Privacy Policy

We at Algominds take your privacy seriously. We build software and services that help businesses find, understand, and reach the right people, and we know that doing this responsibly means handling personal data with care, transparency, and a defensible legal basis. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your data.

This Policy is written to meet our obligations under the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (the DUAA, as it comes into force), the EU GDPR (Regulation (EU) 2016/679), the California Consumer Privacy Act as amended by the CPRA, other US state privacy laws, and the e-privacy and electronic-marketing rules that apply to us. Our customers and users are based in the United Kingdom, the European Union and EEA, the United States, and worldwide, and this Policy is intended to apply globally with region-specific sections where the law requires them.

Who this applies to. This Policy applies to:

• Visitors to our websites, including app.algominds.ai, app.heyalgo.ai and algominds.ai.
• Users and account holders of Algominds Signals, heyalgo and our other products.
• Customers who buy our managed (done-for-you) outbound, AI SDR, software, or marketing services.
• Prospects and recipients whose business contact data is processed through our platform or campaigns (please read Sections 5 and 10, which explain who is legally responsible for that processing).
• People who contact us, book a meeting with us, or receive marketing from us.

In this Policy, "we", "us" and "our" mean AI Empowerment Ltd, trading as Algominds. "You" and "your" mean the individual or organisation whose personal data we process. "Services" means the products and services described in Section 1.

---

1. Who we are and how to contact us

AI Empowerment Ltd, trading as Algominds, is the company responsible for the Services described in this Policy.

You can reach our privacy contact, Edward Albazii, at [email protected] for any question about this Policy, to exercise your rights, or to raise a concern. For general enquiries, write to [email protected] or to our registered office above.

Our Services. Algominds provides:

1. Algominds Signals (app.algominds.ai), a public, self-serve B2B SaaS platform for AI-driven signal intelligence, prospect sourcing, data enrichment, and AI-written outreach copy. Users sign up themselves (including via Google or Microsoft sign-in), subscribe through Stripe, and connect their own mailboxes and LinkedIn accounts (via Unipile) to run outreach.
2. Managed (done-for-you) outbound, where we run cold email (via Smartlead) and LinkedIn outreach (via HeyReach and Unipile) on behalf of a client, under a Data Processing Agreement.
3. AI Sales Development Representative (AI SDR) tooling, workflow automation, software and web/app development, and digital marketing services.

A note on a statutory contact. We have appointed Edward Albazii as our privacy contact. Where this Policy refers to a "DPO" or "data protection contact", this means our designated privacy contact; this designation does not by itself mean that we are required to appoint a statutory Data Protection Officer under Article 37 of the UK or EU GDPR.

EU representative (Article 27). Because we are established in the United Kingdom and offer Services to, and monitor the behaviour of, individuals in the European Union and EEA, we are within the territorial scope of the EU GDPR under Article 3(2). We recognise that Article 27 of the EU GDPR therefore requires us to appoint a representative in the EU/EEA as a point of contact for EU and EEA data subjects and supervisory authorities. Our EU representative is:

EU representative. We are appointing a representative in the EU/EEA under Article 27 of the EU GDPR and will publish their name and contact details here once the appointment is confirmed. In the meantime, individuals in the EU and EEA can contact us at [email protected] and we will route the request appropriately.

Until that appointment is reflected above, EU and EEA data subjects may contact us directly at [email protected], and we will respond and route your request appropriately.

---

2. Privacy at a glance

This summary is for convenience only and does not replace the full Policy below.

---

3. Key definitions

• Personal data / personal information: any information relating to an identified or identifiable individual. We use both terms interchangeably across the UK/EU and US sections.
• Controller: the party that decides the purposes and means of processing personal data.
• Processor: a party that processes personal data on behalf of, and on the documented instructions of, a controller.
• Joint controllers: two or more parties that together determine the purposes and means of processing.
• Sub-processor: a third party we engage to process personal data on our behalf when we act as a processor.
• Data subject: the individual to whom personal data relates.
• Services: the products and services in Section 1.
• Algominds Signals (or "Signals"): our self-serve B2B SaaS platform at app.algominds.ai.
• Managed campaign: cold email and/or LinkedIn outreach we operate on behalf of a client under a Data Processing Agreement (DPA).
• Prospect / recipient: a business contact who is the target of, or a recipient of, outreach run through the Services.
• Suppression list: a do-not-contact list used to honour opt-outs and objections.
• LIA: a Legitimate Interests Assessment, which documents and balances our (or a customer's) legitimate interests against the rights of individuals.
• DPIA: a Data Protection Impact Assessment, carried out for higher-risk processing.
• DPA: our Data Processing Agreement, which governs our role as a processor and lists our sub-processors.
• UK/EU GDPR: the UK GDPR (read with the Data Protection Act 2018 and the Data (Use and Access) Act 2025) and the EU GDPR (Regulation (EU) 2016/679), read together. Article references are common to both unless we say otherwise.

---

4. The Services and how this Policy fits with our other terms

This Privacy Policy works alongside the following documents, which together govern your relationship with us:

• our Terms of Service, which set out the commercial terms for the Services, including subscription, cancellation, cooling-off, auto-renewal, and refund terms (see Section 17);
• our Acceptable Use Policy (AUP), which sets out what you may and may not do when using the Services to send outreach;
• our Data Processing Agreement (DPA), which governs our role as a processor and contains our sub-processor list and our international-transfer terms; and
• our Cookie Policy and cookie consent tool (see Section 12).

Where there is any conflict between this Policy and the DPA on the question of whether we act as controller or processor, the relevant contract and the analysis in Section 5 govern.

