer Scout", "we", "us", "the Service") handles information when you use our web application. Bulk Buyer Scout is a business-to-business outreach tool. It lets a registered user upload a list of store owners or business contacts, write an email campaign, control the waiting time between sends, and send those emails from one or more Gmail accounts that the user connects themselves.

We only collect what the Service needs in order to work. We do not build advertising profiles, we do not sell personal data, and we do not use the data we process to train machine-learning models. This policy describes exactly what is collected, what it is used for, where it is stored, how long it is kept, and how you can remove it.

By creating an account or connecting a Google account to Bulk Buyer Scout you agree to the practices described here. If you do not agree, please do not use the Service.

All information in Bulk Buyer Scout is either provided directly by you, generated by your own use of the Service, or returned to us by Google when you authorize a Gmail account. We do not buy contact data, and we do not obtain information about you from data brokers or advertising networks.

We use the information described above only for the following purposes:

• To operate the Service: authenticating you, showing your campaigns and contacts, and sending the emails you have scheduled.
• To personalise message content using the fields you supplied for each contact, exactly as you configured it.
• To enforce the timing you configured between sends, and to retry or stop sending when an error occurs.
• To report campaign results back to you: sends, failures, reply activity and per-account statistics.
• To keep your account secure, prevent abuse of the Service, and comply with legal obligations and the requirements of our providers.
• To fix problems and improve reliability and features.

We do not use your data for advertising, we do not sell or rent it, and we do not share it with other users. We do not use your contacts, campaign content or Google data to train artificial-intelligence or machine-learning models.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The following subsections describe precisely how Google data is used inside Bulk Buyer Scout.

Application data — accounts, contacts, campaigns, message queues and activity — is stored in a managed cloud database hosted on our behalf by our backend provider. Data is encrypted in transit using TLS and encrypted at rest by the hosting provider. Google OAuth tokens receive an additional layer of application-level encryption using a secret key that is available only to the server.

The database uses row-level access controls, so each record is scoped to the account that owns it and one user cannot read or modify another user's contacts, campaigns or connected email accounts. Privileged operations — such as the background process that sends due messages — run only on the server and are protected by server-side credentials.

We take the following concrete measures to protect your information:

• All traffic between your browser and the Service is encrypted with TLS.
• Passwords are hashed by our authentication provider and are never stored in readable form.
• OAuth tokens are encrypted with a server-side key and are only ever decrypted on the server.
• Secrets and keys are stored in a server-side secret store, never in client code or in our source repository.
• Row-level security rules restrict every record to the account that owns it.
• Background jobs and webhook endpoints require a server-side shared secret to run.

No system can be guaranteed perfectly secure. If we become aware of a breach affecting your personal data we will notify affected users and any relevant authority as required by applicable law.

We do not sell, rent or trade your personal information, your contact lists, or any Google user data. We do not share your data with advertisers or data brokers. We share information only in these limited situations:

• With Google, when we submit a message you scheduled to the Gmail API in order to send it from your connected account.
• With our infrastructure providers, who host the application, database and authentication on our behalf and process data only as needed to provide those services to us.
• With the recipients you choose, because the content of a campaign is by design delivered to the contacts on the list you uploaded.
• When required by law, to comply with a valid legal request, or to protect the rights, safety and property of our users or of us.
• In a business transfer, such as a merger or acquisition, in which case the recipient remains bound by this policy or you are notified of any change.

Bulk Buyer Scout relies on the following categories of third-party service:

• Google (Gmail API and Google OAuth) — used to authorize your connected accounts and to send your campaign emails. Google's handling of your data is governed by the Google Privacy Policy.
• Our cloud backend and authentication provider — stores accounts, contacts, campaigns and encrypted connection credentials, and handles sign-in.
• Our application hosting and OAuth connection gateway — serves the application and brokers the server-side OAuth exchange with Google.

These providers act as processors for us. They are not permitted to use your data for their own purposes. Bulk Buyer Scout does not include advertising networks, analytics trackers sold to third parties, or social-media tracking pixels.

We retain your account data, contacts, campaigns and campaign activity for as long as your account remains active, because that information is what the Service shows you. You can delete individual contacts, contact lists and campaigns at any time from within the application, and deletion removes the associated records from the database.

OAuth tokens for a connected Gmail account are retained only while that account remains connected. Disconnecting the account deletes the stored tokens. Technical logs are kept only as long as needed for debugging, security and abuse prevention, and are then discarded by our providers on their normal schedule. When you delete your account, the account record and the data associated with it are deleted, other than anything we are legally required to keep.

You can disconnect a Gmail account at any time. Sign in, open the Email Accounts page, find the account, and choose Disconnect. This immediately deletes the stored access and refresh tokens for that account, and the Service can no longer send anything through it. Any campaign assigned to that account stops sending until you assign a different connected account or reconnect it.

Independently of the app, you can revoke Bulk Buyer Scout's authorization directly in your Google account. Go to myaccount.google.com/permissions, select Bulk Buyer Scout, and choose Remove access. Google then invalidates our tokens for that account. The next time the Service tries to use the connection it will fail, the affected campaign is paused, and the account is shown in the app as needing re-authorization.

To delete your account and the data associated with it, email us using the contact details below from the address registered to the account, or use the account deletion option in the app where available. We will verify the request and delete your account record, profile, settings, contacts, campaigns, message queues, campaign activity and any stored Gmail connection credentials.

We aim to complete verified deletion requests within 30 days. Deletion is permanent and cannot be undone, so please export anything you want to keep first. Note that emails already delivered to recipients, and copies retained in your own Gmail Sent folder, remain outside our control and are not affected by deleting your Bulk Buyer Scout data.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct inaccurate data, to receive a copy in a portable format, to have your data deleted, to restrict or object to certain processing, and to withdraw consent you previously gave. Where the GDPR applies, our legal basis for processing is performance of our contract with you (operating the Service), your consent (for connecting a Google account), and our legitimate interests (security and abuse prevention).

To exercise any of these rights, contact us with the details below. We do not discriminate against users who exercise their privacy rights. You may also lodge a complaint with your local data protection authority.

When you upload a contact list, you act as the controller of that data and we act as your processor. You are responsible for having a lawful basis to contact those people, for honouring their opt-out and deletion requests, and for complying with applicable email and marketing laws such as CAN-SPAM and the GDPR.

Bulk Buyer Scout uses only the storage it needs to work. We set a session cookie and use browser local storage to keep you signed in and to remember basic interface preferences. These are strictly functional — without them you would be signed out on every page load.

We do not use advertising cookies, cross-site tracking cookies, or third-party behavioural analytics. You can clear cookies and site data in your browser at any time; doing so signs you out of the application.

Bulk Buyer Scout is a business tool intended for use by adults. It is not directed to children, and you must be at least 18 years old to create an account. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it promptly; if you believe a child has provided us with information, please contact us.

We may update this Privacy Policy as the Service evolves or as legal requirements change. When we do, we will revise the "last updated" date at the top of this page. If a change materially affects how we handle your personal data or Google user data, we will give notice inside the application before it takes effect. Continued use of the Service after a change takes effect means you accept the updated policy.

If you have questions about this Privacy Policy, about how your data is handled, or if you want to exercise any of your rights or request deletion of your data, contact us at simonawoleye10@gmail.com. We aim to respond to every privacy enquiry within 30 days.

You can also review our Terms of Service.