Privacy notice.

1. Who we are

BuyerState Ltd is the controller of personal information used for its own business purposes. When we process information solely on a client’s documented instructions, that client may be the controller and its privacy notice will also apply.

2. Information we collect

Information you give us

• Your name, work email, company and contact details.
• Enquiry messages, sample-report briefs, targeting criteria, commercial priorities and files you choose to upload.
• Client, contract, billing and service communications.
• Where you sign a BuyerState Proposal: your confirmed name, business role, authority and agreement confirmations, and the business email used to verify the signing session.

Business research information

• Professional identity, employer, role, work contact details and public professional profiles.
• Company facts, public business events, published statements and the sources supporting them.
• Research quality, suppression and compliance status needed to prevent inappropriate contact.

We do not intentionally collect special-category information for prospect intelligence.

Technical and electronic-acceptance information

• IP address, browser, device, requested pages, timestamps, referral information and security logs generated when the website is delivered.
• For statistical website analytics: cookieless page visits, referrers and selected conversion interactions used to understand and improve buyerstate.app. PostHog's cookieless server hash changes daily rather than using a persistent browser analytics identity. BuyerState does not send Sample Report form inputs, names, email addresses or free-text answers to PostHog, does not identify website visitors by name or email, and keeps session replay disabled.
• For Proposal signing: one-time-code verification outcome and timestamp, signing-session identifier, source IP address, browser/user-agent information, the accepted Proposal and terms versions, acceptance timestamp, and cryptographic integrity information used to evidence the exact document accepted.
• We do not retain the usable plaintext one-time verification code as part of the signature evidence.
• Privacy preferences and an optional sample-form draft stored on your own device. See our cookie notice.

3. How and why we use information

4. Where information comes from

We obtain information directly from you, from our clients, and from lawful public or licensed sources. These may include company websites, Companies House, public professional profiles, reputable news and trade publications, public registers, search services, and specialist business-data providers.

5. Who we share information with

We share information only where necessary with service providers supporting website hosting and forms, website analytics, email delivery and Proposal verification, secure cloud storage and databases, document generation, and AI-assisted processing. Current infrastructure includes Netlify, Supabase and PostHog. We may also share information with professional advisers, regulators, courts, law-enforcement bodies, or a buyer of our business where lawfully required.

Service providers must process information under appropriate contractual and security controls. We do not sell personal information or provide it to data brokers for their independent marketing.

6. International transfers

Some service providers may process information outside the United Kingdom. Where this happens, we use an applicable UK adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum, together with appropriate security measures.

7. How long we keep information

• Enquiries and sample requests: normally up to 24 months after the last meaningful contact.
• Website analytics: retained subject to PostHog's configured event retention for the statistical website-improvement purpose. The cookieless visitor hash changes daily, BuyerState does not create named PostHog visitor profiles, and session replay is disabled.
• Client and financial records: normally up to seven years after the relationship ends where required for tax, accounting or legal purposes.
• Signed Proposals and electronic-acceptance evidence: normally up to seven years after the client relationship ends, as part of the contractual record and where reasonably needed to establish, exercise or defend legal claims.
• Prospect-research records: while needed for the client purpose, quality assurance, suppression and legal compliance, then deleted or anonymised.
• Optional form drafts: up to 30 days on the user’s device.

We may keep information longer where required by law, a dispute, fraud prevention, or a valid suppression request. We review retention against purpose, sensitivity and legal requirements.

8. Your rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to our use of your information, and to receive portable information. You can turn statistical website analytics off at any time through the site's privacy choices. Where another processing activity relies on consent, you may withdraw that consent at any time.

To exercise a right, email jay@buyerstate.app. We may need to verify your identity.

9. Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

10. Security, children and changes

We use proportionate technical and organisational measures to protect information. Proposal signing secrets and one-time codes are not exposed through buyer-facing pages, and signed Proposal evidence is protected from ordinary application editing. No internet service can guarantee absolute security.

BuyerState is a business service and is not directed at children.

We may update this notice when our service, suppliers or legal duties change. The current version and date will remain on this page.