Privacy Policy

1.1 Information you provide to us.

Personal information you may provide to us through the Service or otherwise includes:

• Contact data, such as your first and last name, email address, professional title, company name, phone number, and mailing or billing address.
• Profile data, such as the password you set for your account, your photograph, biographical details, links to your profiles on professional networks, your role, location, career history, and any other information you add to your profile.
• Organization data, such as your organization's name, domain, members and roles, plan, settings, and the systems it has connected.
• Communications data based on our exchanges with you, including when you contact us through the Service, by email, through support channels, on social media, or otherwise.
• Transactional data, such as information relating to your subscription, invoices, usage allowances, and billing history.
• Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.
• User-generated content and input data, such as prompts, search criteria, agent run inputs and outputs, approvals, CRM records, contact lists, campaign content, drafts, messages, notes, files, and other content or information you generate, upload, or otherwise make available through the Service, along with associated metadata.
• Connected account data from mailboxes, LinkedIn, CRMs, and other systems you connect, as described in Section 1.4.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

1.2 Third-party sources.

We may combine personal information we receive from you with personal information falling within one of the categories identified above that we obtain from other sources, such as:

• Public sources, such as company websites, press, public social media and professional profiles, public records, and other publicly available sources, including through web search and crawling providers.
• Data providers, such as business-contact and company data licensors (for example, People Data Labs), email verification services (for example, ZeroBounce), logo and company-metadata providers, and enrichment or scraping providers acting on our instructions.
• Customers, who may submit information about you as a prospect, contact, colleague, or invitee.
• Service providers that provide services on our behalf or help us operate the Service or our business.
• Business transaction partners. We may receive personal information in connection with an actual or prospective business transaction, such as a merger, acquisition, sale of assets, financing, insolvency, or similar transaction.
• Third-party services that you use to log into, or otherwise link to, your account, such as Google and LinkedIn sign-in. This data may include your name, email address, profile picture, and other information associated with your account on that service that is made available to us based on your settings on that service.

1.3 Automatic data collection.

We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, our communications, and other online services, such as:

• Device data, such as your device's operating system type and version, browser type, screen resolution, device type, IP address, unique identifiers, language settings, and general location information such as city, state, or geographic area.
• Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths, clicks and other interactions on a page, access times and duration, and whether you have opened our emails or clicked links within them.
• Communication interaction data, such as delivery, bounce, and reply status for messages sent through the Service, and, where a delivery provider you choose supports it, whether a recipient opened or clicked a message.

For more information concerning our automatic collection of data, see the Tracking technologies section below.

1.4 Connected accounts and sign-in providers.

You may sign in with Google or LinkedIn and may connect mailboxes, professional networks, CRMs, and other systems to the Service. We collect and process only the information needed for the feature you authorize:

• Google or LinkedIn sign-in: your name, email address, and profile picture, used to create and authenticate your account and pre-populate your profile.
• Gmail and Outlook: the connected mailbox's email address and connection status; messages, threads, labels or folders, and contacts to the extent you use Inbox, contact import, or campaign features; and messages you direct us to send. Mailbox connections are authorized through our integration provider, Composio, which holds and refreshes the OAuth credentials. Vsyble stores the connected account's email address and a connection record, not the mailbox OAuth access or refresh token. To keep Inbox responsive, we store a user-, organization-, and account-scoped mailbox projection with a 24-hour expiry that is invalidated after mailbox changes.
• LinkedIn account connection: when you connect your LinkedIn account through our provider, Unipile, we access your profile, network connections, and messaging to the extent you use network, research, and outreach features.
• CRMs, sequencing tools, and other integrations (for example, HubSpot, Salesforce, Slack, Instantly, Google Sheets): records and events needed to sync, enrich, or act on your data as you direct.

1.5 Information about business contacts and prospects.

The Service helps customers find and research people who may be relevant to their business (for example, potential buyers, partners, or warm-introduction paths). If you are not a user of the Service, we may still process limited business-contact information about you, such as your name, employer, job title, professional profile URL, business email address or its likely format, location, and professional history. We obtain this information from the sources in Section 1.2, and from our customers, who may enrich, verify, and organize it inside their workspace. A relationship or company match produced by the Service is an inference, not a verified fact. You may ask us to remove or stop processing your business-contact information as described in Your choices.