---

5. Our roles: when we are a controller and when we are a processor

Algominds wears two distinct "hats" depending on the activity. Understanding which one applies matters, because it determines who is legally responsible.

We act as a controller for:

• the operation of our websites;
• the Algominds Signals account relationship (sign-up, authentication, settings, in-app activity, and support);
• billing and subscriptions;
• our own B2B marketing, prospect sourcing, and product and website analytics, including our own controller-side prospecting and enrichment of business contacts to market our Services; and
• security, fraud and abuse prevention, suppression-list maintenance, and legal compliance across all activities.

For these activities we decide the purposes and means of processing, and the legal-basis and rights provisions of this Policy apply to us directly.

We act as a processor for:

• the prospect data that a managed-service client instructs us to discover, enrich, write copy about, and send to on their behalf. Here the client is the controller. Our processing is governed by our DPA and limited to the client's documented instructions; and
• the prospect data that a self-serve Signals user chooses to discover, enrich, and send to using their own connected mailbox or LinkedIn account. Here the user is the controller of that prospect data, and we provide the tooling and process on their instruction. The user warrants, in our Terms, AUP, and DPA, that they have a lawful basis for that processing and will honour opt-outs and objections.

Controller warranty. Whether engaging us for a managed campaign or using Signals to send their own outreach, the customer is responsible, as controller, for the prospect data they target, including identifying a lawful basis (such as legitimate interests, supported by a documented assessment, or consent where required by local law), complying with applicable marketing and anti-spam laws, providing any required notice to recipients, and honouring objections and opt-outs.

A note on enrichment and discovery. For certain discovery and enrichment activities, we choose the third-party data sources and the means by which prospect data is gathered. A regulator could view us and the customer as joint controllers for those steps. Where that is the case, our DPA allocates responsibilities between us and the customer, and we remain transparent with affected individuals as described in Sections 7 and 8.

Our own limited-purpose controller role within campaigns. Even when we act as a processor, we remain a controller for our own narrow and independent purposes, namely: maintaining suppression and do-not-contact lists, protecting email and platform deliverability, preventing abuse and securing our systems, billing the client, keeping records to defend legal claims, and improving our Services in a privacy-protective way. Our DPA carves these purposes out.

Stripe, our payment provider, acts as a separate and independent controller for its own payment-processing, fraud-prevention, and regulatory purposes.

---

6. Information we collect

We collect the following categories of personal data. Not every category applies to every person.

6.1 Account and identity data. Your name, business email address, phone number, company, job title or role, and LinkedIn or professional profile. Account identifiers and authentication data, including OAuth identifiers when you sign in with Google or Microsoft. We never receive your third-party passwords; we receive only scoped tokens (see 6.5).

6.2 Billing data. Your billing name, billing email, company and billing address, VAT or tax information, subscription plan and history, and limited card metadata such as the card brand, last four digits, and expiry that Stripe returns to us. We never see or store your full card number; Stripe handles card data directly (see Section 17).

6.3 Content and inputs you submit. Website URLs, text, prompts, search criteria, target definitions, lists, and other data you submit to the Services for processing, including data you ask our AI features to act on (see Section 9). Free-text fields (for example, notes and AI prompts) may contain personal data you choose to include; please do not include special-category or sensitive data (see 6.9).

6.4 Prospect and enrichment data. For prospects and recipients targeted through the Services: business contact data (name, work email, business phone, job title, seniority, employer, and location), LinkedIn or professional profile URLs and public profile data, enrichment attributes (such as company, technology stack, firmographics, and buying signals), AI-generated personalisation, and engagement events (opens, clicks, replies, bounces, and unsubscribes). Some of this data is collected by automated means, including from public web pages and professional profiles and through scraping and discovery providers (see Section 7). Where we process this data as a processor, the customer is the controller (see Section 5).

6.5 Integration and OAuth token data. When you connect a mailbox, a LinkedIn account, or another integration (via Unipile, Zapmail, or a CRM such as Salesforce or HubSpot), we receive scoped OAuth access and refresh tokens, the scopes you granted, and connection metadata, together with the message and contact data that surfaces through the connection so the Services can function. We never receive your account passwords. Tokens are encrypted at rest, used only for the purpose you authorised (such as sending or syncing), revocable by you at any time, and deleted when you disconnect the integration or close your account. Our Unipile-powered connection flow runs under connect.algominds.ai. We comply with the API and limited-use requirements of the providers we connect to, including Google's and Microsoft's API data-use policies.

6.5a Algominds LinkedIn Connector (Chrome extension). If you install our Chrome extension and click "Agree and connect" (or tick the consent box and enter a pairing code), the extension reads the LinkedIn sign-in cookies that keep your session active on linkedin.com (li_at and, where present, li_a), your LinkedIn member ID and public profile link, your browser's user agent, your browser language settings and your time zone. It sends them over an encrypted connection to your Algominds workspace so that we can connect, and keep connected, the LinkedIn account you authorised, and confirm that the same account stays connected. It refreshes them about once an hour and when you sign in to LinkedIn again. It does not read your LinkedIn password, your messages, your posts or your browsing history, and it runs only on linkedin.com. An Algominds dashboard can ask the extension to start a connection, but nothing is read or sent until you agree inside the extension. We store this data encrypted, use it only to operate the LinkedIn connection you authorised, never sell it and never use it for advertising. Revoking the connector from the extension deletes the connector's saved copy of your session and stops these refreshes. It does not disconnect the LinkedIn account from your workspace; disconnect it there (see Section 6.5). Other connection data is kept as described in Section 15. Our use of information received from the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

6.6 Technical and usage data. IP address, device and browser type, operating system, language, referral source, pages and features used, server and security logs, and records of sign-ins to and use of customer workspaces and onboarding (such as the time, IP address, device, and the pages or features opened).

