@stacksjs/defaults 0.75.109 → 0.75.110

package/ai/skills/stacks-marketing-prospecting/evals/evals.json

@@ -0,0 +1,163 @@
+{
+  "skill_name": "stacks-marketing-prospecting",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "We're a B2B SaaS selling RevOps tooling at $30K ACV. Build me a list of 25 prospects.",
+      "expected_output": "Should check for product-marketing.md first. Should identify this as the SaaS branch. Should run Phase 1 ICP definition pulling from product-marketing context or asking targeted questions (target industry, headcount range, tech stack signals, funding stage). Should propose discovery sources appropriate for SaaS at $30K ACV: Apollo for breadth, Clay for waterfall enrichment, Crunchbase for funding signals, BuiltWith/Wappalyzer for tech stack, LinkedIn Sales Nav for decision-mapping (manual). Should ask about user's tool access before assuming. Should source 50-75 candidates (2-3x target) before qualifying. Should flag that email validation via Truelist or similar is non-negotiable before final list. Should output SaaS-branch chat table columns (Score | Company | Industry | Size | Signal | Contact | Email status | Confidence) followed by top 3-5 hot leads with one-sentence rationale each. Should reference references/saas-prospecting.md.",
+      "assertions": [
+        "Checks for product-marketing.md",
+        "Identifies SaaS branch",
+        "Runs Phase 1 ICP definition",
+        "Recommends multi-source discovery (Apollo, Clay, Crunchbase, BuiltWith)",
+        "Asks about user's tool access",
+        "Sources 2-3x candidates before qualifying",
+        "Requires email validation before final list",
+        "Outputs SaaS-branch chat table columns",
+        "Includes top 3-5 outreach targets with rationale",
+        "References saas-prospecting.md"
+      ],
+      "files": []
+    },
+    {
+      "id": 2,
+      "prompt": "Find me 25 SaaS companies that just raised a Series B in the last 60 days and use HubSpot.",
+      "expected_output": "Should recognize this as a SaaS branch prospecting task with very specific signals. Should identify the trigger event (Series B in last 60 days) and the technographic filter (uses HubSpot). Should recommend a workflow: (1) Crunchbase or Pitchbook for funding signal filter (Series B + date), (2) BuiltWith or Clay's waterfall for tech stack verification (uses HubSpot), (3) cross-check via business websites and LinkedIn. Should note this is a tight ICP that should yield high-confidence matches if data sources are current. Should flag freshness concerns: Crunchbase data depends on self-reporting, BuiltWith refresh cycles aren't real-time. Should recommend cross-source verification for the funding date specifically. Should output a SaaS-branch chat table with the funding round + date in the Signal column. Should include verified email validation before delivering.",
+      "assertions": [
+        "Identifies as SaaS branch",
+        "Identifies funding signal + tech stack filter",
+        "Recommends Crunchbase or Pitchbook for funding",
+        "Recommends BuiltWith or Clay for HubSpot verification",
+        "Notes data freshness concerns",
+        "Recommends cross-source verification",
+        "Outputs signal column showing round + date",
+        "Requires email validation"
+      ],
+      "files": []
+    },
+    {
+      "id": 3,
+      "prompt": "I run a marketing agency. Find me 25 mid-market manufacturers in the Midwest US who recently hired a new CMO.",
+      "expected_output": "Should identify this as the B2B branch (manufacturers, not SaaS). Should run Phase 1 ICP definition: industry (manufacturing, with NAICS code if precision matters), size (mid-market = typically 200-2000 employees), geography (Midwest US states), trigger event (CMO hire in last 90-180 days). Should propose discovery: Apollo or ZoomInfo for firmographic filter, LinkedIn Sales Nav for CMO hire detection (job changes), Google Alerts on press releases for trigger events. Should warn that CMO hires aren't always in public databases - LinkedIn Sales Nav alerts on job changes is the most reliable source. Should output B2B-branch chat table with the CMO trigger as the signal. Should reference references/b2b-prospecting.md. Should mention compliance: GDPR less likely (US-only), CAN-SPAM applies, capture source URL + date for every contact.",
+      "assertions": [
+        "Identifies B2B branch (not SaaS)",
+        "Runs Phase 1 ICP definition with NAICS or industry classification",
+        "Specifies mid-market size band",
