Privacy Policy

This Privacy Policy describes how DigitalPilot collects, uses, and shares information when you use digitalpilot.app, the DigitalPilot application, and integrations you connect through an API connection or an OAuth connection (together, the "Service"). If you do not agree with this policy, do not use the Service.

This policy covers three groups of people: DigitalPilot customers and users, visitors to websites that use our tracking tag, and professional contacts returned when a customer searches, reveals, or verifies a person.

We may update this Privacy Policy by posting a new version on the Service. The updated policy is effective when it is posted. The date at the top of this page is the date of the current policy. Please review it from time to time.

Information about DigitalPilot customers

When you create an account, use the product, or pay us, we collect:

• Name and email address
• Phone number, if you add one
• Account and workspace details, including users you invite
• Billing records. Card payments are processed by Stripe. We do not store full payment card numbers on our servers
• Support messages you send us
• Product usage needed to run the Service, such as credit balances and integration connections

Website visitors

When our tag is installed on a customer's website, we use the visitor's IP address and related network data to identify the company associated with that address, and we record page activity for that company in the customer's workspace. Company identification does not, by itself, name the individual visitor.

If the customer turns on lead capture, we also store the email address and form details a visitor submits, and we can send those leads to destinations the customer configures, such as Slack or a webhook.

Contact search, email reveal, and email verification

When a customer searches for contacts, reveals an email, or verifies an email, we process personal data about named people who work at the company the customer looked up. The customer chooses the company and when to reveal, verify, or save a person. This data comes from third-party partners. It is not inferred from the person's visit to the customer's website.

Where contact data comes from

Contact search and email reveal use a third-party partner. We send that partner the company domain and any filters the customer sets, such as seniority, department, or decision maker. The partner returns professional contact records. Depending on what the partner has, a record can include name, job title, seniority, department, company, work email, phone number, LinkedIn profile URL, a confidence score, the partner's verification status, and the public sources the partner cites.

Email verification uses two steps. On our servers we check the address format, common typos, disposable domains, and the domain's mail server. If those checks pass, we send the email address to a third-party partner to verify the mailbox. If the customer supplies an IP address with that request, we send that IP address to that partner as well. We do not send the partner the person's name, phone number, or LinkedIn profile.

How contact data is processed

• Search. We request people at the domain from our third-party partner, store the response, and show the customer the profile fields the partner returned. The email address is omitted from what we show until the customer reveals it.
• Reveal. We return the work email to that customer's workspace, record that the workspace unlocked it, and add or update a lead in Lead Center with the name, email, job title, phone number, LinkedIn profile, and related fields. A later reveal of an email that workspace already unlocked is served from our record of that unlock.
• Verify. We run the local checks, and when they pass we ask a third-party partner whether the mailbox is valid. We return the result to the customer.

How contact data is shared

We share contact data only as needed to provide the feature the customer used:

• Our third-party contact-data partner receives the company domain and search filters so it can return contact records.
• Our third-party email-verification partner receives the email address being verified, and an IP address only if one was included in the verification request.
• The customer's DigitalPilot workspace receives search results, revealed emails, and verification results for users of that workspace.
• Lead Center in that workspace receives a copy of each revealed contact.
• A system the customer connects through an API connection or an OAuth connection, when the customer chooses to save a person, receives the person's name, work email, job title, phone number, and LinkedIn profile, linked to the company. When the customer chooses to store a verification result, that system receives whether the email is valid on the person field the customer selected. The connected system keeps those records under the customer's account there. Disconnecting DigitalPilot revokes our access. It does not delete people already saved in that system.

If a customer connects a system with an OAuth connection, we can also read company and contact records already stored there, through that OAuth connection or an API connection, so we can show CRM context on visitor insights. That is the customer's existing CRM data.

We do not sell personal information. We share information with service providers who host, bill, or support the Service, and when required by law, to enforce our terms, or as part of a merger or acquisition. We may share visitor and lead events with tools the customer connects, such as Slack, webhooks, or Meta, according to the settings on that workspace.

How long contact data is kept

• Partner search cache. We keep the contact records our third-party partner returns, including email addresses, so we can show a later search and complete a reveal without asking the partner again. We replace a stored search when that search is run again. A company's available-contact count is refreshed at least every 7 days. This cache is not deleted on the workspace plan schedule below.
• Unlocked emails. We keep each email a workspace reveals, tied to that workspace, so that workspace can view it again. We keep that unlock until you ask us to delete it or we no longer need it to provide the Service.
• Lead Center. The lead created from a revealed contact follows the workspace plan: 60 days on Core, 14 months on Pro, and for as long as the workspace remains on Max.
• Email verification. We keep the verification response for 24 hours so a repeated request can return the same result. A Valid or Invalid value written to a connected system stays in that system.
• Connected systems. People and verification values saved through an API connection or an OAuth connection are kept by that system under the customer's account. Their retention is controlled by the customer and by that system.

How long other information is kept

We keep customer account and billing records for as long as the account is open and for as long as we need them for tax, accounting, fraud prevention, and legal claims. Workspace activity and leads, other than the contact-search cache and unlocked-email records described above, are removed after 60 days on Core, after 14 months on Pro, and kept while a workspace is on Max. Credit purchases expire one year after payment. Unused credits expire with them.

How we use customer and visitor information

• Provide, secure, and support the Service
• Identify companies visiting a customer's website
• Run contact search, email reveal, and email verification when a customer requests them
• Create and manage accounts, users, and workspaces
• Process payments and credit purchases
• Send product and support messages
• Send marketing about DigitalPilot, which you can opt out of

Your rights

Depending on the law that applies, you may have a right to access, correct, or delete personal data, receive a copy of it, restrict or object to processing, or withdraw consent. Use our contact page. We will respond as required by applicable law.

If you are a person included in contact search results, you can use that same page to ask about the copy we hold. We may also direct you to that third-party partner for data the partner maintains, and to the DigitalPilot customer (and the system they connected, if they saved you there) for records in the customer's systems. If you are a DigitalPilot customer, you are responsible for requests that concern contacts you have revealed or saved.

You can opt out of marketing from us on our contact page. If we cannot process information the Service needs, you may not be able to use the feature that depends on it.

Cookies

To learn more about cookies and your choices, see our Cookie Policy.

Security

We use reasonable measures to prevent the loss, misuse, or unauthorized alteration of information under our control. No method of transmission or storage is completely secure. You send information to us at your own risk.

Third-party sites

The Service can link to sites and services we do not operate, including LinkedIn. Their privacy practices are their own. Review their policies before using them.

Contact

Questions about this policy or about personal data we hold: contact us.