6.7 Cookies and similar technologies. Cookies, pixels, tags, and similar identifiers used for essential, analytics, and marketing purposes (see Section 12).

6.8 Communications and support data. Your correspondence with us, support tickets, in-app messages, survey and form responses, scheduling and booking details (via Cal.com, Calendly, or HubSpot forms), and, where we offer SMS outreach in the US and Canada, mobile numbers, message content, consent and opt-out status, and delivery metadata (via Twilio).

6.9 Special-category and sensitive data. Our Services are designed for B2B use and are not intended to process special-category data under Article 9 of the UK/EU GDPR (such as data revealing health, race, religion, political views, or trade-union membership). We ask that you do not upload or submit such data, or other sensitive information unrelated to the Services, including through free-text fields and AI prompts. We do not knowingly process special-category data. Necessary account credentials, OAuth tokens and connected-account communications may constitute sensitive personal information under US state laws; our handling of that information is described in Sections 6.5, 20, 26 and 27. Because free-text and AI-prompt fields, and public-profile enrichment, can incidentally contain such data, where we become aware that special-category data has incidentally entered the Services we delete it, and we do not use it to infer any characteristic about an individual.

6.10 Agreement and service-delivery records. We may keep records showing what was agreed, authorised and delivered, including the order or statement of work, the checkout page and the applicable Terms version, acceptance timestamps and the acceptance method, payment and renewal notices, the date access to the Services was provided, sign-in and usage records for the customer's workspace or onboarding (Section 6.6), onboarding and approval records, service activity and delivery reports, cancellation requests and confirmations, recordings and transcripts of sales, onboarding and account calls, and relevant correspondence. Where a meeting is recorded or transcribed, we provide appropriate notice and obtain consent where applicable law requires it. We collect these records only where necessary for providing the Services, administering the customer relationship, maintaining accurate records, or resolving a complaint or dispute. We do not collect unrelated mailbox, calendar or CRM content for these purposes. The restrictions in Section 26 apply to all Google API user data, including data derived from it.

---

7. Sources of personal data

Notice to prospects sourced from third parties. Where we obtain prospect personal data from third-party or public sources rather than directly from the individual, and where we act as controller of that data (for example, for our own B2B prospecting), our lawful basis is legitimate interests under Article 6(1)(f), namely marketing our Services to relevant businesses, supported by a documented LIA. This Policy, which is publicly available, is the principal vehicle for the information required by Article 14 of the UK/EU GDPR (the categories of data we hold, the source, the purposes and lawful basis, the recipients, the retention periods, and your rights), and where we contact a prospect directly we also provide or link to this information at or before the first communication, and in any event within one month. Where giving individual notice would involve disproportionate effort, we rely on the exemption in Article 14(5)(b) and make this Policy available instead. You have the right to object at any time, free of charge, to our processing of your data for direct marketing (see Section 19).

---

8. How we use your information and our lawful bases

The table below sets out, for each purpose, the personal data used and our lawful basis under Article 6 of the UK/EU GDPR. Where we act as a processor, we rely on the controller-customer's lawful basis rather than selecting our own.

Where a customer is an organisation, we generally rely on legitimate interests to administer our relationship with its employees and other representatives; Article 6(1)(b) applies only where the relevant individual is a party to the contract and the processing is necessary to perform that contract. The bases in this section do not override the restrictions in Section 26.

Our legitimate interests. Where we rely on legitimate interests, those interests include operating and growing a B2B software business, marketing our Services to other businesses, keeping our platform and our customers' sending reputation secure and deliverable, preventing abuse and fraud, and being able to defend legal claims. We carry out and keep an LIA for these purposes, including for our own B2B prospecting and enrichment, and we balance our interests against your rights and freedoms. Where the law requires a Data Protection Impact Assessment (DPIA) for higher-risk processing (such as large-scale enrichment, profiling, or monitoring), we carry one out. You can ask us for a summary of the relevant LIA, and you can object at any time (see Section 19).

---

9. Artificial intelligence (AI) processing

AI is central to several of our Services. We want to be transparent about how it works.

What we send to AI providers. To generate outreach copy, classify and prioritise prospects, and enrich data, we send relevant content to AI model providers through their application programming interfaces (APIs). We send most of it through OpenRouter, a service that passes each request to a provider that hosts the AI model we have chosen. Most of our AI features use DeepSeek V4.1 Flash, a model developed by DeepSeek and run for us by hosting providers that OpenRouter selects. Other features use models from Z.ai, Moonshot AI, xAI, Alibaba (Qwen), Google, Anthropic, OpenAI and TypeSafe through OpenRouter, and some call OpenAI and Anthropic directly. Where you connect your own OpenAI or Anthropic account to a feature, we send the content to that provider under your account, and your agreement with that provider governs its use. What is sent may include the content and inputs you submit, prospect and enrichment data, and the prompts that drive a feature.

Training of public models. We configure our AI requests so that they go only to providers that, under their terms and the data policies OpenRouter records for them, do not use the content we send to train their general-purpose, public, or foundation models. OpenRouter does not keep the content of our requests. Unless a request is limited to providers that keep no data (as Section 26.2 describes for mailbox content), a provider may retain inputs and outputs for a limited period (generally up to 30 days) to monitor for misuse and to operate its service, after which the content is deleted under its terms, and its staff or automated systems may access flagged content for safety purposes. Where you use your own provider account, its settings and terms apply instead. We select providers and configurations consistent with this no-training position, but these are practices of third parties that we do not control and cannot independently guarantee.

