This Privacy Policy explains how EnrichLoops ("EnrichLoops", "we", "us") handles personal data across enrichloops.com, app.enrichloops.com, docs.enrichloops.com, and our APIs (together, the "Service"). It works alongside our Terms of Service and our Data Processing Addendum.
Short version (not part of the policy): We are a business data product. We collect what we need to run accounts, bill you, keep the Service secure, and answer support requests. We do not sell your account data. Records you send through the API are processed on your behalf under the DPA. If you want your own information removed from our company records, email us and we will handle it.
1. The two roles we play
As a controller. For your account, billing, support, and website use, we decide how the data is handled. This policy covers that.
As a processor. When you send records through the API, we process them on your instructions and on your behalf. Your agreement with us, plus the DPA, governs that processing. If you are an individual whose data was submitted by one of our customers, contact that customer first; we will help them respond.
2. Information we collect
Account information. Name, work email, company name, and the credentials used to sign in.
Billing information. Plan, invoices, and payment status. Card details go directly to Stripe, our payment processor. We never see or store full card numbers.
Usage and log data. API requests, credit consumption, timestamps, IP addresses, user agents, and error events. We keep these to meter usage, debug problems, and detect abuse.
Your Data. The domains, identifiers, and configuration you submit for enrichment. See Section 1.
Website data. Pages viewed, referring source, approximate location from IP, and similar analytics signals.
Support communications. Anything you send us by email or through the dashboard.
We do not ask for special categories of personal data, health data, or government identifiers, and the Service is not built to receive them.
3. Company records
The Service returns information about businesses. Those records are compiled from publicly available and licensed sources, and they can include business contact details that relate to a person in their professional capacity, such as a role or a work email pattern.
Where data protection law applies, we rely on legitimate interests for compiling and providing this information for business-to-business purposes. If you are an individual and you want your information removed from our records, email support@enrichloops.com. We will action the request and, where we can, prevent it from being re-added.
Company records are never used to make decisions about credit, employment, housing, or insurance. That use is prohibited under Section 6 of our Terms.
4. How we use information
- Provide, operate, and maintain the Service.
- Authenticate users and secure accounts and API keys.
- Meter credits, bill you, and collect payment.
- Respond to support requests.
- Monitor for abuse, fraud, and rate limit evasion.
- Diagnose errors and improve reliability and performance.
- Send service notices, and product updates you can unsubscribe from.
- Meet legal, tax, and accounting obligations.
We use aggregated, de-identified statistics about how the Service is used. Those do not identify you or your customers.
5. Legal bases
Where the GDPR, UK GDPR, or equivalent law applies, we rely on:
- Contract for running your account, delivering the Service, and billing.
- Legitimate interests for security, abuse prevention, product improvement, compiling business records, and business-to-business marketing.
- Consent for optional analytics cookies and marketing email, where consent is required.
- Legal obligation for tax, accounting, and lawful requests.
6. Sharing
We share personal data with:
- Service providers that run infrastructure, payments, email, error monitoring, and analytics for us, under contract and only for those purposes. The current sub-processor list is in Annex C of the DPA.
- Professional advisers such as accountants and lawyers, where needed.
- Authorities, when a valid legal request requires it. Where we are legally permitted, we will tell you first.
- A successor, if we are involved in a merger, acquisition, or sale of assets. This policy continues to apply until it is replaced.
We do not sell your account data, and we do not share it for cross-context behavioural advertising.
7. Retention
Account and billing records are kept for the life of the account and then for as long as tax and accounting law requires, generally seven years. API logs are kept for up to twelve months. Support email is kept for up to two years. Data processed on your behalf is deleted or returned under the DPA when your account closes.
8. Security
We use TLS in transit and encryption at rest, scoped access controls, audit logging, and regular dependency and access reviews. API keys are stored hashed and are shown in full only once. No system is perfectly secure, so keep your keys secret and rotate them if you suspect exposure.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Email support@enrichloops.com and we will respond within the time your law allows, normally within 30 days. We may need to verify your identity first.
Residents of California and other US states with privacy laws have equivalent rights, including the right to request access or deletion, and to be free from discrimination for exercising them.
EU and UK residents can also complain to their local supervisory authority. Canadian residents can complain to the Office of the Privacy Commissioner of Canada.
10. International transfers
We are based in Canada and use infrastructure in Canada, the United States, and the European Union. Where personal data leaves your region, we rely on recognised transfer mechanisms, including the standard contractual clauses set out in the DPA.
11. Cookies and analytics
We use strictly necessary cookies to sign you in and keep the dashboard working, and analytics to understand how the site and product are used. Our analytics providers are PostHog and Vercel Analytics. You can block or clear cookies in your browser, though the dashboard will not work properly without the necessary ones.
We do not run advertising cookies or third-party ad trackers.
12. Children
The Service is for business use and is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.
13. Changes
We may update this policy. If a change is material, we will give notice by email or in the dashboard before it takes effect. The date at the top of this page always reflects the current version.
Contact
Privacy questions, rights requests, and removal requests: support@enrichloops.com