Privacy Policy

1. Who is responsible

ProperIntro is the controller of personal data described here, except where we process Customer Content on a customer’s behalf, in which case the customer is the controller and we are its processor (see our Data Processing Addendum).

2. What we collect

• Account data: name, work email, password (stored hashed by our authentication provider), workspace name, role, and how you describe your work.
• Billing data: plan and subscription status. Card details are handled by our payment processor; we never see or store full card numbers.
• Usage and security data: sign-in events, audit logs of sensitive actions (reveals, sends, plan changes), IP address and device information for security and rate limiting, and error logs.
• Customer Content: lists, notes, relationships, campaigns, messages, coverage and imports you add, including personal data about your contacts.
• Email delivery data: delivery, bounce, complaint, unsubscribe and reply events, and a short snippet of replies to your campaigns.
• Mailbox connections (optional): if you connect Gmail or Outlook, an encrypted permission token and the connected address. We do not read your inbox except to check for replies to campaigns you sent, and only where you grant that permission.
• Directory data about people: professional name, role, outlet, topics covered, links to published work, city and country, pitch preferences, and a work email address where public or provided, with its source and verification status. We do not collect personal social media accounts, home addresses, or sensitive categories of data.
• Communications: messages you send us and your responses to confirmation emails.

3. How we use personal data

• To provide, secure, support and improve the Service and to carry out your instructions.
• To process payments and enforce plan limits.
• To keep the directory accurate: confirming details with the people listed and with outlets, and learning from delivery results.
• To prevent abuse and fraud, honor opt-outs and do-not-contact requests, and meet legal obligations.
• To communicate with you about the Service, security and billing, and, where permitted, about product updates (you can opt out of non-essential email).
• To produce aggregate business metrics that do not identify individuals.

4. Legal bases (EEA, UK and similar regions)

• Contract: to provide the Service to customers.
• Legitimate interests: operating a professional directory that helps communications professionals reach relevant media contacts, keeping it accurate, securing the Service and preventing abuse. We balance these interests against individuals’ rights, minimize the data we hold, and give listed people easy ways to correct, restrict or remove their record.
• Consent: where required, such as optional integrations you enable. You can withdraw consent at any time.
• Legal obligation: such as tax, accounting and responding to lawful requests.

5. People listed in the directory

If you are a journalist, editor, producer, host or other media professional and appear in the directory, you can see, correct, restrict or delete your record at any time. Claim your listing at /me, use the privacy form at /remove, or contact us. When you ask us to remove you, we confirm and complete the request within 30 days and keep a minimal suppression entry so you are not added again. Your address is masked from customers by default; revealing it is limited, logged and blocked entirely if you opt out.

6. How we share personal data

• Customers: directory data is shown to customers as described above. Customer Content is private to its workspace and never shown to other customers.
• Service providers (subprocessors) that help us run the Service, listed on our Subprocessors page, under written terms that require them to protect it.
• Mailbox and chat providers you connect.
• Professional advisers, and authorities where required by law or to protect rights, safety and security.
• A successor in a merger, acquisition or sale of assets, with notice to you.
• We do not sell personal data and do not share it for cross-context behavioral advertising.

7. International transfers

We and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and the UK Addendum, and the Data Processing Addendum covers customer data.

8. Retention

• Account and workspace data: while your account is active, then deleted or anonymized within 90 days of closure unless law requires longer.
• Customer Content: deleted within 90 days of workspace closure; backups roll off on their normal cycle.
• Audit and security logs: up to 24 months.
• Billing records: as required by tax and accounting law.
• Directory records: kept while accurate and useful; deleted on valid request, leaving only a minimal suppression entry.
• Delivery events and reply snippets: up to 24 months.

9. Security

We protect personal data with encryption in transit and for contact values at rest, strict access controls and row-level isolation between workspaces, multi-factor authentication for staff, audited access, and limits on reveals. See our security page. No method is perfectly secure; we will notify affected parties and regulators of a breach as the law requires.

10. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict, object to or port your personal data, and to withdraw consent. You also have the right to complain to your data protection authority. To exercise a right, contact us or use /remove or /me. We may need to verify your identity, and we will respond within the time the law requires (generally 30 days).

11. California and other US states

We collect the categories of personal information listed above for the business purposes described. We do not sell or share personal information as those terms are defined by the CCPA/CPRA and similar state laws, and we do not use or disclose sensitive personal information to infer characteristics. California residents and residents of other states with similar laws may request access, correction, deletion and portability, and may opt out of sale or sharing (which we do not do). You will not be discriminated against for exercising these rights. An authorized agent may submit a request on your behalf.

12. Children

The Service is for business use by adults. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.

13. Cookies

We use only the essential cookies needed to sign you in and remember interface preferences, and do not use advertising or cross-site tracking cookies. See the Cookie Policy.

14. Automated decisions

Search ranking and suggestions are generated by deterministic scoring and AI-assisted features to help you decide. We do not make decisions that produce legal or similarly significant effects on individuals solely by automated means.

15. Changes

We will post updates here with a new date and, for material changes, notify customers by email or in the product.

16. Contact

Use the privacy request form at /remove. If you are in the EEA or UK and are unsatisfied with our response, you may contact your local supervisory authority.