Privacy

This describes what Prequalified stores and who it is sent to. It is written to be read rather than to be comprehensive-sounding, and it matches what the software actually does.

What we store

Your email address and a hashed password. The website address you give us, and the profile extracted from it — what you sell, who you serve and the problems you solve. The searches built from that profile. The public posts a scan finds, the scores given to them, and the reply drafts written for them. Anything you type into the app, such as notes on a lead or your voice settings.

We record what each scan and each draft cost us to run, so that usage can be shown back to you and capped.

What we do not store

We do not ask for or store card details. Payments run through Stripe, which collects and holds them on its own systems; no card field ever exists on this site, and what comes back to us is a customer reference, a subscription status and a renewal date. We do not ask for your Reddit or X account credentials — Prequalified never signs in as you and never posts anything.

Where your data goes

If you subscribe, Stripe processes the payment and receives your email address, your billing address and your card details directly from you. Stripe is the controller of that payment data and acts as our processor for the subscription record; we receive back only what we need to know which plan you are on. Stripe is certified under the EU–US Data Privacy Framework and holds PCI DSS Level 1. Nobody at Prequalified can see your card.

Two further third parties are involved in normal use. Apify runs the website crawl and the Reddit and X searches, so it receives the URL you submitted and the search terms built from your profile. OpenRouter runs the models that read your website, score posts and write drafts, so it receives the text of your site, the posts being scored, and your profile. Transactional email — verification and password resets — is sent through Resend. Our database and hosting are provided by Neon and Vercel.

We do not sell your data, and we do not share it with anyone else.

The people in the leads

This is the part of this policy that matters most, because it is about people who never agreed to any of it.

When a scan runs it collects public posts from Reddit and X, and for each one it stores the text, the author’s public username, a link to the post, and a score describing how well that person matches a customer’s business. The scoring is done by a language model. Under the GDPR that is profiling of an identifiable person, and the fact that they posted publicly does not by itself make it lawful. So it is worth being exact about what we rely on.

Our lawful basis is legitimate interests (Article 6(1)(f) GDPR) — ours and our customers’ interest in finding people who have publicly said they need the thing that customer does. Weighing that against the interests of the person posting: the data is limited to what they chose to publish under a name they chose to publish it under, it is not combined with anything from anywhere else, we do not attempt to identify anyone behind a username, we do not build a profile that persists beyond the post, we never contact anyone automatically, and nothing is ever sold or shared. What a customer does with a draft reply is a decision a person makes, on the platform, under that platform’s own rules. We think that balance holds. If you are one of the people being scored and you disagree, the section below is not a formality — it is the point.

We do not collect special category data on purpose, and we do not search for it. A public post can of course contain anything, and if one we hold contains something about your health, beliefs, politics or anything else in that category, it is there because you wrote it and not because we went looking. Deleting it is one form below.

If you are one of those people

You have the right to see what we hold about you, to correct it, to have it deleted, to object to the processing entirely, and to complain to a regulator. We are established in Denmark, so our supervisory authority is Datatilsynet, the Danish Data Protection Agency — and if you live elsewhere in the EU or EEA you may complain to your own national authority instead. You do not need an account here to use any of these rights, and we will not ask you to prove who you are before deleting something.

Delete everything we hold about a Reddit or X account — one field, no account, immediate. It deletes the posts, the scores and the drafts written from them, and it adds the username to a list our searches check before collecting anything, so a later scan does not bring it all back. For anything else, including a copy of what we hold, use the contact form and we will answer within a month. It does not require an account either.

How long any of it is kept

A post that a scan collected but nobody kept — the great majority of them — is deleted thirty days after we collected it. A post that did become a lead is kept as long as that lead is, which is twelve months, and then both are deleted. Deleting your account deletes everything belonging to it immediately. These are enforced by a job that runs every night, not by a promise to get round to it.

Anything you send us through the contact or support form is kept until it has been dealt with, and then for twelve months from the day it was closed — long enough to look back at what people were struggling with a season ago. A report that is still open is not deleted on a timer, because a product with no support inbox forgetting an unanswered complaint would be the worst thing this could do. Deleting your account removes yours straight away, including any you sent before you had an account.

Nothing here is ever used to train a model. The text of a post is sent to the model that scores it and is not retained by us for any other purpose.

Cookies

One cookie, holding your session, so that you stay signed in. It expires after thirty days. There is no analytics, advertising or tracking cookie on this site.

Deleting your data

Settings → Account has a delete button. It removes your account, your workspace, your profile, your searches, your leads, your drafts and anything you sent us through the contact form. It is immediate and it is not reversible. You can also ask us and we will do it for you.

Who we are

Prequalified is a product of Cupid Solutions (CVR 43973746), a company registered in Denmark. That company is the data controller for everything described above, and it is who a request or a complaint is made against.

We do not publish an email address, and that is a decision rather than an oversight: a single inbox read by a single person is a promise that quietly stops being kept. Questions, requests and complaints go to the contact form, which needs no account, lands in a queue a human works through, and cannot be lost to a spam filter. We answer within a month, and in practice sooner.