+        "Specifies Midwest US geography",
+        "Identifies trigger event (CMO hire)",
+        "Recommends Apollo/ZoomInfo + LinkedIn Sales Nav",
+        "Notes CMO hires often only on LinkedIn",
+        "Outputs B2B-branch chat table",
+        "Mentions CAN-SPAM and source URL capture",
+        "References b2b-prospecting.md"
+      ],
+      "files": []
+    },
+    {
+      "id": 4,
+      "prompt": "We sell to industrial distributors. Build a list of 25 prospects.",
+      "expected_output": "Should identify this as the B2B branch. Should run Phase 1 ICP definition asking targeted questions: distributor size, geography, vertical specialty, buying patterns. Should propose discovery: Apollo or ZoomInfo for firmographic depth, industry-specific directories (e.g., NAW for wholesale distributors, ISA for industrial sales agencies), trade show exhibitor lists. Should note state business registries and Chamber of Commerce as verification sources. Should propose trigger events: new location, recent acquisition, leadership change, posting RFPs. Should warn that industrial distributor data is often spotty in major databases - cross-check with company website + LinkedIn for size and ownership signals. Should output B2B-branch chat table. Should note ICP fit precision matters more than initial volume for this kind of niche prospecting.",
+      "assertions": [
+        "Identifies B2B branch",
+        "Runs Phase 1 ICP definition asking targeted questions",
+        "Recommends industry-specific directories beyond Apollo/ZoomInfo",
+        "Mentions trade show exhibitor lists",
+        "Identifies relevant trigger events",
+        "Warns about data spottiness for industrial",
+        "Recommends cross-verification with business websites + LinkedIn",
+        "Notes ICP fit precision over volume"
+      ],
+      "files": []
+    },
+    {
+      "id": 5,
+      "prompt": "I build websites for local businesses. Find me 15 prospects near Austin, TX who don't have a website.",
+      "expected_output": "Should identify as Local SMB branch. Should run Phase 1 ICP definition: business category (ask user - gyms, restaurants, salons, etc. matter), radius (default 20 km from Austin), target count (15). Should run the browser research workflow: search Google Maps for category + Austin, build candidate list from visible results, cross-check via business name + city web search to verify website status. Should apply the 4-tier website status classification (No site found / Social only / Weak site / Has site) - prioritize No site + Social only as Hot. Should score: Hot (no site + active + phone + within radius), Warm (weak site), Cold (has site), Skip (closed/duplicate/out of scope). Should output Local SMB chat table (Score | Business | Category | Area | Distance | Website status | Website/Social | Phone | Why prospect | Confidence). Should add 'Best first outreach targets' top 3 with reasoning. Should reference references/local-prospecting.md. Should warn against bulk-scraping Google Maps (ToS violation) - browser-assisted research only.",
+      "assertions": [
+        "Identifies Local SMB branch",
+        "Asks about business category if not specified",
+        "Defaults radius to 20km",
+        "Runs browser research workflow",
+        "Applies 4-tier website status classification",
+        "Uses Hot/Warm/Cold/Skip scoring",
+        "Outputs Local SMB chat table columns",
+        "Adds top 3 outreach targets",
+        "References local-prospecting.md",
+        "Warns against bulk-scraping Google Maps"
+      ],
+      "files": []
+    },
+    {
+      "id": 6,
+      "prompt": "I have a list of 200 prospect emails from Apollo. How do I know which ones are deliverable before I start outreach?",
+      "expected_output": "Should explain the deliverability validation step in Phase 3. Should recommend Truelist (the integration in this pack) for bulk validation. Should explain the email_state classification output: ok (deliverable), email_invalid (bounces, exclude), risky (deliverable with risk like role or disposable, include cautiously), unknown (couldn't determine, skip or re-verify), accept_all (catch-all domain, include cautiously). Should warn that Apollo data accuracy is typically 60-80% - sending without validation will tank sender reputation (bounce rate >2% triggers ISP throttling and reputation damage). Should recommend the workflow: bulk POST to /api/v1/verify or CSV upload → keep ok, include risky/accept_all cautiously, exclude email_invalid, re-verify unknown → hand off to outreach. Should note Truelist also has an official MCP server for agent-driven validation. Should note cold email reputation is hard to recover once damaged - validation is non-negotiable, not optional. Should mention Hunter and Snov as alternatives with built-in verification. Should reference truelist.md integration guide.",
+      "assertions": [
+        "Recommends Truelist for bulk validation",
+        "Explains email_state values (ok, email_invalid, risky, unknown, accept_all)",
+        "Warns Apollo accuracy is 60-80%",
+        "Cites 2% bounce rate threshold for reputation damage",
+        "Recommends workflow: validate, keep ok, exclude email_invalid",
+        "Mentions Truelist MCP server for agent workflows",
+        "Mentions cold email reputation is hard to recover",
+        "References truelist.md or data-sources.md"
+      ],
+      "files": []
+    },
+    {
+      "id": 7,
+      "prompt": "I just built a tool that automates failed-payment follow-up for gym owners. I have no customers yet. Help me find my first ten - the people who are actually dealing with this problem right now.",
+      "expected_output": "Should select the Demand-signal branch (early-stage, first customers, evidence-of-demand) and load references/demand-signals.md - NOT the SMB/B2B list-building branches. Should start with a product brief, then mine the five signal buckets (explicit demand / pain / workaround / switching / timing) across public discourse (forums, communities, reviews, GitHub issues, job posts) - using last30days for recency, social-fetch/scraping to read original pages, not qualifying from snippets. Should score prospects on demand-fit (pain 25 / product fit 25 / timing 20 / reachability 15 / evidence quality 15, 0-100 with bands) rather than ICP-fit Hot/Warm/Cold, and require a cited public signal for every primary-shortlist prospect. Should draft source-based openers but never auto-send. Should produce an evidence report (verdict → ICP → top prospect → shortlist with sources+scores → repeated patterns → 7-day manual outreach plan → limits) and label prospects as 'potential customers based on public signals,' not confirmed buyers. Should honor the compliance guardrails including no data brokers/leaked data and no sensitive-trait targeting.",
+      "assertions": [
+        "Selects the Demand-signal branch, not the SMB/B2B/SaaS list-building branches",
+        "Mines the five signal buckets from public discourse rather than contact databases",
+        "Uses recency/original-source tooling (last30days, social-fetch, scraping) and does not qualify from snippets",
+        "Scores on the demand-fit rubric (0-100 weighted), not ICP-fit Hot/Warm/Cold",
+        "Requires a cited public signal for every primary-shortlist prospect",
+        "Drafts openers but never auto-sends; labels prospects as potential-based-on-public-signals",
+        "Produces the evidence report structure with a 7-day manual outreach plan and limits"
+      ],
+      "files": []
+    },
+    {
+      "id": 8,
+      "prompt": "I sell CRO services to B2B SaaS companies. How do I find companies that are likely to need us right now instead of just pulling a big list from Apollo?",
+      "expected_output": "Should load the signal plays reference. Should rank signals by closeness and pick ones that fit a CRO agency: recent funding (30-60 day window), a new VP Marketing or growth leader (first 90 days), open growth or performance marketing roles, a redesigned site or new pricing page, launched paid campaigns. Should stack signals with ICP fit rather than act on one weak signal, record signal dates, map signals to plays (value-first teardown), and assign account tiers (Tier 1 1:1 top 25-50 with account briefs, Tier 2 segments, Tier 3). Should name ways to detect each signal (job data, funding news, visitor ID) and warn against opening with the signal itself or mentioning tracked visits.",
+      "assertions": [
+        "Uses buying signals as a timing filter on top of ICP fit",
+        "Names signals relevant to a CRO agency",
+        "Gives freshness windows for signals",
+        "Maps signals to a play, including a value-first teardown",
+        "Assigns account tiers that set research depth",
+        "Says not to open with 'congrats on the raise' or mention tracked visits"
+      ],
+      "files": []
+    },
+    {
+      "id": 9,
+      "prompt": "About a fifth of the emails in my list come back as catch-all from our verifier. Should I send to them or drop them?",