Transfers to AI providers. Because prompts and prospect data may contain personal data, and OpenRouter, OpenAI, Anthropic and most of the hosting providers OpenRouter selects are based in the United States, sending content to them is an international transfer. Some hosting providers are in other countries. We rely on Standard Contractual Clauses with the UK Addendum and, where the provider is certified, the EU-US Data Privacy Framework, as set out in Section 14.

Human oversight. Our AI features are designed as decision-support, to assist people rather than to replace their judgement. AI-generated outreach copy and AI-assisted scoring are reviewable and editable, users configure and can override automated sending, and a human is accountable for each campaign. Some sending is automated once a user has configured and approved a campaign; in those cases a human has set up, reviewed, and approved the campaign even though they do not separately review each individual message before it is sent. You are responsible for reviewing AI-generated content before you rely on it.

No solely-automated significant decisions. We do not use AI to make solely-automated decisions that produce legal effects concerning you, or similarly significant effects, without a lawful basis and appropriate safeguards under Article 22 of the UK/EU GDPR. Lead scoring, classification, and prioritisation are decision-support tools that inform human users; prioritising a business contact for outreach does not by itself produce a legal or similarly significant effect on that individual. See also Section 21.

AI-generated outreach. Outreach copy produced through the Services may be AI-assisted or AI-generated. The sending controller (the managed-service client or the self-serve user) is responsible for any disclosure required in the outreach it sends, including any obligation to indicate that content is AI-generated.

Accuracy. AI outputs can be inaccurate or incomplete and are not professional, legal, or financial advice. We do not promise that AI output is error-free, and you should verify it before relying on it.

EU AI Act transparency. Our current assessment is that the AI features we operate are not high-risk AI systems under the EU AI Act. Where our Services let an individual interact directly with an AI system, or generate synthetic text, image, or audio content, we will provide the transparency required by Article 50 of the EU AI Act (which applies from 2 August 2026), including informing people when they are interacting with an AI system and, where required, marking AI-generated content. Separately, our customers remain responsible, as controllers and senders, for any disclosure obligations that attach to the outreach they send.

---

10. Cold outreach and B2B marketing on behalf of clients

A core part of the Services is enabling B2B outreach. This section explains how we approach it and how responsibility is allocated. Please read it together with Section 5.

Roles. For managed campaigns, the client is the controller and we are the processor under our DPA. For self-serve sending, the user is the controller and we are the processor. In both cases, the controller-customer warrants that it has a lawful basis for the prospect data it targets and that it will comply with applicable laws.

Lawful basis for B2B prospecting. Cold B2B outreach in the UK and EU typically relies on legitimate interests under Article 6(1)(f), supported by a documented LIA, together with compliance with electronic-marketing rules. Legitimate interests must be balanced against the recipient's rights, and recipients always have the right to object.

Opt-out, objection, and suppression. Every recipient has a clear and easy way to object or opt out. We honour objections under Article 21 of the UK/EU GDPR and unsubscribe requests, and we maintain suppression lists as the enforcement layer so that a person who has objected is not contacted again through the Services.

Higher-risk jurisdictions. Marketing and anti-spam rules differ by country, and some, including Germany and other EU member states, treat unsolicited commercial email as high-risk and may require prior consent (for example, under the German Act Against Unfair Competition (UWG)) rather than allowing reliance on legitimate interests alone. We have received a German GDPR/UWG demand of this kind. We therefore operate suppression and restricted-jurisdiction controls and require, through our Terms, AUP, and DPA, that customers ensure they have an appropriate lawful basis (including documented consent where local law requires it) before targeting recipients in such jurisdictions. We may suppress or decline outreach to certain jurisdictions.

If you are a recipient of outreach. If you have received outreach run through our Services and want to opt out, object, or find out who is responsible, contact us at [email protected]. Because the sending customer is usually the controller, we will action your request across the Services (including adding you to suppression so you are not contacted again) and, where appropriate, pass your request to the relevant controller. We will not simply turn you away.

---

11. Marketing communications to you

We send our own marketing only where we are permitted to.

• UK and EU e-privacy (PECR). The "soft opt-in" we rely on applies only to individual subscribers (such as sole traders and some partnerships) whose details we obtained in the course of a sale or negotiations for a sale of our Services, and only for messages about our own similar Services, with an opt-out offered at the point of collection and in every message. We do not rely on the soft opt-in for cold prospecting where there has been no such sale or negotiation; in those cases we rely on consent where the law requires it. For corporate subscribers (such as limited companies and LLPs), PECR does not require consent for marketing email, but we still honour any objection or opt-out and any right to object under the UK/EU GDPR.
• US (CAN-SPAM). Our marketing emails identify us, use accurate headers and subject lines, include our postal address, and offer a working unsubscribe that we honour promptly.
• Canada (CASL). For Canadian recipients we rely on express or valid implied consent, identify ourselves, and include a functioning unsubscribe.
• SMS (US and Canada). Where we offer SMS, the sending customer warrants that it has the consent required for the recipients it targets. In the United States we operate consistently with the Telephone Consumer Protection Act (TCPA), including relying on prior express consent where required, registering sending under the A2P 10DLC framework, observing quiet hours, and offering STOP and HELP keywords. Standard message and data rates may apply, and message frequency varies. In Canada we comply with CASL as above.

