Two kinds of people read this: customers, and the people in the data.

01Who is responsible for your data

The controller of the personal information described here is Smarter Outbound LLC, a United States limited liability company — contact: privacy@smarterdata.ai (Smarter Data, we). Smarter Data and smarterdata.ai are the names under which Smarter Outbound LLC offers the Service. Privacy questions and requests go to privacy@smarterdata.ai.

This policy applies to the website smarterdata.ai, the console at /app, the API at api.smarterdata.ai, the MCP server at mcp.smarterdata.ai, and the business dataset we license through them.

02Customers: what we collect

• Account. Your email address and a password (stored only as a hash by our authentication provider), or a sign-in link sent to that email. Your organization name and billing details if you give them.
• Payments. Credit packs are paid through our payment processor; we never see or store full card numbers. We receive the transaction identifier, amount, status, the last digits and brand of the card, and the billing name and country the processor passes back, and we keep them for our ledger and tax records.
• API and MCP usage. For every request our servers log the endpoint with its filters and parameters, the timestamp, the request id, the response status and the IP address it came from; what each call cost is kept in your account's credit ledger. We also keep the delivery ledger — which records were delivered to your account and when — because it is what stops a repeated pull from charging you again for a record you already bought.
• Data you submit. Email addresses you verify, domains you crawl, addresses and phone numbers you resolve, opt-outs you pass to us, and the queries you run. See section 3 for what we do with the results.
• Support. Emails and messages you send us, and the request ids you quote.
• Website. The website sets no analytics or advertising cookies and runs no tracking scripts. The console stores your sign-in session in your browser's local storage so that you stay signed in. Pages load their typefaces from a third-party font service, which receives your IP address when the page loads; our hosting provider keeps standard server logs.

03Customers: how we use it

• To provide the Service: authenticate you, meter and bill credits, keep the delivery ledger, enforce scopes and rate limits, and answer support requests.
• To secure the Service: detect abuse, shared or leaked keys, fraud and attacks.
• To tell you about billing, security, outages and changes to our terms. We do not send marketing email to customers who have not asked for it.
• To improve the dataset. The results of the processing you ask for — that an email address is deliverable or not, that a domain's site lists certain contact details, that a lookup matched or did not match — and records of how the Service is used may be retained and folded back into the dataset and our quality models, so that every customer sees more accurate data. These outcomes are kept as facts about the business record they concern, not as facts about you: we do not tell other customers who searched for what, whom you contacted, or that a record was delivered to you. One consequence to know: an answer we already hold — a verification, a crawl, a live page or a skip-trace — is served to any customer who asks for the same address, domain, query or property within its freshness window, with the date it was really obtained, so that customer can see it was checked before and when (never by whom). If you need a particular submission not to be retained, say so at privacy@smarterdata.ai before you send it and we will tell you what we can do.
• To meet legal obligations, such as tax and accounting rules and lawful requests from authorities.

We do not sell customer account information, and we do not use it for third-party advertising.

04Customers: who we share it with

• Service providers working for us under contract: hosting and database infrastructure, authentication, payment processing, transactional email, and the data providers whose lookups we run on your behalf (they receive the value you asked about — an email address, a domain, an address — and nothing that identifies you).
• Legal. When required by law, court order or a lawful request, or to protect the rights, safety or property of Smarter Data, our customers or the public.
• Business transfers. If Smarter Data or the Service is sold, merged or reorganized, account data moves with it under this policy.

Nobody else. We never give one customer another customer's account data, queries or delivery history.

05The dataset: what it holds and where it comes from

Our dataset describes United States businesses and the people who run or work at them, in their professional capacity. It is licensed to customers for business-to-business sales and marketing under the Terms and the Acceptable Use Policy, and never for decisions about an individual's credit, employment, insurance or housing.

What a record may contain

• About a business: name, industry and niche, NAICS code, street address, phone number, website domain, employee and revenue bands (revenue is a modeled estimate), service lines, a quality score, and the kind of source each fact came from.
• About a person at a business: name, job title and seniority, whether they are a decision-maker, their business email address, a direct or mobile phone number where one is on file, a professional-network profile URL, and the city and state of the business. We label a shared inbox such as info@ as a business address, never as a person's personal address.

Where it comes from

Business directories and map listings; public records such as state business registrations, licenses and property records; the businesses' own websites; live web search at the moment of a query; licensed third-party business-data providers; verification results from our own processing; and corrections and outcomes observed while serving customers (section 3). Every record carries the class of its sources. We cross-check and deduplicate sources into one record per business; we do not knowingly collect data about people in their private capacity or about anyone under 18.

What we do with it

We license records to customers through the API and MCP server, which some state privacy laws treat as a sale or sharing of personal information. Because we collect and license personal information about people we have no direct relationship with, we are, or may be, a data broker under the laws of several states and register accordingly: [[IVAN: data-broker registrations — California (Delete Act / CPPA), Texas, Vermont, Oregon: registration numbers and dates, or "registration in progress" — confirm status before publishing]].