+      "expected_output": "Should load the sourcing and enrichment reference and explain that catch-all domains accept any address, so basic SMTP verification can't confirm the person. Should recommend a policy: resolve catch-alls with a verifier that goes beyond SMTP checks; send resolved-valid ones from separate lower-volume mailboxes; send unresolved ones only to Tier 1 accounts while watching bounces; keep campaign bounces under 2% with automatic pause; re-verify within 7 days of sending. Should not recommend sending all of them blind or dropping all of them without considering account value.",
+      "assertions": [
+        "Explains why catch-all addresses can't be confirmed by basic verification",
+        "Recommends resolving catch-alls with a specialist verifier",
+        "Recommends separate lower-volume mailboxes for resolved catch-alls",
+        "Limits unresolved catch-alls to Tier 1",
+        "Keeps bounce rate under 2% with a pause rule",
+        "Neither sends all blindly nor drops all by default"
+      ],
+      "files": []
+    },
+    {
+      "id": 10,
+      "prompt": "We have 200 B2B prospects and several connected enrichment providers. Some records are fresh in our cache, some caches are expired, one API says429 and another finds a same-name company in the wrong country. Design a cost-bounded waterfall without overwriting verified CRM contacts.",
+      "expected_output": "Defines identity and accepted-field criteria, exact account/provider/input cache matching, differentiated expiry/no-match/error handling, and conditional ordered lookups. Preserves stronger CRM evidence, contact verification, and unresolved reasons.",
+      "assertions": [
+        "Reuses only applicable fresh cache entries",
+        "Does not treat429 or timeout as no-match",
+        "Rejects a wrong-entity result instead of counting any nonempty response as success",
+        "Stops when an accepted field is found instead of running every provider",
+        "Preserves stronger verified CRM fields and separate contact verification"
+      ],
+      "files": []
+    }
+  ]
+}

package/ai/skills/stacks-marketing-prospecting/references/account-research.md

@@ -0,0 +1,59 @@
+# Account Research for Outreach
+
+Research before outreach has one job: find a true, specific reason this account should care right now, and the person who owns that problem. Dossiers on companies you compete with belong to the competitor-profiling skill.
+
+## How much research each tier gets
+
+| Tier | Time per account | Output |
+|------|------------------|--------|
+| Tier 1 | 10-20 minutes, or an agent run reviewed by a human | Full brief (below) |
+| Tier 2 | 2-3 minutes per account, plus shared segment research | One sourced hook per contact + the segment brief |
+| Tier 3 | None per account | The segment brief only |
+
+Tiers are defined in [signal-plays.md](signal-plays.md).
+
+## Where the useful facts are
+
+In rough order of usefulness:
+1. **Their job posts.** They describe the problem in their own words, list the tools they use, and reveal priorities ("own our experimentation roadmap").
+2. **Their own pages.** Pricing, landing pages, changelog, careers, case studies. For a services pitch, the page you'd improve is the research.
+3. **What leaders say publicly.** LinkedIn posts, podcast appearances, conference talks, interviews.
+4. **Company news.** Funding, launches, acquisitions, leadership changes, new markets.
+5. **Filings and reports.** For public companies, the 10-K risk factors and earnings calls name priorities explicitly.
+6. **Reviews of their product.** What their customers complain about can show what they're under pressure to fix.
+
+## The brief (Tier 1)
+
+```markdown
+## [Company] - account brief
+**Fit:** [ICP criteria met, with any gaps]
+**Signal:** [what happened, date, source URL]
+**Likely priority:** [the problem the signal implies, in their words where possible]
+**Evidence:** [2-4 facts, each with a source URL]
+**Who owns it:** [name, title, why them; a second contact if multi-threading]
+**Angle:** [one sentence connecting their situation to what you offer]
+**Proof to use:** [the closest case study or result]
+**Don't mention:** [anything sensitive, stale, or creepy, e.g. tracked website visits]
+**Hook found:** yes / no
+```
+
+## Rules for agent research
+
+AI makes research cheap, and it also makes invented hooks cheap. These rules keep the research honest:
+
+1. **Facts first, angle second.** Run research as two steps. Step one collects facts, each with a source URL and date. Step two writes the angle using only those facts. Never let one step do both.