You can unsubscribe at any time using the link in our messages or by emailing [email protected]. Opting out of marketing does not stop service or transactional messages necessary to provide the Services.

---

12. Cookies and similar technologies

We use cookies and similar technologies on our websites in three categories:

• Strictly necessary, which are required to run the site and cannot be switched off.
• Analytics, to understand how the site and product are used (for example, Google Analytics, PostHog, and HubSpot analytics).
• Marketing, to support our advertising and measure its effectiveness (for example, HubSpot tracking).

Consent. We obtain your prior consent for non-essential (analytics and marketing) cookies through our cookie consent banner, which lets you accept or reject non-essential cookies and change your choices at any time. We do not set non-essential cookies before you consent, and rejecting is as easy as accepting.

Managing cookies. You can manage cookies through our consent tool and through your browser settings. For Google Analytics, you can also use Google's opt-out browser add-on, and we configure Google Analytics with IP anonymisation. Where we maintain a separate Cookie Policy, it lists the specific cookies we use, their providers, purposes, and durations, and it forms part of this Policy.

We honour recognised browser and device opt-out signals, including the Global Privacy Control (GPC), as described in Section 20.

---

13. How we share and disclose your data

We share personal data with the categories of recipient below. We do not sell your personal information for monetary or other valuable consideration. Some advertising and analytics cookies may, however, count as a "sale" or "share" under California law even when no money changes hands; you can opt out as described in Section 20.

13.1 Sub-processors and service providers, by function. The vendors we currently use include those listed below. When we act as a processor, these are our sub-processors; when we act as a controller, they are our processors or recipients. We maintain an up-to-date sub-processor list as part of our DPA and commit to giving notice of changes; customers can ask to be notified of changes.

We require these providers, by contract, to process personal data only on our instructions (or, where they are independent controllers such as Stripe, in line with their own obligations) and not for their own independent marketing.

13.2 Professional advisers. Lawyers, accountants, auditors, insurers, and similar advisers, where needed and under duties of confidentiality.

13.3 Legal and regulatory. Courts, regulators (including the ICO), law enforcement, and others where we are required by law, or where disclosure is necessary to establish, exercise, or defend legal claims, or to protect our rights, users, or the public.

13.4 Business transfers. If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy and applicable law. We will notify you of any change in control or use of your personal data, as well as any choices you may have.

13.5 Payment complaints and disputes. Where necessary to investigate or respond to a payment complaint, refund request, chargeback or other contractual dispute, we may disclose relevant transaction, agreement, acceptance, cancellation and service-delivery evidence, and relevant customer correspondence, to Stripe or another applicable payment provider, acquiring banks, payment networks, card issuers, and the professional advisers or competent authorities described above. We limit each disclosure to evidence reasonably necessary for the matter, redact unrelated personal data and confidential information where practicable, and use appropriate access and transfer safeguards. These recipients may process the evidence as independent controllers under their own legal duties and privacy notices. Google API user data is not included unless its use and disclosure are permitted under Section 26. This provision does not authorise publication of customer communications or prospect data, and it does not remove any right to raise a legitimate payment dispute or exercise a statutory right.

We do not disclose your personal data to third parties for those third parties' own independent direct marketing.

---

14. International data transfers

We are based in the United Kingdom and work with providers in the United States, the European Union and EEA, and elsewhere, so your personal data may be transferred internationally, primarily to providers in the US and EU.

When we transfer personal data out of the UK or the EEA to a country that is not covered by a UK adequacy regulation or an EU adequacy decision, we use an appropriate safeguard, which may include:

In short, for our US-based providers we rely on the EU-US DPF and UK Extension only where the specific provider is certified, and on Standard Contractual Clauses with the UK Addendum (or the UK IDTA) otherwise. You can ask us for more information about, or a copy of, the safeguards that apply to a particular transfer by emailing [email protected].

---

15. How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this Policy, after which we delete or anonymise it. The periods below are our general approach; where we act as a processor, retention follows the controller-customer's instructions and our DPA.

---

16. Security

We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, encryption of OAuth tokens at rest, access controls and the principle of least privilege, network and application security controls, monitoring and intrusion detection, and vendor due diligence on our sub-processors. No system can be guaranteed to be perfectly secure, but we work to protect personal data and to improve our controls over time. We require our sub-processors to maintain appropriate security as well.

---

17. Payments and subscriptions

Payments and subscriptions are processed by Stripe, a PCI-DSS Level 1 certified payment provider. Stripe collects and processes your card data directly. Algominds never sees or stores your full card number. We receive only limited card metadata (such as the card brand, last four digits, and expiry) and transaction records needed to manage your subscription and meet our tax and accounting obligations. Stripe acts as a separate controller for its own payment, fraud-prevention, and regulatory purposes.

We may retain and disclose necessary payment and service-delivery evidence to investigate billing concerns and respond to payment disputes as described in Sections 6.10, 8, 13.5 and 15. Our Privacy Policy provides information about data processing; it does not waive payment-network, cardholder or statutory rights.

Information about cancellation, the 14-day cooling-off right and digital-content waiver for consumers, auto-renewal reminders, easy cancellation, and refunds (including under the UK Consumer Contracts Regulations 2013, the Consumer Rights Act 2015, and the Digital Markets, Competition and Consumers Act 2024) is set out in our Terms of Service, which govern your subscription. Those terms distinguish between consumers and business customers; nothing in this Policy or our Terms removes the statutory rights that consumers cannot contract out of.

