> SpecStream is the live web data engine for teams and agents. This is the Markdown copy of https://specstream.ai/privacy. Every page, with what SpecStream does and costs: https://specstream.ai/llms.txt # Privacy policy How SpecStream handles your account, saved requests, research, and shared work, and the information about people and businesses it finds on the web. Saving a request, running it, and sharing its results are separate actions. Updated November 3, 2026. ## Who is responsible SpecStream SAS, 20 quai de Lorraine, 11100 Narbonne, France, is the controller for your account, our website, billing, support, and the opt-out list. When a customer looks for businesses or people, or imports personal data, that customer decides what is looked for and how the results are used, and SpecStream reads public pages and processes the results and the imported data on the customer’s behalf, as their processor under the data processing agreement. The legal notice names SpecStream’s officers and its registration number. For privacy questions and requests, write to support@specstream.ai or use the request form on the opt-out page. You do not need a SpecStream account to contact us. ## Your account Your account includes your email address, profile details, sign-in identity, sessions, and access permissions. These let us recognize your account and apply the permissions you give to people, agents, and connected tools. If you sign in with Google or Microsoft, we receive your name, email address, and an account identifier from that provider. Payment references, plan status, invoices, and balance records support billing. Our payment provider handles card details; SpecStream never receives your full card number. Support messages contain the information you send us to resolve a request. Do not include passwords, sign-in codes, or card details in a support message. ## What a saved request contains A saved request records what you want to find: the requirements, requested fields, name, context you add, and revisions. Reopening it brings back those instructions. Saving or sharing a request does not run research or include the results of a run. A shared request link contains the reviewed revision and only the context you choose to include. It does not give the recipient private results, account access, or authority to spend. You can expire or revoke the link. ## Information found on the web When a customer authorizes research, SpecStream reads public sources within the approved scope and checks what it finds against the request. Results can describe businesses (names, addresses, websites, opening hours, ratings, size, funding, hiring, technology, and registry facts) and people in their professional capacity. Each fact keeps its source URL and when it was read. Public availability does not remove privacy rights or give permission to send marketing. On the opt-out page you can ask us to stop using a website, email address, phone number, a profile of you, or your name with your employer, or send a request about yourself by name. Suppression applies whenever SpecStream presents results, including previously completed work. It does not change the source website or recall exports already received elsewhere. ## If you appear in results When a customer asks for people, such as founders of a kind of company or authors in a field, SpecStream reads public sources for that customer and returns information about the people who match. That can include a name, job title, employer and its website, past employers, education, city or region, links to professional profiles and personal websites, published works, follower counts, a short public description, and work email addresses and phone numbers published online. It comes from publicly accessible pages and records: company websites, professional and personal websites and profiles, public registries such as company and financial-services registers, business listings and maps, publications, and open datasets. The customer who runs the search is responsible for it: they decide what to look for, need their own lawful basis, and must tell you where they got your details when the law requires it. SpecStream processes the information only to carry out that customer’s request. We read information published in a professional context, keep the source of every fact, do not seek out sensitive information, and prohibit using results for credit, employment, insurance, or housing decisions. The legal basis for finding and using a person's business contact details belongs to the customer who asked, as the controller. SpecStream carries out the customer's request as its processor, under the data processing agreement, and only for that customer. This is the same when the customer reaches the results through an AI app such as ChatGPT, Claude, or Codex: the app's provider receives them because the customer chose to use it. Public availability is not a legal basis in itself. You can object, and have yourself excluded from every customer's results, on the opt-out page. It goes only to the customer whose request matched you, and to the tools that customer sends results to. We do not sell it, use it for advertising, or give it to advertisers. We do not keep a database of people. Copies of pages read for a request are kept for that customer only, for at most 24 hours. Working copies from a run are deleted within 7 days. Results saved in a customer’s workspace stay there until the customer deletes them or closes their account. Nothing found for one customer is reused for another. You can have yourself excluded from every customer’s results at any time on the opt-out page. We keep a one-way hash of the details you give us so the exclusion keeps working, and it applies to results customers have already saved. For other