+2. **"No hook found" is a valid result.** If the sources don't support a specific angle, say so and drop the account to the segment-level message. A generic hook dressed up as personal research is worse than an honest segment message.
+3. **Bound the angles.** Give the agent your 3-5 value propositions and require the angle to map to one of them. Unbounded creativity produces promises you can't keep.
+4. **Date everything.** A fact without a date can't be judged for staleness. Discard anything older than its freshness window.
+5. **Quote, don't paraphrase, when it matters.** If the hook rests on something a leader said, keep the exact quote and link.
+6. **Never use sensitive traits** (health, finances, politics, religion, family) even when public. See [compliance.md](compliance.md).
+
+## Segment briefs (Tier 2 and 3)
+
+For a segment, research the shared situation instead of each account:
+- What the accounts have in common (the segment definition)
+- The pain that commonality creates, with 2-3 public examples
+- The proof that speaks to it
+- The one-line opener each contact will get, plus the slot for a per-contact detail (Tier 2)
+
+A tight segment does the personalization work. "Series A SaaS companies that just posted their first growth marketer role" needs little per-account research, because the segment already explains why you're writing.

package/ai/skills/stacks-marketing-prospecting/references/b2b-prospecting.md

@@ -0,0 +1,106 @@
+# B2B Prospecting Reference
+
+For when the user sells to non-SaaS B2B - services, agencies, manufacturers, mid-market and enterprise companies, professional services firms.
+
+---
+
+## ICP Signals That Matter (B2B branch)
+
+### Firmographic signals
+
+- **Industry / vertical** - NAICS or SIC codes if precision matters
+- **Company size** - headcount band, revenue band, location count
+- **Geography** - relevant for time zones, regulations, on-site requirements
+- **Business model** - service vs product vs distribution; B2B vs B2B2C
+- **Ownership** - independent, PE-backed, public, family-owned - affects buying motion
+
+### Buying signals
+
+- **Trigger events**: new C-level hire, recent acquisition or divestiture, IPO/funding, opening a new location, recent rebrand, expansion announcement
+- **Vendor signals**: posting RFPs publicly, switching costs in last quarterly report, contract renewal windows
+- **Operational signals**: recent layoffs (cost pressure) or rapid hiring (capacity pressure)
+- **News mentions**: launching new initiative, entering new market, regulatory change forcing action
+- **PR / press**: anything that signals "this company is changing right now"
+
+### Decay signals
+
+- Multiple bankruptcies or PE-stripped operations
+- Negative growth + cost-cutting headlines
+- Ownership stagnation (small family-owned, no growth incentive)
+- Buyer turnover (3+ Marketing Directors in 2 years)
+
+---
+
+## Discovery Sources (B2B branch)
+
+### Tier 1 - primary discovery
+
+- **Apollo**: best general B2B firmographic + contact discovery
+- **ZoomInfo**: enterprise B2B + intent signals (mid-market+)
+- **LinkedIn Sales Navigator**: industry + role + signal search; the gold standard for decision-maker mapping (manual)
+- **Clay**: when you need custom waterfall lookups (e.g., enrich Apollo records with Hunter, then a waterfall aggregator)
+
+### Tier 2 - industry-specific directories
+
+- **Crunchbase / Pitchbook**: funded businesses
+- **D&B Hoovers**: large traditional B2B firmographics
+- **State / national business registries**: for verified incorporation data
+- **Industry association membership rosters**: trade groups often publish member lists
+- **Trade show exhibitor lists**: signals active participation in a vertical
+- **Procurement databases** (Procore for construction, e.g.): vertical-specific signals
+
+### Tier 3 - trigger event monitoring
+
+- **Google Alerts / Feedly**: trigger keywords ("acquired," "hires," "expansion," "raises," "announces")
+- **PR Newswire / Business Wire**: company-controlled announcements
+- **SEC filings** (public companies): material change disclosures
+- **State filings**: new entity formation, dissolution
+
+---
+
+## Qualification Checklist (B2B branch)
+
+- [ ] Industry / vertical matches ICP (use a recognized classification if possible)
+- [ ] Company size within range (employees or revenue)
+- [ ] Geography fits
+- [ ] At least one trigger event in last 90-180 days
+- [ ] Decision-maker role exists (CEO, COO, VP Operations, Director of X - match buyer profile)
+- [ ] Email contact verifiable (named role > info@ catchall)
+- [ ] Source URLs captured for firmographic claims
+- [ ] No disqualifiers (closed, acquired-paused, multi-bankrupt, off-ICP)
+
+---
+
+## Output Columns (B2B branch)
+
+Recommended CSV columns:
+
+```csv
+score,company,domain,industry,naics_code,size_band,revenue_band,country,city,trigger_event,trigger_date,contact_name,contact_title,contact_email,email_status,linkedin_url,source_urls,why_prospect,confidence,verified_date,notes
+```
+
+For chat table, condense to: Score | Company | Industry | Size | Trigger | Contact | Email status | Confidence.
