Privacy Policy

1. Who We Are

The entity responsible for your information is impactXtech, based in the Commonwealth of Virginia, United States. You can reach us at hello@orgsignals.ai.

2. Information We Collect

2.1 Information you provide to us

• Account information: name, business email, company name, job title, and login credentials when you register.
• Billing information: billing name and payment details. Payment card data is processed by our third-party payment processor, and we do not store full card numbers.
• Workspace and configuration data: target account lists, ideal-customer-profile inputs, scoring rules, team assignments, and other settings you create.
• Communications: messages, support requests, survey responses, and feedback you send to us.

2.2 Information we collect automatically

• Usage data: pages and features viewed, searches and filters run, accounts tracked and activated, and actions taken within the Service.
• Device and log data: IP address, browser type, operating system, device identifiers, referring URLs, and timestamps.
• Cookies and similar technologies: see the "Cookies and Tracking" section below.

2.3 Information we obtain from third parties and public sources

To generate signals, briefs, and buyer maps, we collect and compile information about organizations and the professionals associated with them from sources that may include:

• publicly available sources such as company websites, news, press releases, regulatory filings, and public professional profiles;
• third-party data providers and licensed datasets;
• our integration partners and the systems you connect (for example, CRM data you choose to sync); and
• enrichment and verification vendors used to confirm contact accuracy.

This third-party information may include personal data about individuals who are not our users. See Section 4.

3. How We Use Information

We use information to:

• provide, operate, and maintain the Service, including generating account briefs, signals, predictions, and verified contacts;
• create and manage accounts, process subscriptions and activations, and handle billing;
• personalize and improve the Service, develop new features, and train and refine our signal and scoring models;
• communicate with you about your account, transactions, security, and product updates;
• provide customer support;
• monitor for, prevent, and address fraud, abuse, security incidents, and violations of our Terms;
• comply with legal obligations and enforce our agreements; and
• conduct analytics and research to understand how the Service is used.

We do not use the personal data of business contacts to serve them advertising, and we do not knowingly use it for any purpose incompatible with the legitimate business-to-business prospecting purpose for which it is provided.

4. Information About Business Contacts

This section applies to individuals whose professional information appears in our Service (for example, as a decision-maker or buyer contact at a tracked account).

What we process. Business-context personal data such as name, job title, employer, professional contact details (for example, work email and business phone), professional history, and inferences about role, seniority, and likely involvement in purchasing decisions. We focus on professional, business-related information and do not seek to compile sensitive personal data about these individuals.

Where it comes from. Public sources, licensed data providers, enrichment vendors, and information our customers contribute, as described in Section 2.3.

Why we process it. We process this data to provide a business-to-business sales-intelligence service to our customers. Where we rely on legitimate interests as our legal basis (see Section 5), our legitimate interest is enabling lawful B2B outreach and account planning, balanced against the rights and expectations of the individuals concerned.

Your rights. You may request access to, correction of, or deletion of the information we hold about you, and you may object to our processing or ask us to suppress your information so it is not surfaced in the Service. To do so, contact hello@orgsignals.ai. We will honor valid requests as required by applicable law and will maintain a suppression record to prevent re-collection where feasible.

Important note on use by our customers. Our customers are independently responsible for how they use contact information they obtain through the Service, including compliance with applicable marketing, anti-spam, and data-protection laws. We require this of them in our Terms, but we do not control their outreach.

5. Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Contract: to provide the Service to users and customers and to administer their accounts.
• Legitimate interests: to operate, secure, and improve the Service; to compile and provide B2B account and contact intelligence; and to conduct analytics. We balance these interests against individuals' rights and have assessed that B2B contact processing is within reasonable expectations for a professional context.
• Consent: where required, for example for certain cookies or marketing communications. You may withdraw consent at any time.
• Legal obligation: to comply with applicable laws and respond to lawful requests.

6. How We Disclose Information

We disclose information in the following circumstances:

• Service providers and processors: vendors that host our infrastructure, process payments, deliver email, provide analytics, and support customer service, under contracts that limit their use of the information.
• Our customers: by design, account briefs and buyer maps are made available to the customer who activates the relevant account.
• Integration partners: where you connect third-party systems (for example, your CRM), we exchange data with those systems at your direction.
• Legal and safety: to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, property, or safety of impactXtech, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to the protections in this Policy.

We do not sell the personal data of our users for money. Because we make business-contact data available to customers, certain disclosures may be treated as a "sale" or "sharing" under some U.S. state privacy laws. See Section 11.

7. Cookies and Tracking

We use cookies and similar technologies to keep you logged in, remember preferences, measure usage, and improve the Service. We use:

• Strictly necessary cookies for core functionality;
• Analytics cookies to understand usage; and
• Functional cookies to remember settings.

You can control cookies through your browser settings and, where we offer one, our cookie banner.

8. Data Retention

We retain personal data for as long as needed to provide the Service and for the purposes described in this Policy, then delete or anonymize it. Account and billing records are kept for the life of the account and for a reasonable period afterward to meet legal, tax, and accounting requirements. Business-contact data is retained while it remains relevant to the Service and is refreshed or removed as sources change or upon a valid suppression request.

9. Data Security

We maintain administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Data Transfers

We operate from the United States and may process information in other countries. Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may request information about these safeguards by contacting hello@orgsignals.ai.

11. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• restrict or object to processing;
• data portability;
• withdraw consent where processing is based on consent; and
• opt out of the "sale" or "sharing" of personal data and of certain targeted advertising and profiling.

EEA and UK residents have the rights above under the GDPR and UK GDPR and may lodge a complaint with their local supervisory authority.

California residents (CCPA/CPRA). You have the right to know, delete, correct, and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising these rights. To the extent we make business-contact data available to customers, we treat this as "sharing" or a "sale" under California law. You may opt out by emailing hello@orgsignals.ai.

Other U.S. states. Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, and others) have comparable rights, which you may exercise as described below.

How to exercise your rights. Email hello@orgsignals.ai with your request. We will verify your identity where required and respond within the timeframes set by applicable law. You may use an authorized agent where the law permits.

12. Children's Privacy

The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact hello@orgsignals.ai and we will delete it.

13. Third-Party Links and Services

The Service may link to or integrate with third-party websites and services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their policies.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, where required, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance.

15. Contact Us

Questions, requests, or complaints about this Policy or our data practices can be sent to: