Clear about the data behind the work.

What we collect

For the scanner and enquiries, we receive the work email, company name, public URL, consent selection, scan result, timestamps, and limited technical request information needed to operate and protect the service. Do not submit private, credential-bearing, or staging URLs.

For customers, we also use business contact, contract and billing details plus the minimum screenshots, transcripts, configuration details, or test materials agreed for delivery. Synthetic test data is the default.

For carefully selected business enquiries, we may record a company, its public product information, country, public corporate contact route, relevant professional role, source URL, contact history, and objection or suppression status. We do not buy bulk lists or intentionally collect private personal contact details.

Why we use it

• Provide a requested scan, answer an enquiry, and take steps toward a contract.
• Perform the agreed review, recheck, billing, and customer support.
• Protect the service, prevent misuse, and maintain reliable records.
• Send one relevant follow-up where the scanner user has agreed.
• Make proportionate, individually researched B2B enquiries where the route and local law permit.
• Keep a minimal suppression record so objections are not overridden.
• Meet accounting, tax, legal, and dispute-resolution duties.

The relevant UK GDPR bases are steps at a person's request and contract, consent, legitimate interests in operating a secure service and proportionate B2B development, and legal obligation. We do not rely on legitimate interests where electronic-marketing law requires consent. Consent can be withdrawn and direct marketing can always be objected to.

Who receives it

We share data only with suppliers and advisers needed for website hosting, managed data storage, business email, secure document delivery, invoicing or payment, professional advice, and legal compliance. Access is limited to the relevant purpose. We do not sell personal data.

Suppliers may process data in the UK, EEA, or other countries. For a restricted UK transfer, we require an adequacy regulation or an appropriate safeguard, such as approved contractual clauses, and apply additional protections where required. Contact us for information about safeguards relevant to a particular transfer.

How long we keep it

• Unconverted scanner leads and enquiries: up to 12 months after the last substantive interaction.
• Prospect research and campaign records: up to 12 months after last contact.
• Suppression records: only as long as reasonably needed to prevent repeat contact.
• Restricted delivery source material: normally 30 days after recheck or 90 days after initial delivery, whichever is earlier.
• Contracts, invoices, and required records: for the period required by applicable law.

We delete sooner when the purpose ends unless a record is needed for a legal claim or obligation.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to use of your data. You may withdraw consent at any time. To exercise a right, email hello@clearobligation.com. We may need to verify identity before disclosing data.

You may complain to the UK Information Commissioner's Office at ico.org.uk. We would appreciate the opportunity to address the concern first.

Cookies and security

At launch, ClearObligation does not intentionally use advertising cookies, behavioural analytics, or email tracking pixels. The service uses access controls, encrypted transport, data minimisation, restricted evidence sharing, synthetic test data where practical, and credential revocation after delivery. No internet service is risk-free.

Sources and changes

Business-prospect information comes from company websites, official registers, professional profiles, reputable public announcements, and direct referrals. Material changes to this notice will appear here with a revised date.