+
+---
+
+## Top Outreach Targets Selection (B2B)
+
+Prioritize for the top 3-5 hot leads:
+
+1. **Trigger event recency** - 30 days beats 6 months
+2. **Trigger event specificity** - new CMO hire in your buyer's role beats "company in the news"
+3. **Decision-maker access** - named contact with verified email + LinkedIn beats role-only
+4. **Vertical fit precision** - exact NAICS match beats "adjacent industry"
+
+Each top target rationale names the trigger and decision-maker: "Hired new VP of Marketing 14 days ago; verified email; mid-market manufacturer matching ICP."
+
+---
+
+## Common Mistakes (B2B)
+
+1. **Treating B2B like SaaS** - funding rounds matter less; PE ownership and acquisition activity matter more.
+2. **Trying to verify private company revenue precisely** - most public databases approximate. Use size bands, not point estimates.
+3. **Ignoring procurement complexity** at enterprise scale - your prospect contact list may not include the actual approver.
+4. **Cold-emailing executive assistants** - they're not the buyer and they will flag your outreach as spam.
+5. **Source URL hygiene** - without source lineage, you can't defend a contact under GDPR DSAR or CAN-SPAM challenge.
+6. **Stopping at one source** - Apollo can be 60% accurate on small businesses. Cross-verify with LinkedIn or the business website.

package/ai/skills/stacks-marketing-prospecting/references/compliance.md

@@ -0,0 +1,161 @@
+# Prospecting Compliance Reference
+
+The legal and platform-ToS constraints that apply to prospect list building. Read first, every engagement.
+
+> Operational guidance, not legal advice. For high-volume programs or programs touching EU/UK residents, run your setup past a privacy attorney.
+
+---
+
+## United States - CAN-SPAM (downstream)
+
+CAN-SPAM regulates the cold email **send**, not the list build. But the list build matters because:
+
+- You must be able to identify the source of every email address you contact (required if challenged)
+- The "from" line and email content rules apply at send time - but you can't lie about how you got the contact
+- Opt-out requests must be honored within 10 business days and tracked
+- Every commercial email needs a working opt-out and the sender's valid physical postal address, so plan both before the first send
+
+**For prospecting specifically**: capture and retain the source URL + date for every contact you add to a list. CAN-SPAM doesn't require it explicitly, but defending your sender practices does.
+
+---
+
+## EU / UK - GDPR
+
+The strictest applicable framework. Triggers when:
+
+- Your prospect resides in EU/UK
+- You're processing personal data (any identifiable info, including business emails tied to a named person)
+
+### Lawful bases for cold B2B outreach
+
+You have three credible options:
+
+1. **Legitimate interest** (most common for B2B). Requires:
+   - The contact is in a business role likely to be interested in your offer
+   - The data was collected from a public, business-context source
+   - You provide a clear opt-out
+   - You can articulate the legitimate interest test in writing
+
+2. **Consent** - typically not feasible for cold outreach (you don't have consent before first contact)
+
+3. **Existing customer relationship** - only applies to current customers, not prospects
+
+### What you must do
+
+- Capture **source + date + lawful basis** for every contact
+- Honor data subject access requests (DSARs) - you must be able to disclose, correct, or delete on request
+- Include a privacy notice / opt-out in the first outreach
+- Don't store personal data longer than necessary for the legitimate interest
+
+### EU specifics
+
+- **Commercial interest counts.** The CJEU's KNLTB ruling (October 2024) confirmed that a purely commercial interest can be a legitimate interest. You still need the balancing test in writing (a legitimate interests assessment).
