Legal
How Loadout handles your data and the business contact data in its results.
This notice explains how we handle personal data in Loadout: the Loadout dashboard on entrepedia.co, the MCP server at mcp.entrepedia.co that your AI apps connect to, and Loadout payments. It adds to our main Privacy Policy, which still applies. Where they differ on Loadout, this notice wins.
The controller is Infoproduct Systems s.r.o., Hellova 11/7, Košice 04011, Slovakia, ID No.: 55186033, registered in the Commercial Register of the Slovak Republic MS Košice, Section: Sro, File No. 55913/V, which runs Entrepedia and Loadout ("we", "us").
Contact e-mail: info@entrepedia.co
This notice covers two groups of people:
Account link. Your Entrepedia user ID, your email address, when you joined and when you were last active.
Workspace and credits. Your plan, your credit balance and every credit movement (credits added, reserved, spent, refunded or expired), your daily spend cap and your subscription status.
Runs. Each time your AI uses one of our tools, we save a run: which tool, the input your AI sent (for example a business type and a city, a website address, a company name or keywords), the result we returned, a short summary, its status, the credits estimated and charged, the time, and which connected app made the call. This is how you and your AI can reopen earlier work, and how we check charges.
Business Brief. Your Business Brief stays in your AI app or on your computer. When your AI asks us to check a brief, we read the text to return the check and don't save it. If your AI puts parts of your brief into a tool's input, that input is saved with the run, like any other input.
Connected apps. For each AI app that connects to your workspace: the kind of app (for example Claude, ChatGPT or Codex), its OAuth client ID or the API key it used, and when it was first and last seen.
API keys. The key's name, its first few characters (so you can recognise it), a one-way hash of the full key, when it was last used and when it was revoked. We never store the full key and can't show it again.
Website screenshots. When a website scan includes a screenshot, we store the image in private storage. It is reached only through short-lived signed links and is deleted after 90 days.
Payments. Stripe processes your payment. We receive your Stripe customer ID, billing name and address, VAT number if you give one, and records of payments, invoices, refunds and disputes. We don't receive your full card number.
Security and technical data. Server logs and error reports contain technical details of requests, such as IP address, the app or browser identifier, the time and the error. We also record security events such as API keys created or revoked.
Free tools without an account. If someone uses a free tool without signing in, we store a one-way hash made from their IP address and browser identifier, to apply free-use limits. We don't link it to an account.
We don't ask for sensitive personal data, and you shouldn't send it in tool inputs.
We don't make decisions about you that have legal or similarly significant effects based only on automated processing. Spend caps and free-use limits are applied automatically, but they only stop runs; they don't decide anything about you.
We don't sell your personal data, and we don't sell your tool inputs or results.
Your AI apps. Results go to the AI app you connected. That app is run by another company (for example Anthropic, OpenAI or xAI) under its own privacy policy. You choose which apps to connect.
Service providers. These companies process personal data for us under contract and only on our instructions:
Data sources. To answer a run, we send the run's input (such as a business type and location, a website address, a company name, a person's name and company, or keywords) to the data source that answers it. These sources receive search terms, not your account details:
We may also share data with authorities when the law requires it, and with our legal and accounting advisers. If we add or change a service provider that handles Loadout users' personal data, we'll update this list.
International transfers. Several of these providers are in the United States or other countries outside the EU and EEA, and the Loadout engine and its database run in the United States. Where a country doesn't have an EU adequacy decision, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, with extra measures where needed. You can ask us for a copy of the safeguards at info@entrepedia.co.
Loadout helps businesses find other businesses and the people who work in them. If you run or work at a business, our tools may return details about you to a Loadout user who searches for businesses like yours. This section is our notice to you under Article 14 GDPR.
What data. Business contact and professional details only: your name, job title, the business you work for, your business email address and whether it passed a deliverability check, business phone number, business address, links to your public professional or business profiles, and public content connected to your business role, such as reviews you wrote or replied to publicly, ads your business runs and your business's social media accounts.
Where it comes from. Publicly available sources and commercial data providers: business directories and maps listings, company websites, public professional and social media profiles, review sites, public ad libraries, public domain registration records, and providers that find and check business email addresses. We reach most of these through the data sources listed in section 4.
Why, and our legal basis. We find and return this data so our users can identify and contact businesses for business purposes, such as offering their services. Our legal basis is legitimate interests (Article 6(1)(f) GDPR): our interest in providing a business data service, and our users' interest in finding the right business contacts. We limit this to people in their business role, don't return sensitive data, don't build profiles of anyone's private life, and require users to follow the law when they contact people (see the Loadout Terms).
What we do with it. We look it up when a user's AI asks, return it to that user, keep it in that user's run history and keep a short-lived cached copy (section 3). We don't sell lists of people.
Who receives it. The Loadout user who ran the search and the AI app they use. That user decides what to do with your data and is responsible for it as a separate controller, including telling you where they got it and honouring your objection.
Your rights. You can object at any time to us processing your data, and we will stop unless the law allows us to continue. You can also ask for access, correction or deletion. Email info@entrepedia.co with the name and business email or website the request is about. We'll delete what we hold about you and, where we can, stop returning it in future results. We can't delete copies a user has already taken; if you've been contacted, you can also ask that user directly.
Under the GDPR you have the right to access your personal data, correct it, delete it, restrict its use, receive it in a portable format and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time.
To use these rights for Loadout, email info@entrepedia.co. We reply within one month. You can ask us for a copy of your runs in a portable format.
You can also complain to the Slovak data protection authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection), Hraničná 12, 820 07 Bratislava 27, Slovak Republic, statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk, or to the authority in the EU country where you live or work.
If you live in California or another US state with a privacy law, you have rights to know, delete and correct personal data and to opt out of its sale or sharing. We don't sell personal data. Contact us at info@entrepedia.co to use your rights.
Connections to Loadout are encrypted. API keys are stored only as one-way hashes. Sign-ins from AI apps use tokens that work only with Loadout and can be revoked. Screenshots and files sit in private storage. Access to production data is limited to the people who need it.
Loadout is for people aged 18 and over. We don't knowingly collect data from children.
We'll update this notice when Loadout or our providers change. For important changes we'll tell Loadout users by email or in the dashboard.