Security, privacy and compliance
MarketSizer is operated by Tamcalc Limited, an Irish private company limited by shares (CRO No. 738699, D-U-N-S 986144356). We are incorporated in Ireland and our services are governed by Irish law. We process personal data in accordance with the EU GDPR, the Irish Data Protection Act 2018 and, where applicable, the UK GDPR.
Regulatory frameworks
Where we stand today. We describe ourselves as compliant, never certified for frameworks we do not yet hold.
EU GDPR / UK GDPR Designed to comply
Our policies and controls are designed to comply with EU Regulation 2016/679, the UK GDPR, and the Irish Data Protection Act 2018. Backed by a signable DPA, records of processing, and documented technical and organisational measures.
SOC 2 Type II Working towards
We are preparing for a SOC 2 Type II examination. The report will be made available under NDA on completion.
Documents
Available to download directly - no request needed. Our full Records of Processing, detailed security measures, and Legitimate Interests Assessment are available to customers on request, and a future SOC 2 report will be shared under NDA.
Subprocessors
The vendors that help us run the service - each name links to that vendor's own trust page. Each is bound by a written contract with data-protection terms; transfers outside the EEA/UK rely on SCCs / UK IDTA, and the EU-US Data Privacy Framework where certified.
| Subprocessor | Purpose | Region |
|---|---|---|
| Vercel | Application and website hosting, edge delivery | US (EU edge) |
| Supabase | Application database and authentication | EU |
| Clerk | User authentication and identity | US |
| Stripe | Billing and payment processing | EU / US |
| Microsoft Azure | Cloud infrastructure for data services | EU / US |
| Google Cloud / BigQuery | Data warehouse and processing | EU / US |
| FullEnrich | Business-contact enrichment | EU / US |
| People Data Labs | Business-contact enrichment | US |
| Crustdata | Business-contact enrichment (professional-profile sourced) | US |
| Composio | Integration layer for pushing data to connected tools | US |
| Resend | Transactional and notification email | US |
| ZeptoMail (Zoho) | Transactional email | EU |
| Upstash | Managed Redis cache for session and chat state | EU / US |
| Zoho | Scheduling, analytics and business operations | EU |
| PostHog | Product analytics | EU |
| Microsoft Clarity | Anonymised session analytics (marketing site) | US |
See the full subprocessor list with transfer mechanisms, or download it as a PDF.
How we protect your data
A summary of our technical and organisational measures (Article 32 GDPR). Full detail is available under NDA.
Tenant isolation
Each customer's data is scoped by organisation and enforced at the database layer with row-level security.
Encryption
TLS in transit and encryption at rest across all data stores.
Secrets management
No plaintext secrets in code or config; managed secret stores with a documented rotation programme.
Change control
Changes ship through peer-reviewed, risk-tiered pull requests; direct pushes to production are blocked; automated security scanning runs on every change.
Monitoring and audit
Application and infrastructure logging, an administrative audit trail, and system-health monitoring with alerting.
Access control
Least-privilege, need-to-know access provisioned and removed on role change or exit; personnel bound by confidentiality.
What we collect and how long we keep it
Questions about any of this? Email compliance@marketsizer.io.
What we process, at a glance
A plain-language summary of our processing activities. Our full Records of Processing Activities (Article 30) are available to customers on request.
| Category | Summary |
|---|---|
| Purpose | Delivering the MarketSizer platform - GTM intelligence, company and contact data, scoring, and outreach support. |
| Data subjects | Customer users and business contacts (individuals in professional roles at prospect companies). |
| Data types | Business contact information, authentication data, and usage logs. No special-category data. |
| Retention | Customer account data retained during the subscription; enriched contact data anonymised after 90 days. |
| Processing locations | Primarily the EEA, with approved international transfers where applicable (SCCs / UK IDTA). |
Company information
MarketSizer is operated by Tamcalc Limited, an Irish private company limited by shares incorporated under the Companies Act 2014. Two independent identifiers - our CRO registration and D-U-N-S Number - let you verify that we exist.
| Registered company | Tamcalc Limited (trading as MarketSizer) |
|---|---|
| CRO registration | 738699 |
| D-U-N-S Number | 986144356 |
| Registered office | Greyfort, Cruagh Road, Rathfarnham, Dublin, D16 DE92, Ireland |
| Country of incorporation | Ireland |
| Governing law | Ireland |
| Primary data protection authority | Irish Data Protection Commission |
Regulatory jurisdiction
Tamcalc Limited is incorporated in Ireland and regulated under Irish company law. As an EU-established controller and processor, our primary supervisory authority for data protection matters is the Irish Data Protection Commission (DPC). UK GDPR obligations are supported where applicable, and international transfers use recognised mechanisms such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum where required.
Contact
Explore more
Find out who's evaluating in your market right now
before your competitors do.
30 minutes. No commitment. We'll show you the accounts actively evaluating in your market today.
No credit card · Tailored to your ICP · Live data, not a slide deck