+- **Tell people where you got their data.** When the data didn't come from the person directly (Article 14), say so within a month, and at the latest in the first message. One line works: "I found your email on [source]; reply 'remove' and I'll delete it."
+- **Germany is different.** Germany's unfair competition law (UWG §7) requires prior consent for advertising email, B2B included, and competitors enforce it through lawsuits. Exclude German contacts from cold email; use LinkedIn or phone (B2B calls need presumed consent, meaning a concrete reason to believe they'd welcome the call).
+- **National rules sit on top of GDPR.** Several countries apply stricter ePrivacy rules to email. When a campaign targets one EU country heavily, check that country's rules.
+
+### What disqualifies a list
+
+- Bulk-scraped LinkedIn data - explicit ToS violation + GDPR risk
+- Email addresses purchased from a list broker without source provenance
+- "Anyone @ this domain" guessed emails sent without verification (multiplies risk + bounces)
+
+---
+
+## UK - PECR
+
+PECR sets the email rules on top of UK GDPR:
+
+- **Corporate subscribers** (limited companies, LLPs, public bodies) can be cold-emailed at their work address without consent, as long as you identify yourself and offer an opt-out.
+- **Sole traders and partnerships** are treated like individuals and need consent. Many small agencies and consultancies fall in this group, so check the entity type before sending.
+- **Fines rose sharply.** The Data (Use and Access) Act 2025 raised the PECR maximum from £500,000 to £17.5 million or 4% of global turnover, and wrote direct marketing into UK GDPR as a recognised legitimate interest.
+
+---
+
+## Australia - Spam Act
+
+Australia is consent-based. Inferred consent can come from a conspicuously published business address with no "no unsolicited messages" notice, where the message relates to the person's role. Address-harvesting software is prohibited outright. Every message needs sender identification and a working unsubscribe.
+
+---
+
+## Canada - CASL
+
+Stricter than CAN-SPAM. Cold B2B outreach requires:
+
+- **Express consent** (explicit opt-in) - typically not present for cold prospecting
+- **OR implied consent** - existing business relationship within 24 months, OR business address publicly published on the company's own site for the purpose of receiving such communications
+
+**Practical implication for Canadian prospects**: relying on the publicly-published-address exception is the most defensible cold prospecting basis in Canada. You must include sender identification, mailing address, and an unsubscribe mechanism in every message.
+
+---
+
+## Platform Terms of Service
+
+### LinkedIn
+
+- **Sales Navigator** as a research tool: fine. Use it to define account and persona filters, then pull contacts from a licensed database. Sales Navigator has no native export, caps searches at 2,500 results, and syncs to a CRM only on Advanced plans.
+- **Scraping LinkedIn at any scale**: explicit ToS violation. Banned accounts are permanent. Don't.
+- **LinkedIn enforces against vendors as well as users.** It sued Proxycurl (which shut down in July 2025 under a permanent injunction) and ProAPIs (October 2025) over fake-account scraping, and removed company pages for Apollo, Seamless, and HeyReach. Any data or automation vendor that depends on LinkedIn can disappear overnight; keep an alternative.
+- **Logged-out vs logged-in.** Courts have treated scraping public, logged-out pages differently from scraping behind a login or with fake accounts, which breaches the User Agreement. Under GDPR, "publicly visible" still doesn't mean free to use: France's regulator fined Kaspr €240,000 (December 2024) for collecting contact details from LinkedIn that users had chosen to hide.
+- **Apollo, Clay, and ZoomInfo** claim LinkedIn-overlap data through various legitimate channels - verify their data sources before assuming compliance
+- **Messages, InMail, and connection requests** are still processing of personal data, so GDPR, PECR, and similar laws apply exactly as they do to email: lawful basis, an opt-out on request, and source records. LinkedIn's own rules apply on top, and third-party automation tools violate its User Agreement.
