In short: Lookupist connects your browser to your own CRM. Lookups and new records go directly between your browser and Zoho CRM, HubSpot or Attio, and we don’t copy your CRM records to our servers. We keep what we need to run your account (your sign-in details, your CRM connection, usage and subscription status), plus product analytics that help us improve Lookupist. We never sell your data.
1. Who we are
Lookupist (“Lookupist”, “we”, “us”) is based in the United Kingdom. We are the controller of the personal information described in this policy.
Lookupist is built and maintained by Wintactix, our development team, which also publishes Lookupist on the Attio App Store. Our sign-in and account services run on our server at api.cloudshowplace.com, a domain owned and used by Lookupist.
This policy covers the Lookupist website and the Lookupist browser extensions for Zoho CRM, HubSpot and Attio (together, the “Service”). It doesn’t cover the CRM you connect to Lookupist, which has its own privacy policy, or the websites you visit while using the extension.
2. What we collect
When you sign in with your CRM
- Account details: your name, email address and the identifiers your CRM gives us for your user or workspace (for example your Zoho user ID and role, your HubSpot hub ID, or your Attio workspace ID), and the date you signed up.
- CRM connection: the access tokens your CRM issues when you approve Lookupist, which keep you connected. We never see or store your CRM password: you sign in on your CRM’s own page.
When you use the extension
- Usage and plan status: how many lookups and new records you’ve used, whether your trial or subscription is active, and when your account became inactive.
- Product analytics: events about which features you use and whether they worked, linked to your email address. These events can include the address (URL) of the web page where you used Lookupist, the text you highlighted or searched for, and the result of an action (for example whether a record was added). We use them to understand how Lookupist is used and to fix problems.
- Team settings: if you pin which details are highlighted for your company, we store your company’s email domain, the pinned detail types, who set them and when.
- Email login codes: if you sign in with an emailed code, we store your email address and a one-way hash of the code (never the code itself). Codes expire after 10 minutes.
When you subscribe
Payments are handled by Stripe. We never receive your card details. Stripe tells us your subscription ID, your plan and billing interval, its status and its renewal date, and may share your email address with us.
When you contact us
Through the contact form: your name, email address, company (if you give it), your CRM, the topic and your message, plus your IP address, which we use to prevent spam.
Technical information
Like any online service, our servers process your IP address and basic request details to deliver the Service and protect it against abuse.
3. Your CRM data and the pages you visit
- CRM records stay between you and your CRM. When you look something up or add a record, the extension talks directly to your CRM’s official API from your browser. The contents of your CRM records are not sent to or stored on our servers.
- Pages are read on your device. To find details such as email addresses and phone numbers, the extension reads the page you’re viewing locally in your browser. We don’t receive the content of the pages you visit, except for the page address and the text you choose to look up, as part of product analytics (see section 2).
- Your own copy. The extension keeps some data in your browser’s storage, such as your sign-in, your settings and form drafts. Removing the extension deletes this.
4. How we use information
- To provide the Service: signing you in, keeping your CRM connected and showing your CRM’s fields and records.
- To run the free trial and paid plans, including counting usage against trial limits.
- To send you login codes and to reply when you contact us.
- To understand how Lookupist is used, fix problems and improve features.
- To keep the Service secure and prevent spam, fraud and abuse.
- To meet legal, tax and accounting obligations.
We don’t sell your personal information, use it for advertising, or share it with data brokers.
5. Legal bases
Under UK and EU data protection law (the UK GDPR and the GDPR), we rely on:
- Contract: to provide the Service you signed up for, including your account, CRM connection, trial and subscription.
- Legitimate interests: to understand and improve Lookupist, keep it secure, and answer messages you send us. We balance these interests against your rights, and you can object (see section 10).
- Legal obligation: to keep records we’re required to keep, such as for tax.
6. Who we share it with
We use a small number of service providers to run Lookupist. They may only use your information to provide their service to us.
| Provider | What they do | Location |
|---|---|---|
| Hetzner Online | Hosts our servers and database | Germany (EU) |
| Stripe | Processes subscription payments | EU and US |
| PostHog | Product analytics | EU |
| Google (Google Workspace) | Sends our emails, such as login codes and replies to your messages | EU and US |
| Grist Labs | Keeps our list of new signups (name, email address, CRM, account identifier and signup date) | US |
Your CRM provider (Zoho, HubSpot or Attio) receives the requests the extension makes on your behalf, under your own agreement with them. We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a business transfer, in which case this policy will continue to apply.
7. Where it’s stored
Our servers and database are in Germany, in the European Union. Some providers, such as Stripe, Google and Grist, may process information outside the UK and EU. When they do, the transfer is protected by safeguards recognised under UK and EU law, such as adequacy decisions or standard contractual clauses.
8. How long we keep it
- Account, CRM connection and usage data: for as long as your account is active. If you ask us to delete your account, we remove this data, normally within 30 days.
- Backups: our database backups are kept for 14 days, after which deleted data is gone from them too.
- Email login codes: valid for 10 minutes and single use.
- Contact-form messages: for as long as we need to answer and follow up on them.
- Product analytics: kept within our analytics provider for as long as it is useful for improving the Service.
- Billing records: as long as tax and accounting law requires.
9. Security
All connections to our servers use HTTPS. CRM tokens are kept on our servers and our database isn’t reachable from the internet. Login codes are stored only as one-way hashes. No system is perfectly secure, but we work to protect your information and will tell you and the relevant authorities about a breach where the law requires it.
10. Your rights and choices
Depending on where you live, you can ask us to:
- give you a copy of the personal information we hold about you
- correct information that’s wrong
- delete your information
- restrict or object to how we use it, including product analytics
- give you your information in a portable format
To make a request, email support@lookupist.com. We’ll reply within one month. You can also complain to a data protection authority. In the UK this is the Information Commissioner’s Office (ico.org.uk).
Disconnecting: you can stop Lookupist’s access at any time by removing the extension from your browser and revoking Lookupist in your CRM’s connected apps settings.
11. Chrome Web Store disclosure
Lookupist’s use of information received through its Chrome extensions complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use this information only to provide and improve Lookupist’s single purpose (looking up and adding CRM records from the web pages you visit), we don’t sell it, and we don’t use it for advertising or credit decisions.
12. Children
Lookupist is a business tool and isn’t intended for anyone under 18. We don’t knowingly collect information from children.
13. Changes to this policy
We may update this policy as Lookupist changes. We’ll change the “Last updated” date above and, for significant changes, let you know by email or in the extension before they take effect.
14. Contact us
For questions about this policy or your information, email support@lookupist.com or use the contact form on our website.