---

18. Data breach notification

We maintain procedures to detect, investigate, and respond to personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO (or other competent supervisory authority) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to individuals, we will also notify the affected individuals without undue delay. Where we act as a processor, we will notify the relevant controller-customer without undue delay so they can meet their own obligations.

---

19. Your data protection rights (UK and EU/EEA)

Subject to the conditions and exceptions in applicable law, you have the following rights over your personal data where we act as controller:

• Access: to be told whether we process your data and to receive a copy.
• Rectification: to have inaccurate data corrected and incomplete data completed.
• Erasure: to have your data deleted in certain circumstances ("right to be forgotten").
• Restriction: to limit how we use your data in certain circumstances.
• Portability: to receive certain data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Objection to direct marketing: to object at any time to processing for direct marketing, which we will always honour.
• Objection to other legitimate-interests processing: to object on grounds relating to your particular situation, which we will honour unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defence of legal claims.
• Withdraw consent: to withdraw consent at any time where we rely on it, without affecting prior processing.
• Rights in relation to automated decision-making: see Section 21.

How to exercise your rights. Email [email protected] or [email protected]. We may need to verify your identity, or ask you to clarify your request; where we reasonably do so, the response time begins (or pauses) until we receive what we need. We will respond within one month, which we can extend by two further months for complex or numerous requests, and we will tell you if we do. We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline, as permitted by law.

Where we act as a processor, please direct your request to the relevant controller-customer; we will assist them in responding. As explained in Section 10, even where we act as a processor we will action requests (such as suppression) across the Services and route your request to the controller, rather than simply turning you away.

Complaints to us. If you are unhappy with how we handle your personal data, please contact us first at [email protected]. We will acknowledge your complaint and aim to respond substantively within 30 days.

Complaints to a regulator. You also have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO), ico.org.uk, helpline 0303 123 1113. In the EU/EEA, you may complain to the supervisory authority in your country of residence, place of work, or where the issue arose. We would, however, appreciate the chance to address your concerns first.

---

20. United States state privacy rights

This Section applies to residents of US states with applicable privacy laws. It supplements the rest of this Policy. This Policy, together with any notice given at the point of collection, serves as our notice at collection under California law and is provided at or before the point at which we collect personal information.

20.1 California (CCPA, as amended by the CPRA)

Categories of personal information, sources, purposes, sharing, and retention. In the 12 months before the date of this Policy (see "Last updated" above), we have collected and disclosed for a business purpose the following CCPA categories of personal information. We have not sold or shared (for cross-context behavioural advertising) any category in that period, except that certain advertising and analytics cookies may constitute a "sale" or "share" as explained below.

Sources and purposes. We collect these categories from the sources in Section 7 and use them for the purposes in Section 8. We disclose them to the service providers and recipients in Section 13.

We do not sell or share your personal information. We do not sell personal information for monetary or other valuable consideration. Certain advertising and analytics cookies may, however, be treated as a "sale" or a "share" (for cross-context behavioural advertising) under the CPRA even when no money changes hands. You can opt out of any such "sale" or "share":

• by using our cookie consent tool and any "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link we provide; and
• by enabling the Global Privacy Control (GPC), which we treat as a valid opt-out signal at the browser or device level. Because GPC is browser- or device-specific, signed-in users should also set their preference in their account or cookie settings so it applies across their devices.

Sensitive personal information. We use the limited sensitive personal information we collect (such as log-in credentials, tokens, and the contents of connected-account communications) only to provide the Services you have requested and for purposes for which the CPRA does not require us to offer a right to limit, and we do not use or disclose it to infer characteristics about you. Because we use it only for these permitted purposes, the CPRA "right to limit the use of sensitive personal information" does not apply; we will nonetheless honour a limitation request where it is feasible to do so. You can reach us via any "Limit the Use of My Sensitive Personal Information" link we provide or at [email protected].

Your California rights. Subject to the law, you have the right to know and access your personal information, to delete it, to correct it, to opt out of sale or sharing, and to limit the use of sensitive personal information. You also have the right not to receive discriminatory treatment for exercising these rights: we will not deny you Services, charge you a different price, or provide a different level or quality of Service because you exercised your rights.

How to exercise. Email [email protected] or [email protected], or use any "Do Not Sell or Share My Personal Information", "Your Privacy Choices", or "Limit the Use of My Sensitive Personal Information" link we provide. We will verify your request and respond within 45 days, extendable by a further 45 days where permitted. You may use an authorised agent to submit a request; we may ask the agent for proof of authorisation (such as a signed permission or power of attorney) and may ask you to verify your identity directly.

Service providers and contractors. We require our service providers and contractors, by contract, not to use personal information for their own purposes, consistent with the CPRA. This includes the configurations described in Section 9 under which our AI providers do not use the content we send them to train their public or foundation models.

Shine the Light. Under California Civil Code section 1798.83, California residents may request information about disclosures of personal information to third parties for those third parties' own direct marketing. We do not disclose personal information to third parties for their own direct marketing.

20.2 Other US states

If you reside in a state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Maryland, Minnesota, Indiana, Kentucky, Rhode Island, and other states as their laws take effect), you have, subject to that law, the rights to: access, correct, delete, and obtain a portable copy of your personal data; and to opt out of (a) targeted advertising, (b) the sale of personal data, and (c) profiling in furtherance of decisions that produce legal or similarly significant effects. The specific rights available depend on your state's law; some states (for example, Utah and Iowa) provide a narrower set and may not include correction or appeal rights.