requests about results a customer holds, contact that customer. If you write to us, we pass your request to them and help them answer. ## Why we process information We rely on performance of a contract, or steps you request before entering one, to provide accounts, execute authorized work, manage payments, and respond to service requests. We rely on legal obligations for required accounting, tax, and lawful disclosure duties. Where appropriate, legitimate interests support service security, fraud prevention, troubleshooting, support, and relevant processing of publicly available information. Those interests must be assessed against people’s rights and expectations; public availability alone is not a lawful basis. You can object to processing based on legitimate interests. We rely on consent where it is required: optional marketing, and analytics on our website and in the workspace, which only run after you accept them. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Required account information is needed to provide the corresponding service; optional profile photos and marketing choices are not. ## Sharing and connected services Project membership and result-sharing permissions determine who can read your workspace content. Request-sharing links expose the reviewed instructions, not the corresponding results. Review the role, selected information, contact visibility, and expiry before sharing. Connecting a destination and sending records to it are separate actions. A connected service receives the fields you send to it. Its own terms apply to the copy it receives. When you connect an AI app such as ChatGPT, Claude, or Codex to SpecStream, the app sends us the requests you make in it, and our tools send back the data in these five groups. Our tools do not return the engine's internal decision records, evidence hashes, or billing ledger records. - What you give us: the text of your requests and how we read it, saved requests with their revisions, names, and context, the names of your lists, projects, and web sources, note text, the rows and cells of lists, CSV files, and web sources you import (including rows we rejected), the fields you define, the inputs you give for matching records, and your display settings for a list. - Results: the values we found, each with its source URL and when it was read, the check behind each condition (what it looked for, what it observed, and whether it passed), quotes and evidence from the pages, possible matches with their open conditions, and the matches from input research and reconciliation. Values can include business contact data of people found on public web pages: names, job titles, work email addresses, phone numbers, and profile links. Our section "If you appear in results" describes this data and how to have yourself excluded. - Workspace identifiers: the ids of your lists, projects, requests, revisions, imports, sources, quotes, shares, and notes, and your account id on the notes you write, so the Lists app can show which notes are yours and let you edit or delete them. When you ask for one, a public share link or a single-use download link. - Usage and billing: your balance (available, reserved, and on hold, with the reason for a hold), your monthly spending limit and what you have spent or reserved in the period, the maximum price, price terms, and expiry of each quote, the amounts authorized, charged, and refunded for each run, the number of rows delivered and any shortfall, and the state, queue position, and timestamps of each run. - Note authors: the display name of the person who wrote a note. The app's provider handles that content in your conversation under its own terms and privacy policy, and keeps it as long as your settings there say. It receives the results, business contact data included, because you chose to use the app, in the same way a connected destination receives the fields you send to it. You can disconnect an app, and revoke its access, under Agents & API in the workspace. Nothing runs or is charged until you approve a price. If you connect with an API key instead of signing in with an app, the tools return the same data and may also return the technical records that the API returns, such as the engine's decision records and billing ledger records. When you use SpecStream inside another product, such as the Excel add-in, the Microsoft Teams app, the Microsoft 365 Copilot agent, the Power Automate connector, the Google Sheets add-on or the Slack app, that product sends us the requests you make there with the key or sign-in you connected, and we send back how a request was read, a price, your saved results and result rows. The Excel add-in keeps your API key in memory only while its pane is open and writes rows to a separate sheet it creates in the open workbook; it does not read your other cells. The host product's provider, such as Microsoft, Google or Slack, handles that content under its own terms. You can revoke a key or disconnect an app under Agents & API in the workspace. Nothing runs or is charged until you approve a price. Google user data that reaches us through the Google Sheets add-on is protected the same way as the rest of the service: it is encrypted in transit with TLS, the credentials and tokens we store are encrypted at rest, and access is limited to the staff and systems that run the service. Google user data is never sold or used for advertising. SpecStream's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. These kinds of service providers process personal data for us, under contracts that limit them to our instructions: - Hosting and databases, in the European Union - Content delivery and network security for our website and API - Payments, invoicing, and sales tax - Email delivery and our support inbox - Sign-in with Google or Microsoft, when you choose it - AI services that transcribe dictation and read requests and pages for us, with storage turned off; they may not use that content to train their models - Network providers that route our requests to public websites - Analytics tools on the website and in the workspace, only after you accept them; each is named on the Browser storage page - The App Store and Google Play, for plans bought in the mobile app We also disclose personal data when the law requires it, to protect people or the service against fraud or abuse, and to a company that takes over SpecStream, which must then honor this policy. A list of our service providers by name and location is available on request. ## Transfers outside Europe SpecStream’s servers and databases are in the European Union. Some service providers, such as our payment, email, network-security, AI, and analytics providers, are based in or access data from the United States or other countries. Where a country has no EU adequacy decision, we rely on the EU–US Data Privacy Framework for certified recipients, or on the European Commission’s Standard Contractual Clauses, with additional measures where needed. Customers outside Europe receive results under the Standard Contractual Clauses incorporated in the data processing agreement. You can ask us for a copy of the safeguards that apply. ## How long we keep information Completed results, imported lists, and project notes are separate from the saved request that describes what to find. They remain subject to your account and project permissions. Canceling a monthly plan does not delete work already available in your workspace. | Information | How long we keep it | | --- | --- | | Your account, saved requests, lists, results, and notes | Until you delete them or your account | | Private workspace content after you delete your account | Erased at once; backups clear within 8 days | | Database backups | Up to 8 days | | Server logs, which include IP addresses; search text, email addresses and phone numbers are removed | Up to 30 days | | Shared links | Until they expire or you revoke them | | Copies of public pages read for a request | Up to 24 hours, kept for that customer only | | Working copies from a run | Up to 7 days | | Account audit log | 12 months | | Invoices, payments, and accounting records | 10 years, as French commercial law requires | | Support conversations | 3 years after the last message | | Opt-out requests | Kept as hashed identifiers for as long as the opt-out applies | | Free-balance eligibility | A keyed identifier, for as long as free balance is offered | | Analytics on the website and in the workspace, if you accept them | Cookies up to 13 months; the measurements no longer than 25 months | | Your cookie choice | 6 months, then we ask again | Account deletion revokes sessions, credentials, shared access, and recurring authority, and removes private workspace content: saved request revisions, imported lists, notes, result content, and related source material. Do not use account deletion as a reversible way to pause access. Payment records, the free-balance identifier, and hashed opt-outs are kept separately for the reasons above; they do not preserve the deleted workspace content. ## Cookies and browser storage The website stores display choices such as theme, wallpaper, reading width, and sidebar state in your browser. A contact draft is kept in session storage if a send needs to be retried. Signing in sets a session cookie and, for a few minutes, cookies that complete the sign-in. These support the interface or an action you requested, so they need no consent. Analytics tools, which count visits and show how pages and features are used, run on the website and in the workspace only after you accept them. They set their own cookies, kept no longer than 13 months, and receive your IP address and information about your device and the pages you use. A Global Privacy Control signal counts as a no. You can change your answer at any time with “Cookie choices” at the bottom of every page; declining is as easy as accepting. The Browser storage page lists each tool and cookie, and lets you reset your display preferences without signing out. ## The browser extension The SpecStream browser extension reads the current page’s title and any text you have selected, and only when you open it from its toolbar button, the right-click menu, or its keyboard shortcut. It does not read other tabs, follow your browsing, or send us the page’s address. That text fills the request box. The extension sends a request to SpecStream only when you press Find, or press Enter on a request you typed in its toolbar window or the address bar. We read and price it, and nothing runs until you approve the price. From there it is a saved request like any other, as described above. Your SpecStream key stays in the extension’s storage on your device and goes only to specstream.ai, to sign your requests. While an approved list is running, the extension checks its progress and shows one notification when it is ready. Removing the extension deletes what it stored. We use what the extension sends only to provide the service you asked for. It is never sold, used for advertising, or used to judge creditworthiness, and our use of it follows the Chrome Web Store User Data Policy, including its Limited Use requirements. ## Email with a reason Account access messages respond to a sign-in request. Invitations follow an explicit invitation. Security and important billing messages concern actual account or payment events, not a promotional campaign. A first-account welcome is a single message, not a drip sequence. Notification settings control optional mentions and scheduled-work alerts. Ordinary completed