06Opt-out, suppression and deletion

Anyone, anywhere may ask us to stop licensing their details, whether or not a law gives them that right. Email privacy@smarterdata.ai with the email address(es) and phone number(s) you want suppressed (and, if you like, your name and the business). We will:

• add those values at once to our store-wide suppression list — an internal list we apply every time the dataset is built — so that from the next data build on they are not delivered to any customer in any pull [[IVAN: the build step that applies this list is not in place yet — confirm this section before the page is published]];
• remove the matching contact record from the dataset in that next build (the serving dataset is rebuilt periodically rather than edited in place), keeping only the suppressed values themselves (so the opt-out keeps working if we encounter them again), the date, and the request itself as a record of compliance;
• confirm by email, normally within 10 business days and in any case within the period the applicable law requires.

Records that customers were already delivered are theirs under license; each customer is contractually required to honor the opt-outs they receive and to keep their own suppression list. If you were contacted by a Smarter Data customer, tell them directly as well, and tell us who it was so that we can check their use is within policy.

Customers who receive an opt-out can pass it to us at the same address. A suppression-list upload for your own key, so that values you suppress are never returned to it, is planned; until it ships, the address above is the way.

07Your privacy rights by place

California residents have the right to know what personal information we hold about them and how it is used and shared, to delete it, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information (we do not collect any), and not to be discriminated against for exercising these rights. To exercise them, email privacy@smarterdata.ai with the subject Do Not Sell or Share My Personal Information or California request. An authorized agent may act for you with written permission. We verify requests by replying to the address or number concerned, and we respond within 45 days, extendable once by 45 days with notice. Californians may also submit a single deletion request to the state's Delete Request and Opt-out Platform when it is in force; we will process requests received through it. [[IVAN: confirm the DROP / Delete Act timeline and whether the "Do Not Sell or Share" link should also appear in the site footer]]

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have comparable rights to access, correct, delete and opt out of sale or targeted advertising, and to appeal a refusal; use the same address and we will follow the law of your state. The website sets no cookies that need a consent banner, and because it does not track visitors there is nothing for a Global Privacy Control signal to switch off; the opt-out above covers the dataset.

If you are in the European Economic Area, the United Kingdom or Switzerland: our dataset covers United States businesses only, and the Service is directed at customers in the United States. Where data-protection law there applies to a customer account, our legal basis for processing is the performance of our contract with you and our legitimate interest in running a secure, accurate service, and you have the rights of access, rectification, erasure, restriction, portability and objection, and to complain to your supervisory authority. [[IVAN: confirm whether an EU/UK representative or a standard contractual clauses note is needed]]

08How long we keep things

• Account data: for the life of the account, then as long as tax, accounting and dispute rules require (normally seven years for financial records).
• Delivery ledger: for the life of the account, because it is what stops a repeated pull from charging you again for a record you already bought; after closure it is kept with the account's financial records.
• API request logs: kept in our server log for 30 days, after which the system log rotates them out; what a call cost stays in the credit ledger with the account record.
• Submissions and processing results: the results become part of the dataset (section 3) and are kept for as long as they are accurate and useful; the submitted lists and the job's results are kept with the job record and our answer store, and we delete a specific submission on request [[IVAN: a fixed raw-payload retention period (e.g. 30 days) can be promised only once a purge job exists — today job payloads are not purged]].
• Dataset records: kept while the business exists and the record is useful; refreshed periodically, when the dataset is rebuilt; removed in the next data build when a business closes or a person leaves and that is confirmed, or on request under section 6.
• Suppression list: indefinitely — an opt-out must keep working.

09Security

Traffic to the website, console, API and MCP server is encrypted in transit. API keys are stored hashed; only the prefix is ever shown again. Access to production systems and the control plane is limited to the people who operate them, and the control plane and ledgers are backed up on a schedule. No system is perfectly secure; if you believe a key or account has been compromised, rotate the key in the console and tell us at privacy@smarterdata.ai.

10Where data is processed

Our systems run in the European Union and the United States. The API, the MCP server and the dataset they serve run in a data center in the European Union; the control plane that holds account, credit, key and delivery-ledger records runs in the United States, as do our authentication and payment providers; the website and console are served through a United States hosting provider's global network. If you access the Service from elsewhere, your data is transferred to and processed in those places.

11Children

The Service is for businesses and professionals and not directed at anyone under 18. We do not knowingly collect information about children, in accounts or in the dataset; if you believe we have, email privacy@smarterdata.ai and we will delete it.

12Changes to this policy

The current version is always at smarterdata.ai/legal/privacy.html with its effective date. For material changes we email account holders at least 14 days before they take effect.

13Contact

Privacy, opt-out, suppression and deletion requests: privacy@smarterdata.ai.
Legal notices: privacy@smarterdata.ai.