• Universal opt-out. We treat the Global Privacy Control (GPC) as a valid request to opt out of sale, sharing, and targeted advertising, and we honour it for browsers and devices where it is detected, in every state that recognises a universal opt-out mechanism.
• Targeted advertising and profiling opt-out. You can opt out of targeted advertising or profiling by using our cookie consent tool, enabling GPC, or emailing [email protected]. Because our profiling is decision-support reviewed by humans and does not produce legal or similarly significant effects (see Section 21), a state profiling opt-out generally does not apply to it; you may still contact us to object.
• Sensitive data. Where a state requires opt-in consent (or an opt-out) before processing sensitive data, we obtain consent or provide the opt-out, as applicable. Our Services are not designed to process sensitive data, and we honour stricter data-minimisation requirements (such as Maryland's) where they apply.
• Appeals. If we deny your request, you may appeal by replying to our decision or emailing [email protected]. We will respond to your appeal within the time your state's law requires (generally within 60 days, or 45 days in some states), and if we still deny your request we will tell you how to contact your state Attorney General.

To exercise any of these rights, email [email protected] or [email protected]. We will verify and respond within the timeframe your state's law requires (generally 45 days).

---

21. Automated decision-making and profiling

We use enrichment, lead scoring, and AI-assisted classification to help prioritise and personalise prospect outreach. This is profiling under Article 4(4) of the UK/EU GDPR, but it is used as decision-support for human users, not to make solely-automated decisions that produce legal or similarly significant effects about an individual without a lawful basis and safeguards under Article 22. This is because prioritising or personalising outreach to a business contact does not, in itself, produce a legal or similarly significant effect on that person. A human configures, reviews, and is accountable for each campaign before outreach is sent. Where US state law gives you the right to opt out of profiling that has legal or similarly significant effects, you may do so as described in Section 20. If you have questions about our use of profiling, contact [email protected].

---

22. Children

Our Services are B2B and are not directed to children. You must be at least 18 years old, or older if the age of majority where you live is higher, to hold an account or enter into a contract for the Services. We do not knowingly collect personal data from children through account registration. If you believe a child has provided personal data to us, contact [email protected] so we can investigate and take appropriate steps to delete it, subject to any retention required by applicable law.

---

23. Third-party links and services

Our websites and Services may link to, or integrate with, third-party websites and services (such as your connected mailbox, LinkedIn, your CRM, scheduling tools, and our providers). We are not responsible for the privacy practices of third parties, and their handling of your data is governed by their own privacy policies. Please review them before using those services.

---

24. Changes to this Policy

We may update this Policy from time to time to reflect changes in our Services, our providers, or the law. When we make changes that materially affect your rights or the processing you signed up to, we will give you advance notice by email or through the Services before the change takes effect, and we will update the "Last updated" date above. Where a change requires your consent, we will obtain your fresh consent rather than relying on your continued use. For minor or clarifying changes, the updated Policy applies once published. Please review this Policy periodically.

---

25. How to contact us and complain

For any privacy question, to exercise your rights, or to raise a concern, contact our privacy contact:

Edward Albazii, [email protected] General enquiries: [email protected] AI Empowerment Ltd (trading as Algominds), 124 City Road, London, United Kingdom, EC1V 2NX Company number 15515185. ICO registration reference ZC082052.

If you are in the EU or EEA, you may also contact our EU representative (see Section 1). We will acknowledge any complaint you raise with us and aim to respond substantively within 30 days. You always have the right to complain to your data protection regulator, including the UK ICO at ico.org.uk, or, in the EU/EEA, the supervisory authority in your country of residence, place of work, or where the issue arose, but we would welcome the chance to resolve your concern first.

---

26. Google user data and Limited Use

26.1 What we ask for and why. When you connect a Google account, Algominds asks only for the access the features need:

• Gmail, read only (gmail.readonly, shown as "View your email messages and settings"), to find the replies to the outreach you send through Algominds and show them to you. We read message headers and the short preview to find those replies. Once a message is matched as a reply to, or a bounce of, an email you sent through Algominds, we read its text to record the reply and to write a suggested reply.
• Gmail, send (gmail.send, shown as "Send email on your behalf"), to send your outreach campaigns, their follow-ups and replies to prospects from your own address, in the same conversation.
• Google Calendar (calendar.events.owned, shown as "See, create, change and delete events on Google Calendars that you own"), to create the meetings you book through Algominds on your calendar with a Google Meet link, and to read back that event's link. We change only events Algominds created. We also read the events on your calendar every 15 minutes to find the meetings your prospects book with you, and we keep only the events that include a prospect you contacted through Algominds.

26.2 AI processing. To write a suggested reply, we send the conversation being answered to our AI model provider through OpenRouter. For Google API user data, our requests require providers that do not collect the data and endpoints with a zero data retention policy, and explicitly exclude the DeepSeek serving provider. These restrictions apply to fallback routing too; a request with no eligible endpoint fails rather than relaxing them. Selecting a DeepSeek model hosted by an independent provider is different from sending data to DeepSeek's own API. We do not send Google API user data to DeepSeek's own API, and we do not use Google user data to develop, improve or train generalised artificial intelligence or machine-learning models.

