Privacy
Privacy notice
Who is responsible for your information
Daniel Mclearnon, a sole trader trading as bexford intelligence, is responsible for personal information handled through this website.
Business correspondence address: Shean, Seaforth Road, Muir of Ord, IV6 7TA, United Kingdom.
Privacy enquiries: [email protected]
Your Bexford account and business brief
Signup asks for your business name, what you sell, ideal customers, selling method, service area and email address. Unfinished answers can remain in this browser tab for up to 24 hours and can be deleted on the review screen. Submitted pending answers are stored for up to 24 hours while you complete verification; submitting the form alone does not verify your identity.
Customers sign in using Google or a one-time email code sent by Bexford. Google sign-in provides a verified account identity and email address; it does not by itself give Bexford permission to read your Gmail. An existing email-code account may need to verify its mailbox when linking Google. Authentication and workspace cookies maintain your session. DEVELOPMENT is a separate test environment with restricted access.
Your organisation’s brief, prospect workspace, private notes, recorded contacts, pipeline stages, activity and follow-ups are kept separate from other customers’ private workspaces. The free-prospect ledger records which prospects have been unlocked so repeat sign-in or changes to your brief do not create a new free allowance. Research may use permitted sources and budget-limited AI processing to fulfil your request. No payment or automated prospect outreach is activated by signing up.
Information we collect
When you register interest, we collect your contact name, business name, business email, main trade, service or product, operating regions and selected service tier. You may also provide a website, project preferences, value range and additional requirements. Optional marketing consent is recorded separately.
Cloudflare may process technical information such as IP addresses and request logs to deliver and protect the website. The service stores short-lived hashed email/IP identifiers for rate limits. Authentication and workspace cookies maintain your secure session; browser session storage preserves unfinished answers. The legacy website request handler stores an hourly IP-derived identifier with accepted early-interest registrations.
Why and how we use it
We use registration details to review your request, assess whether bexford may be relevant to your business, contact you about the selected service and administer the early trial. This is separate from optional marketing communications.
Our intended lawful basis for handling a service request is taking steps at your request before entering a contract and, where appropriate, our legitimate interests in responding to business enquiries. Marketing email requires the separate choice shown on the form and may be withdrawn at any time. These bases should be confirmed against the final trading setup.
B2B market assessments and company research
A market assessment brief may include your products or services, ideal customer industries, sales territory, exclusions and requested prospect count. It is used to prepare the requested research, not to start marketing campaigns or a subscription. Your brief and customer-specific qualification records are private to your account.
Company research uses permitted public business sources. Published business information can still contain personal data. We distinguish facts from assessments, record source provenance, restrict access and support corrections, suppression and deletion requests.
Named decision-makers found during lead research
When Bexford researches a business as a possible customer for one of our users, it may record the name and job title of one person who appears to make or influence buying decisions there, such as an owner, director or manager. We take this only from published sources: the business’s own website, its Companies House record, or another published page that names the person in that role. We keep a link to that page and the date we saw it.
We do not collect personal email addresses, personal phone numbers, home addresses or personal social media profiles.
The name and job title are shown to the Bexford customer the lead was researched for, so they can ask for the right person. Bexford does not contact you and never sends anything on a customer’s behalf. A customer who contacts you is responsible for their own use of your details.
We rely on legitimate interests for this: helping small UK businesses find the right person to speak to, using information already published in a business context. Because we hold no contact details for you, we do not write to each person individually; this notice and the removal form are how we tell you. A name is removed from a lead after 12 months unless later research confirms it again.
To be removed: use the removal form or email [email protected]. We stop using your details, remove them from leads and keep only a protected code so they are not collected again.
Inactive free assessment requests should be reviewed after 90 days. Retention of customer deliverables should follow the agreed service and applicable requirements. The full approved privacy notice sets out the applicable retention details.
Storage, sharing and security
The live customer service uses its own Cloudflare Worker and D1 database, separate from our test environment. It stores verified account membership, your criteria, unlocked prospects and private notes. Approved company-level factual evidence may be reused across customers; private criteria, assessments and notes are not copied between customers. The legacy early-interest request form uses a separate website database. A failed submission is not confirmed as stored. We do not sell personal information. Data may be handled by service providers only where needed to host the site, secure the form or operate the service, or where required by law.
