Privacy Policy
Last updated 7 September 2026
The data controller is 8GROUP CORPORATIONS LTD, company registration number 17232906, trading as 8MKT, operating from Spain. Contact us about anything on this page at hi@8mkt.agency.
This policy explains what we collect, why, who else touches it and what you can demand from us.
1.What we collect
- Public LinkedIn profile data. When you submit a profile URL for a score, we retrieve information that is already publicly visible on that profile: name, headline, About text, experience entries, listed skills, profile photo, banner image and the date of the most recent public post. We do not access anything private and we never ask for your LinkedIn password.
- Your email address, which we ask for before running a free score, and again if you buy something.
- A verification code, stored only as a one-way hash, valid for 15 minutes.
- A work email address for a scanned profile, in one case only. Scores run before 6 September 2026 did not require an email, and for those we may have looked up a work address for the profile with a third-party service so that we could follow up on the score. Every score now starts with an email, so we no longer do this.
- Scan records: the profile handle scanned, a timestamp, and a salted one-way hash of your IP address. We store the hash rather than the address itself, to enforce limits and spot abuse without keeping the raw IP.
- Order and onboarding information, if you buy: what you tell us about your role, business, audience and goals.
- Payment information is handled entirely by Stripe. We receive confirmation that you paid and never see your full card number.
2.Why we use it, and our legal basis
| What | Why | Legal basis |
|---|---|---|
| Public profile data | To produce the score you asked for | Steps taken at your request before a contract, and our legitimate interest in running the tool |
| Email and verification code | To confirm the address is real, run the score you asked for, and send you your results | Steps taken at your request |
| Scan records and hashed IP | To enforce usage limits and prevent abuse | Our legitimate interest in protecting the service |
| Order and onboarding data | To write and deliver your rebuild | Performance of our contract with you |
| Marketing emails | To send you LinkedIn tips and offers | Your agreement, given with the box you tick before a free score or when you buy. You can withdraw it at any time |
| Work email found for a profile scored before 6 September 2026 | To follow up on that score | Our legitimate interest in following up an enquiry made through the site. Every such email carries an unsubscribe link, and we stop the moment you use it |
| Hashed email and ad click reference | To tell LinkedIn, Meta or X that their ad led to a verified scan or an order, so we know which ads are worth paying for | Our legitimate interest in measuring our own advertising. Section 6 explains exactly what is sent |
| Advertising cookies | To show our ads again to people who have visited | Your consent, asked for by the banner and off until you give it |
You can unsubscribe from marketing at any time using the link in any email, or by writing to us. Withdrawing consent does not affect anything we sent before you withdrew it, and it does not stop the emails we must send to deliver something you bought.
3.Scanning a profile that is not yours
The tool works on publicly visible profile information. If you submit someone else's profile, you are the one deciding to do that, and you are responsible for doing it lawfully. If you are the owner of a profile that has been scored and you want the record removed, write to hi@8mkt.agency and we will delete it.
4.Who else processes your data
We use these providers to run the service. Each one only receives what it needs, and each is bound to process it on our instructions.
| Provider | What it does | Where |
|---|---|---|
| Vercel | Hosts the website and its functions | United States |
| Supabase | Database storing emails, code hashes and scan records | European Union |
| Apify | Retrieves the public profile information | European Union |
| Anthropic | Scores the profile content | United States |
| SendPulse | Sends verification and marketing email | European Union and United States |
| Stripe | Processes payments | United States and Ireland |
| Tally | Hosts the onboarding form | European Union |
| Google Fonts | Serves the site typeface | United States |
| LinkedIn, Meta, X | Told when one of their ads led to a verified scan or an order, so we can measure our own advertising. Receives a hashed email and the ad click reference, never your address in the clear. See section 6. Separately, if you accept advertising cookies, LinkedIn's Insight Tag runs in your browser so we can show our ads again to people who have visited. It is not loaded at all unless you accept, and it never reports a scan or a purchase. | United States and Ireland |
We do not sell your data, and we do not hand it to anyone to advertise their own products to you. The only advertising use is measuring whether our own ads work, described in section 6.
5.Transfers outside the EEA
Some of the providers above are outside the European Economic Area. Where that is the case, the transfer is covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism offered by that provider.
6.Cookies and advertising
This site runs no analytics. We do not measure how you move around it, and there is no Google Analytics or equivalent anywhere on it.
Advertising cookies are off until you turn them on. If we are running ads, you will see a short banner asking whether we may set them. Until you accept, no advertising script is fetched at all. Decline, or simply ignore it, and nothing loads. You can change your mind at any time by clearing this site's data in your browser.
What we store in your browser without asking is limited to what the site cannot work without: a sign-in token in localStorage, so you do not have to re-verify your email every visit; your answer to the banner above, so we do not ask again; and, for the length of that one tab only, the campaign reference from the link you arrived on. All of it stays on your device, we cannot read any of it remotely, and clearing your browser data removes it.
Measuring our own ads
If you arrive from an ad on LinkedIn, Meta or X, that platform adds a click reference to the link. When you then complete something that matters to us, finishing a score, or buying a rebuild, our server tells that platform the click led somewhere, so we know which ads are worth paying for.
Two things are worth being precise about. First, this happens on our server, not in your browser, so it is not affected by the banner above and it is not something an ad blocker changes. Second, we never send your email address itself. It is put through a one-way SHA-256 hash first, which the platform can only compare against a hash it already holds. We send that hash, the click reference, and the value of the order. We do not send your name, your LinkedIn profile, your score, or anything you wrote on the onboarding form.
The lawful basis for this is our legitimate interest in knowing whether our own advertising works. If you would rather we did not, email hi@8mkt.agency and we will exclude you.
Note that the site loads its typeface from Google Fonts, which means your browser contacts a Google server and Google receives your IP address as part of that request. If you would rather that did not happen, blocking fonts.googleapis.com and fonts.gstatic.com will not break the site, it will simply render in a fallback typeface.
7.How long we keep it
- Verification codes: 15 minutes, then they expire. Only the hash is ever stored.
- Scan records: up to 12 months, so the per-profile limit can be enforced.
- Email addresses: until you unsubscribe or ask us to erase them.
- Order and onboarding data: for as long as we need it to deliver and support your order, then as long as tax and accounting law requires us to keep the record of the sale.
8.Your rights
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you
- correct it if it is wrong
- delete it
- restrict or object to how we use it, including profiling and direct marketing
- send it to you or another provider in a portable format
- withdraw a consent you previously gave
Write to hi@8mkt.agency and we will respond within one month. You do not have to pay to exercise these rights.
If you are unhappy with how we handled it you can complain to your local data protection authority. In Spain that is the Agencia Española de Protección de Datos, aepd.es.
9.Security
Traffic to the site is encrypted in transit. Verification codes are stored only as SHA-256 hashes, IP addresses only as salted hashes, and the database is reachable only by our server-side functions, never by your browser. No system is perfect, and we do not claim otherwise.
10.Children
The service is for people in working life and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.
11.Changes
If we change this policy we will update the date at the top. If the change is significant and we hold your email address, we will tell you.
12.Contact
8GROUP CORPORATIONS LTD, company registration number 17232906, trading as 8MKT.
Email: hi@8mkt.agency