26.3 Limited Use. Algominds' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We transfer Google API user data only where permitted by Google's Limited Use requirements: to provide or improve appropriate, visible user-facing features with the user's consent; for necessary security purposes; to comply with applicable law; or as part of a merger, acquisition or sale of assets after obtaining the user's explicit prior consent. We do not treat a billing dispute, a general contractual clause or this Privacy Policy as blanket permission to disclose Google API user data. These restrictions also apply to data aggregated, anonymised or derived from Google API user data.
• We do not use Google user data for advertising.
• We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine-learning models.
• Our staff read Google user data only where the person who connected the account agreed, while connecting, to let them read it; where reading it is necessary for security purposes, such as investigating abuse, or to comply with applicable law; or where aggregated data is used for internal operations in accordance with Google's policy and applicable law. When you connect a mailbox for a managed client, we ask you, while connecting, to agree that our staff may read and answer the replies to your campaigns in that mailbox, and see the meetings your prospects book on that calendar. We record that agreement.

26.4 Storage and disconnecting. Google tokens are encrypted at rest and used only for the features in 26.1. When you disconnect a Google connection inside Algominds, we delete its stored tokens. When no other Algominds connection uses that Google account, we also revoke our access at Google. You can remove all of Algominds' access at any time at https://myaccount.google.com/permissions.

26.5 heyalgo. heyalgo (app.heyalgo.ai) is our AI sales agent. When you use it with a Google account:

• Creating a HeyAlgo account with Google asks for your name, email address and profile picture, lasting Gmail access to read and send mail, and the Calendar permissions below. Your work mailbox and Calendar access connect when you create the account.
• Gmail access (gmail.readonly and gmail.send) lets HeyAlgo send your outreach, follow-ups and replies from your address, show and sort replies, suggest replies, and run the automations you build. You can also connect or reconnect a mailbox in Settings or a chat.
• Google Calendar access uses calendar.events.owned to create and read back meetings on calendars you own, calendar.freebusy to check availability, and calendar.calendars.readonly to read the calendar's name, time zone and supported meeting-link types. HeyAlgo uses your primary calendar. When you explicitly enable reply handling and booking for a campaign, it can offer available times and create an invitation after the prospect accepts an offered time. It reads back the created event to confirm the booking and may include Google Meet when supported.
• What HeyAlgo reads. For ongoing mailbox sync, HeyAlgo reads the headers of messages received or sent since you connected the mailbox, excluding spam, trash and drafts. It reads a full message when it is a reply in a HeyAlgo conversation, comes from or goes to a person in your workspace's records, or may be a bounce. It keeps nothing of the rest. Separately, to learn your writing style when you connect or ask it to learn again, HeyAlgo checks headers of recent sent emails for conversation starters you wrote to external addresses and reads candidate messages in full. It excludes replies and HeyAlgo-sent messages from learning. An AI model selects the outbound business emails from the candidates. HeyAlgo keeps the learned style rather than the source emails. When heyalgo cannot tell whether an email it sent went out, it reads your sent mail to that person from the ten minutes after the send to find it, and keeps only that email's identifiers.
• AI processing. heyalgo sends mail text to its AI models only through providers that keep none of it after the request and do not train on it. Section 26.2's last sentence and Section 26.3 apply to heyalgo in full.
• Tools you connect. An automation you build that runs on a reply can pass the reply's text to a tool you connected to that automation, through our integrations provider, Composio (see 13.1).
• Who can see it. The member who connected the mailbox and the workspace's owners and admins.
• Storage and disconnecting. Tokens are encrypted at rest. heyalgo keeps the replies, and the emails you sent outside heyalgo, that it stored while the mailbox stays connected. When you disconnect the mailbox in heyalgo, or leave the workspace, heyalgo deletes them, with the copies of their text in its event log and automation history, deletes the stored tokens and revokes its access at Google. The emails heyalgo sent stay in the workspace's history.

26.6 No email warming of Google accounts. Algominds and heyalgo do not warm up, or offer to warm up, any Google account that you connect to them. Neither product uses a connected Google account, Gmail data or the Gmail API to send, open, reply to, label or move messages in order to warm up a mailbox or to create engagement.

26.7 Explicit prior recipient consent for Gmail. Users are prohibited from sending commercial or marketing emails through a connected Google account to any contact who has not given explicit, prior opt-in consent to receive those emails. This restriction applies to both Algominds and heyalgo. Contacts sourced from public web data, enrichment tools, purchased lists or third-party databases cannot be emailed through the Gmail integration without verified prior opt-in consent. Finding an address, verifying its deliverability, a public listing or a business role is not consent. Users must hold evidence of that consent and record it in the application before sending; research, enrichment and imports do not create consent. The application checks recorded recipient permission before sending commercial or marketing email through Gmail.

---

27. Microsoft 365 mailbox and calendar data

When you connect a Microsoft 365 account, Algominds asks for these permissions: read and write mail (Mail.ReadWrite), send mail (Mail.Send), read and write calendars (Calendars.ReadWrite), and read your profile (User.Read). We use them to send your outreach campaigns, their follow-ups and replies to prospects from your own address, to show you the replies, and to create the meetings you book through Algominds on your calendar with a Teams link. Section 26.2 applies to AI processing of your mail in the same way. Tokens are encrypted at rest. When you disconnect inside Algominds, we delete the stored tokens and stop receiving mail notifications; you can also remove access at https://myapps.microsoft.com. HeyAlgo connects your Outlook mailbox and Calendar access when you sign up with Microsoft. It asks to read and write mail (Mail.ReadWrite), send mail (Mail.Send), read and write calendars (Calendars.ReadWrite), read your profile (User.Read) and maintain offline access. It reads each new message in full and keeps only the mail described in Section 26.5.

For writing-style learning, it reads recent sent messages in full, selects self-authored external conversation starters that an AI model classifies as outbound business emails, and keeps the learned style. Disconnecting the mailbox in heyalgo deletes its stored mail as 26.5 describes.