Your account information is accessible to your authorised organisation members and the service owner for operation/support; other customers cannot access it. Website code does not contain database credentials or unrestricted storage access.
How we protect sensitive Google user data
We use HTTPS/TLS to protect information in transit between your browser, Google and Bexford. Bexford account, connection and private CRM records are held in Cloudflare D1, which encrypts stored databases and their metadata at rest using AES-256 with Cloudflare-managed keys. Worker-to-D1 connections use TLS. Server credentials are held in encrypted Cloudflare Worker secrets, rather than delivered to the browser or included in public website code.
The Gmail endpoint verifies Google-signed deployment and user identity tokens, including their intended audience, issuer and expiry. Each request checks the linked Google identity, an enabled Bexford organisation membership and the current connection receipt before displaying private prospect information. Customer workspace queries are scoped to the authorised organisation; write permissions and record versions protect changes. Disconnecting invalidates the connection and stale sidebar actions. DEVELOPMENT and LIVE use separate application databases.
Temporary Gmail access tokens and the current email’s fetched headers are processed in server memory for that request. They are not saved to Bexford’s database or deliberately included in application logs. The add-on does not retain a Gmail refresh token. Responses containing private information use no-store caching controls. Infrastructure providers may process technical request metadata to operate and secure their services.
Access to stored private information is restricted to authorised organisation members and authorised service administration. Human access to Google user data is limited to the user’s documented agreement for specific data, security investigation, legal requirements, or the other exceptions allowed by Google’s Limited Use requirements. We do not sell Google user data, use it for advertising, share it with contact-data providers or copy private Gmail-derived information into the shared company directory.
Google data, AI, retention and deletion
The current Gmail add-on uses only the open email’s From, To and Cc metadata to match existing prospects. It does not read message bodies, attachments or mailbox history, generate thread summaries, create Gmail drafts or automatically log email activity. Google receives the CRM card information needed to display the sidebar. Cloudflare hosts Bexford’s application and stored records. Current Gmail metadata is not sent to an AI provider. Separately, Bexford’s company-research features may use OpenAI to process the customer’s saved business brief and permitted research evidence; this is not permission to process Gmail messages.
Bexford does not use, or permit providers to use, Google user data or data derived from it to create, train or improve general-purpose, foundation or frontier AI models. Any future email summarisation or reply-assistance feature will require appropriate permissions, clear disclosure and any required renewed consent before that processing begins.
Fetched Gmail headers and temporary tokens are not retained after request processing. We retain the account email, linked Google identifier, connection choice, policy version, connection/disconnection timestamps and a generation counter that rejects stale actions. Connection receipts have no automatic expiry or deletion schedule. They remain until removed through a verified deletion request. CRM notes, activity and follow-ups that you choose to save remain with your private workspace until deleted or the applicable account-retention process is completed. Disconnecting or uninstalling stops future access but does not itself erase these saved records.
To request access, correction or deletion of Bexford-held account, connection or private CRM information, contact [email protected]. We verify your authority, review any legal retention obligations and remove the applicable records through a controlled support process; deletion is not automatic on disconnect. Service-provider recovery copies may remain for their recovery period before expiry. You can separately revoke Google permission through Google account connections.
Bexford’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.
Optional Gmail add-on
The optional Gmail add-on has separate Google permissions and a Connect Bexford choice. Read the Gmail privacy information for how it accesses, uses, stores and shares data, and how to disconnect. Customer installation is not available yet.
Retention and deletion
Unsuccessful or inactive early-interest registrations should be reviewed and deleted within 12 months. Details needed for an active customer relationship or legal record may be retained for longer under the applicable business retention policy. You may ask for deletion sooner using the privacy contact above, subject to any legal requirement to retain information.
Your rights
UK data-protection law may give you rights including access, correction, deletion, restriction and objection. You may also complain to the Information Commissioner's Office at ico.org.uk.
Cookies and marketing
This site does not intentionally use analytics or advertising cookies. Choosing to receive the requested service or be contacted about it is not treated as consent to unrelated marketing.
Last updated: 12 November 2026