Privacy Policy

Data we collect about account holders

• Identity: name, work email, job title, phone number, and profile photo if provided.
• Authentication: a hashed password, two-factor secrets if enabled, and session records including IP address and user agent.
• Organisation: the workspace you belong to, your role, and your permissions.
• Usage: pages visited, features used, and audit records of actions that change data.
• Billing: plan, subscription status, and invoices. Card details are handled by our payment provider and never reach our servers.

Data our customers store about their prospects

Customers collect business contact data — company name, website, business address, publicly listed business email and phone, job title, and public social profile links — from public sources such as business directories, OpenStreetMap, company websites, and optional third-party enrichment providers the customer connects. Customers may also import their own lists and record notes, call outcomes, and message history against a contact.

• We do not sell this data, and we do not use one customer's data to enrich another's.
• We do not build a shared people database across customers.
• Customers are responsible for having a lawful basis for their outreach and for honouring objections.

Why we process it

• To provide the service: storing records, sending the messages a customer composes, and showing analytics.
• To keep the service secure: rate limiting, audit logging, fraud and abuse prevention.
• To support customers: diagnosing problems they report.
• To meet legal obligations: tax records, and responding to lawful requests.
• Our lawful bases are performance of a contract, our legitimate interest in operating and securing the service, and consent where required.

AI processing

Warm Deals uses third-party language models to draft messages, score leads, and summarise conversations. When a customer asks for a draft, the relevant record and conversation context is sent to the model provider to generate it.

• Providers used: Anthropic, OpenAI, and DeepSeek, depending on the task.
• We use these providers' API tiers, which do not train their models on submitted content.
• AI output is a draft. A person reviews and sends it — nothing is delivered to a prospect without a user's action or an automation the customer configured.

Sharing

We share data with the sub-processors listed on our Sub-Processors page, each under a data processing agreement. Optional providers — CRMs, enrichment services, messaging providers — receive data only if the customer connects them. We also disclose data where legally compelled, and to a successor in the event of a merger or acquisition, in which case we will give notice.

International transfers

Our infrastructure runs in Germany. Some sub-processors are in the United States; those transfers rely on Standard Contractual Clauses.

Retention

• Account data is kept while the account is active and deleted within 90 days of closure, except records we must keep for tax or legal reasons.
• Customer-controlled data follows the retention periods each workspace sets, with defaults of 365 days for email events, 730 days for audit events, and 180 days for campaign logs.
• Backups are retained for 30 days and then overwritten.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to it. Warm Deals provides these in the product: a preference centre for recipients, and export and erasure endpoints for account holders.

• If a Warm Deals customer contacted you and you want your data removed, use the unsubscribe or preference link in their message, or write to us and we will route your request to that customer and add you to our suppression list.
• We respond to requests within 30 days.
• You may complain to your local data protection authority.

Security

• Traffic is encrypted with TLS. Credentials for connected mailboxes and integrations are encrypted at rest.
• Passwords are hashed with bcrypt and never stored or logged in plain text.
• Access is scoped per organisation; API keys carry only the permissions granted to them.
• Every change to data is written to an audit log.
• Our current certification status is published on the Trust Center. Where a certification is in progress, we say so rather than implying it is complete.

Cookies

We use cookies that are necessary for the service: a session refresh cookie, and local storage for your language and interface preferences. We do not use advertising cookies and we do not sell personal information.

Children

Warm Deals is a business tool and is not directed to anyone under 16.

Changes

If we make a material change we will update the date above and notify account administrators before it takes effect.

Contact

Privacy questions, data requests, and removal requests: privacy@adsbeast.pro.