+
+### Google Maps
+
+- ToS prohibits bulk extraction or productizing Maps data
+- Browser-assisted research as a discovery aid: acceptable
+- Place IDs are exempt from Google's caching limits, so storing them to re-look up a business is fine. Other Maps content (reviews, ratings, photos, and bulk-copied listing details) can't be cached beyond the terms or rebuilt into your own database
+- The Places API is the compliant way to pull business data programmatically, within its terms
+- Use Maps to **find** local businesses, then cross-source from the business's own site for the data you retain
+
+### Apollo / ZoomInfo / other licensed data providers
+
+- All have their own ToS limiting reselling, downstream sharing, and use cases
+- Read your contract - typically you can use the data for your own outreach but not productize it
+- Don't share extracts publicly (e.g., on a leaderboard, in a public report)
+
+### Crunchbase
+
+- Free tier is read-only for personal use
+- Paid tier permits broader use within contractual scope
+- API access requires paid Pro+ tier
+
+---
+
+## Phone and SMS (US)
+
+- **Do Not Call.** Scrub numbers against the National DNC Registry and your internal DNC list before calling. B2B calls to business lines are lower risk, but mobile numbers enriched from data providers are often personal cell phones, which the rules protect.
+- **AI voice counts as an artificial voice.** The FCC's February 2024 ruling puts AI-generated voices under the TCPA's artificial or prerecorded voice rules. AI-voiced calls to cell phones need prior express consent, and written consent for marketing. Damages run $500-$1,500 per call. Use AI voice only for inbound calls and requested callbacks.
+- **Opt-outs by any reasonable means.** Since April 2025, a consumer can revoke consent by any reasonable means (a reply of "stop," a spoken request), and you have 10 business days to honor it.
+- **Cold SMS** to US mobiles needs consent plus 10DLC registration. Treat SMS as a channel for people who've already engaged.
+
+---
+
+## Anti-Patterns (Don't Do These)
+
+1. **Bulk-scraping LinkedIn / Google Maps / Yelp**. Browser-assisted research is OK; automated scrapers pointed at these platforms are not. **Firecrawl and Browserbase are fine for an individual prospect's own website** (the URL you found through manual discovery) - not for the platforms hosting prospects.
+2. **Buying lists from random vendors** without source provenance. You inherit their legal exposure.
+3. **Guessing emails and sending unverified**. Bounce rates over 2% destroy sender reputation; legally, you can't claim a "legitimate interest" basis for an email you fabricated.
+4. **Harvesting personal email addresses** (Gmail, personal Outlook, etc.) from public profiles. Personal addresses raise GDPR risk significantly.
+5. **Storing data you don't need**. Minimize retention. Don't keep prospect lists forever - GDPR right to deletion applies.
+6. **Skipping the lawful basis documentation**. If challenged, you need to show your work. Capture source URL + collection date for every contact.
+7. **Reselling prospect lists**. You may not have the right to share them downstream. Read your data provider contracts.
+8. **CAPTCHA bypass / login wall bypass**. Even if technically possible, this signals bot behavior and violates virtually every ToS.
+
+---
+
+## Quick Audit Checklist
+
+Before shipping a list to the user (or downstream to cold-email):
+
+- [ ] Every contact has a source URL + collection date
+- [ ] No contacts sourced from scraped LinkedIn data
+- [ ] No bulk Maps content (reviews, ratings, listing copies) retained beyond Google's terms
+- [ ] Country gating applied: Germany excluded from cold email, UK sole traders and partnerships excluded without consent, CASL and Spam Act requirements met for Canada and Australia
+- [ ] Phone numbers scrubbed against DNC; no AI-voice calls to mobiles without consent
+- [ ] Lawful basis documented (legitimate interest test for B2B, or relevant alternative)
+- [ ] Email addresses validated (deliverability check before outreach)
+- [ ] Personal addresses (Gmail, etc.) flagged or excluded
+- [ ] Source provider contracts permit the intended use case
+- [ ] Retention plan documented (when to delete)
+- [ ] First outreach will include an opt-out, a postal address, and (for EU/UK) where the data came from (downstream concern for cold-email skill, but mention it now)