runs do not need an email. Product updates require a separate opt-in and a way to unsubscribe. We do not use tracking pixels or link rewriting to measure individual opens or clicks in these product email templates. ## If we write to you about SpecStream SpecStream SAS writes to people at companies whose work may need our data. We use your name, role, company and work email, found on public pages such as your company’s site, public procurement notices, filings and publications. We rely on our legitimate interest in offering a service related to your job. You can object at any time: reply no to the note, or write to support@specstream.ai. We stop at once and keep only your address on a do-not-contact list, so that we never write again. We keep prospect details for up to 12 months after our last note, unless you become a customer. You can also ask what we hold about you and where we found it, and you can complain to the CNIL (cnil.fr). ## Your choices and rights Depending on the circumstances and applicable law, you can request access, correction, erasure, restriction, or a portable copy of personal data, object to processing based on legitimate interests, and withdraw consent. In France, you may also give instructions about personal data after death. Some rights have exceptions, such as records we must keep by law. Use the request form on the opt-out page, or email support@specstream.ai, with enough information to locate the data and explain your request. We may ask for proportionate verification to protect someone else’s information, but do not send identity documents unless we explain why they are needed and how to provide them safely. We respond within one month; if a lawful extension is necessary, we will explain it. You can complain to the French data protection authority, the CNIL, at cnil.fr, or to your competent local supervisory authority. You can contact us first, but you do not have to. ## If you live in the United States The privacy laws of California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states give residents rights over their personal information. In the last 12 months SpecStream collected these categories: - Identifiers, such as name, email address, phone number, IP address, and online identifiers - Professional or employment-related information, such as job title, employer, work history, and education history - Commercial information, such as plans and balance purchased - Internet activity, such as requests to our servers and, with your consent, analytics on our website and in the workspace - General location, such as city or region; never precise geolocation We collect it from you, from your use of SpecStream, and, for people in results, from the public sources described above, for the purposes in this policy. We do not use sensitive personal information to infer characteristics about anyone. SpecStream does not sell or share personal information. When a customer looks for people, SpecStream processes the information for that customer as their service provider. You can still have yourself excluded from every customer’s results on the opt-out page, through “Your privacy choices” at the bottom of every page, or by sending a Global Privacy Control signal, which we honor as an opt-out. We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects. You have the right to know what we collect, use, and disclose, and to get a copy; to have it deleted; to have it corrected; and not to be treated differently for using these rights. Send requests through the opt-out page or to support@specstream.ai. We verify requests in proportion to the information involved. An authorized agent can make a request for you; we may ask for your signed permission and ask you to confirm your identity. If we decline a request, you can appeal by replying to our decision, and if the appeal is declined, you can contact your state attorney general. ## Children Accounts are for people aged 18 or over, and SpecStream is not directed at children. We do not knowingly collect personal data from children. If you believe a child’s information is in SpecStream, contact support@specstream.ai and we will delete it. ## Access, logs, and automated processing Access checks apply when work is reopened, exported, shared, or delivered through a notification. Revoking credentials or membership removes the corresponding authority. Operational logging excludes request bodies, contact values, credentials, and sign-in tokens rather than using them as debugging text. Each account keeps an audit log of sign-ins, access changes, spending and exports for 12 months, which its owners can export. When you use the website, the workspace, or the API, our servers process your IP address and basic details of each request to deliver the service, apply rate limits, and prevent abuse. AI helps read requests and pages, and each result keeps the sources it came from. Code checks quotes, identity, permissions, and spending limits. A research result is not an automated decision about a person’s legal rights or eligibility. You remain responsible for how you use it. If a personal data breach is likely to put your rights at risk, we notify the CNIL and, when the law requires it, you. ## Changes to this policy We may update this policy as the service or legal requirements change. We publish the revision date and provide notice of material changes through the service or by email where appropriate. A policy update does not replace consent where fresh consent is required. Questions about your account or your data? [Email support@specstream.ai](mailto:support@specstream.ai). [Manage browser storage](https://specstream.ai/cookies.md) or [request removal from results](https://specstream.ai/opt-out.md). You can also contact the [CNIL](https://www.cnil.fr/en).