Privacy Policy

Last updated 22 September 2026

This policy covers the Enriclio platform — the application you sign into. It explains what the platform holds, why, and how to get it removed. The website that sells Enriclio has its own policy at https://enriclio.com/privacy.

1. Who is responsible

Enriclio, [postal address not set - Settings > Sender identity]. Data protection contact: privacy@enriclio.com. Full registered details are on the Imprint.

There are two distinct roles here, and the difference matters:

• Your account (name, company, email, password hash, session records) — we are the controller.
• The business contact data in your workspace — you are the controller and we act as your processor. You decide who is contacted and why; we provide the machinery and follow your instructions.

2. What the platform stores

• Account: name, company, email address, a bcrypt hash of your password, your plan, and your session tokens.
• Workspace data: the businesses and business contacts the generator discovers for you — company name, website, industry, country, region, a business email address and, where published, a decision-maker’s name, role and public social profile.
• Outreach records: the emails you send, their delivery status, and whether they were opened, clicked, replied to or bounced.
• Suppression list: addresses that unsubscribed or bounced. This one is kept on purpose even after other data is deleted — forgetting an opt-out would mean contacting that person again.

What it does not store. No analytics, no session recording, no keystroke logging, no advertising identifiers. No date of birth, no home address, no payment card data. No special-category data (health, beliefs, politics, biometrics) is sought or wanted; if any reaches the system through a scraped page it is deleted on discovery.

3. Where lead data comes from, and the legal basis

The generator reads publicly accessible sources — company websites, public business directories, public social profiles and domain registration records — to find businesses and the people who publicly represent them in a professional capacity. It does not buy consumer lists and does not target private individuals.

The basis for processing that data is legitimate interest (GDPR Art. 6(1)(f)) in B2B communication, balanced against the individual’s rights. That balance is why the platform: contacts people only in their professional role at their work address; identifies the sender and its postal address in every message; carries a one-click opt-out in every message; and honours an opt-out permanently and across every list in the system.

Where a recipient is in a jurisdiction that requires prior consent for electronic marketing to their category of address, obtaining it is the account holder’s responsibility under the Terms.

4. Notifying the people in your lists

Because their data was not collected from them directly, GDPR Art. 14 requires that they be told who holds it and why. The first email each contact receives serves that purpose: it names the sender, gives the sender’s postal address, explains the reason for the contact, and links to a working opt-out. Anyone can also write to privacy@enriclio.com to ask what is held about them or to have it erased — see Delete my data.

5. Processors we use

• Hosting — the server this platform runs on.
• Your own SMTP/IMAP provider — you connect your own mailbox; we never send through a shared pool, and your provider sees your mail under your own agreement with them.
• Search and enrichment providers — the web-search backend you configure, and optional enrichment services, which receive the company or person being looked up.
• The language model backend you configure — receives page text for extraction and drafting. Configure a provider you are willing to send business data to; the platform does not pick one for you.
• Make.com — only if you connect it.

Each is used to deliver the service, under contract, and none is permitted to use your data for their own purposes. Some operate outside the EEA; transfers rely on Standard Contractual Clauses or an adequacy decision.

6. Retention

• Account data: while the account is open, then deleted on request or within 90 days of closure.
• Workspace and outreach data: until you delete it, or the account closes.
• Suppression entries: kept indefinitely, because their whole purpose is to prevent future contact.
• Server access logs: 30 days.

7. Security

HTTPS in transit, bcrypt password hashing, httpOnly session cookies, per-account tenant isolation so one client can never read another’s leads, and role-gated admin access. No system is perfect; we report a breach that puts rights at risk to the supervisory authority within 72 hours and to affected people without undue delay.

8. Your rights

Access, rectification, erasure, restriction, portability and objection. Email privacy@enriclio.com or use the deletion form. We answer within 30 days and never charge for it. You may also complain to your local data protection authority.

9. Children

The platform is a paid business tool, is not directed at children, and is not available to anyone under 18. We do not knowingly hold a child’s data. If a child’s data reaches the system by any route, it is deleted on discovery without a request being needed. Parents and guardians can write to privacy@enriclio.com.

10. Cookies

One session cookie, nothing else. See the Cookie Policy.