Privacy Policy

Last updated: 17 July 2026

FormProspect ("we", "us") helps businesses reach other businesses through public website enquiry forms, with every message reviewed and submitted by a human. This policy explains what we collect and how we use it.

What we collect

• Account data: your email address and name, via email sign-up or Google sign-in (handled by Supabase Auth). We never see or store your password in our own database, and we never see your Google credentials.
• Prospect data you upload: company lists (names, domains, and any columns in your spreadsheet). This data is private to your workspace.
• Submission profiles: the contact details you want filled into forms — your name, business email, phone, company, website and what you offer. If you give us your website, we fetch its public pages and use Gemini to draft these details for you to correct. This is the data the extension fills on your behalf.
• Outreach records: the pitches generated for you, which forms you filled, and what you submitted after review — stored privately in your workspace so you can track responses.
• Form structure fingerprints: when you submit a form, we store the form's structure (field types, names, labels) for the page — never the values you entered. This improves autofill accuracy for all users. It contains no personal data by design.

What the Chrome extension does

The extension runs on any page so that you can contact a company by browsing to its contact page yourself, not only from a list you uploaded. Which pages those are is your choice, so we cannot know the domains in advance. Here is exactly what happens on a page:

• Detection is local and silent. It reads the form's field structure (types, names, labels) in your browser to decide whether to offer help. Nothing is sent to us for this, on any page. If there is no enquiry form, or you are not signed in, it does nothing at all.
• "Fill my details" never leaves your browser. The free fill writes your own saved profile details into the form's fields locally. It makes no network request and costs no credit.
• "Write a pitch" sends that page to us — only when you click it. To ground the pitch in facts about the company and to honour no-solicitation notices, we send the page's address and its visible text to our server, which passes it to the Gemini API to draft your message. This happens on that click and at no other time.
• It never submits a form; you do. When you submit a form yourself, we record what you sent — the field structure plus your entered values — to your workspace so you can track replies. Consent and legal checkboxes are dropped before this record is made, and the extension never ticks them in the first place.
• No browsing history. We never receive a list of pages you visited. A page's address reaches us only as part of a pitch you asked for or a submission you made.

Processors we rely on

• Vercel (hosting), Supabase (database & authentication), Google (sign-in, and Gemini API for generating pitch text), Railway (background processing).

What we don't do

• We don't sell your data.
• We don't share your prospect lists or outreach content with other users.
• We don't send messages on your behalf — submission is always a manual, human action.

Retention & deletion

Your data is kept while your account is active. Email us to delete your account and all workspace data.

Contact

growtlab@gmail.com