Trovascout
Start free trialFree trial

Legal

Privacy Policy

This policy explains what personal data Trovascout holds, where it comes from, what it is used for and how to ask for it to be removed. Trovascout is built and operated by CVPK Digital Studio LLC, a New York limited liability company ("CVPK," "we," "us").

This policy covers two different kinds of personal data, and they are not the same thing. We say which is which throughout, because our role toward each one is different: toward the first we are the company you signed up with, and toward the second we are a tool a customer of ours is using to find and reach people who have no relationship with us at all.

1. Data you give us

Customer supplied data is what you or your organization types into your own account: your name, work email address, organization name, the brand brief and niches you set up, and anything else you enter while configuring or using Trovascout. We hold this to create your account, run the Service for you, bill your subscription and respond when you contact us. It is deleted when your account is deleted, subject to what we must keep for tax, accounting or legal reasons.

2. Data we find about creators

Publicly sourced creator data is names, handles, profile photographs, follower counts, bios and public contact links that Trovascout collects from creators' own public profiles, through third-party vendors, plus anything your own import or enrichment adds. The creator never signed up for Trovascout, never agreed to anything with us, and in most cases does not know a search like this ran. We use this data to build the board Trovascout shows you: matching a creator against your brief, scoring the match and surfacing a public contact point where one exists. We do not sell this data, and we do not let one customer's search results improve or appear inside another customer's account.

Where the contact information came from is recorded on the creator's own record inside your account rather than hidden behind the score, so you can see whether an address was found by a search or brought in through your own import.

3. How long creator data is kept

A creator's record stays on your board for as long as your account keeps it there. Removing a creator from a board archives that record rather than erasing it immediately, so the same person is not silently re-added the next time a search happens to find them again; a do-not-contact request, described below, is a separate and stronger signal that outlives an archive, a re-import or a later search.

4. If you are a creator and want to be left alone

Trovascout's first outreach message ends with a line telling you to say so if you do not want to hear from that sender again. If you ask, your email address or platform handle is added to a do-not-contact list, matched on that exact address or handle rather than on any one profile record. Once it is added, no future message is drafted to that address or handle again, from that sender or from any other Trovascout customer, even if a later search or import surfaces the same identity. To ask for this directly, or to ask what we hold about you and have it reviewed for removal, contact us at hello@dkstudio.ai.

5. How your outreach messages are sent

You write or approve the message, and you review and confirm each batch before anything goes out. Once you confirm, our own worker sends it for you, from the mailbox you connected under your own account. There are two ways to connect one.

A Google mailbox connects through Google's own sign-in, using OAuth. We ask that account for two things only: permission to send mail (Gmail's "gmail.send" scope), and the account's email address (Google's basic "openid" and "email" scopes), so we know which mailbox you connected. We never ask Google for, and cannot use, a permission that would let us read your mail. The access token we hold for your connected mailbox is encrypted at rest.

A mailbox at most other email hosts connects with its outgoing mail server and its password, or an app password where your email host offers one. On most email hosts that password is the mailbox's own password, and it could also be used to read the mailbox. We use it only to send: your outreach messages, and one message to the mailbox itself carrying a code you type back to finish connecting. We never use it to read, delete or forward mail. It is encrypted at rest and never shown again once typed, and disconnecting the mailbox deletes it. Changing that password with your email host, or deleting the app password if you made one, also stops it working.

A reply from a creator is addressed to our own reply domain, not to your mailbox, so we can match it to the right creator and the right message before you see it. We do not read your mailbox to find a reply: it comes to us directly, at an address minted for that one message.

Trovascout's use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

6. Who we share data with

We use outside vendors to run Trovascout. Each one sees only the data it needs to do its job, and none of them may use it for their own purposes. As checked against this repository on 2026-09-22:

Where you connect your own vendor account under our bring-your-own-key model, that vendor processes data under your own agreement with it, not ours. The same is true of the company that hosts a mailbox you connect to send from: it carries your messages under your agreement with it.

We do not sell personal data. We disclose it only to the vendors above, to comply with the law, or with your consent.

7. What we do not claim

We do not hold a third-party security or privacy certification of any kind, and this page does not claim one. What we can show instead, verifiable inside the product itself, is this: a customer sets its own excluded territories in its account configuration and the product enforces them; every creator's contact information carries a record of where it came from; and when you connect a Google mailbox, the consent screen you approve asks for two things only, permission to send mail and the account's email address, and never asks to read your mail. When you connect a mailbox with its password, the form tells you what that password can do and what we use it for before you type it.

8. Security

Customer supplied data and creator data are both stored with our database provider, access controlled by account and by organization, and transmitted over encrypted connections. No system is perfectly secure, and we will tell affected customers if we learn of an incident involving their data.

9. International transfers

Our vendors operate infrastructure in the United States. If you or a creator whose data we hold is located outside the United States, your data may be transferred to and processed in the United States.

10. Children

Trovascout is not directed at children, and we do not knowingly collect personal data from a child.

11. Changes to this policy

We may update this policy as the product changes. A change to the words of this page moves the version date at the top and the bottom of it; a change to how the page looks does not.

12. The free search

If you use the free search on our marketing site, we store the email address, market and country you submit, as a record of who asked about which market. We keep that for 12 months and then delete it.

We also log the IP address each search comes from, so that one connection cannot run more than a few searches an hour. For an IPv4 address we keep the address itself. For IPv6 we keep only the network block it belongs to. That log is deleted within two days.

Neither of these creates an account, and the free search shows counts only, never a creator's details.

13. Contact

CVPK Digital Studio LLC. Mailing address: 3164 21st St #1098, Astoria, NY 11106, United States. Questions about this policy, or a request about your data or a creator's: hello@dkstudio.ai.

Version 2026-10-08