1.6 Website Visitor Intelligence.

A Vsyble business customer may add our tracker to a website it controls. The customer is responsible for its privacy notice, legal basis, consent mechanism, and regional configuration, and decides when the tracker is loaded. We process this data to provide the service to that customer.

The tracker sends a public site identifier, random event and tab-session identifiers, the page path after sensitive-looking segments are masked, a sanitized referrer, and limited UTM campaign fields. It does not read or send cookies, page query strings, fragments, page text, form values, email addresses, browser fingerprints, or a visitor-supplied IP field. Our network receives the connection IP address as part of the request. In company mode, we use it transiently to request a probabilistic company match from People Data Labs; the raw address is not stored in our application database, and persistent references are one-way, customer-scoped values. For an activated enterprise service, RB2B's script and service perform company and eligible U.S. person identification. A company attribution is not proof that a particular employee visited. Identified visits are visible to authorized members of the customer's workspace and may be linked to an existing CRM identity; the Service does not create a new CRM record, start research, or initiate outreach from a visitor match unless an authorized user takes that action.

1.7 Data about others.

We offer features that let you invite colleagues to your organization and import contacts from your mailbox or files. We collect contact details about invitees so we can deliver invitations, and we process imported contacts on your behalf. Please do not share someone's contact details with us unless you have the right to do so.

Web beacons.

We may use pixel tags in HTML emails we send you to learn whether an email was opened or a link clicked. Most email clients let you block images to prevent this.

Chat and other artificial-intelligence ("AI") technologies.

The Service uses generative AI models provided by OpenAI, Anthropic, and xAI to operate research, drafting, copilot, and agent features. When you use these features, the prompts, connected-account content, and workspace context needed to answer your request are sent to the applicable provider to produce the response. We use these providers' API services, which do not use API inputs or outputs to train their models by default, and we contractually require them to maintain appropriate data-protection safeguards. We do not use your personal information or content to train generalized AI models.

Your choices.

Most browsers let you remove or reject cookies and clear browser storage; follow the instructions in your browser settings. If you disable cookies, parts of the Service may not work, and you may need to sign in more often. The Website Visitor Intelligence tracker described in Section 1.6 does not set cookies; the customer that operates the website controls whether and when it loads.

Service delivery and operations.

We may use your personal information to:

• provide the Service, including account and people research, relationship mapping, signal monitoring, CRM, Inbox, campaigns, and agent workflows;
• establish and maintain your user profile and organization;
• run the research, agent, and monitoring workflows you request, and connect context and actions across the systems you authorize;
• send messages you direct us to send, and record their delivery and reply status;
• enable security features of the Service, including recipient verification, suppression, and abuse detection;
• facilitate invitations to colleagues and collaboration within your organization;
• communicate with you about the Service, including by sending Service-related announcements, updates, security alerts, and support and administrative messages; and
• provide support for the Service, and respond to your requests, questions, and feedback.

Service personalization.

We may use your personal information to understand your needs and interests, personalize your experience with the Service and our Service-related communications, and remember your selections and preferences.

Service improvement and analytics.

We may use your personal information to analyze your usage of the Service, improve the Service and the rest of our business, understand user activity on the Service (including which pages are most and least visited and how users move around the Service), evaluate the quality of agent and research output, and develop new products and services. For example, we use PostHog and Google Analytics for this purpose; see Section 2 for how to limit them.

Direct marketing.

We may send you direct marketing communications about our products, events, and content, and may personalize these messages based on your needs and interests. You may opt out of our marketing communications as described in Your choices. We do not engage in interest-based advertising.

Compliance and protection.

We may use your personal information to:

• comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, investigations, or requests from government authorities;
• protect our, your, or others' rights, privacy, safety, or property (including by making and defending legal claims);
• audit our internal processes for compliance with legal and contractual requirements or our internal policies;
• enforce the terms and conditions that govern the Service; and
• prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks, spam, and identity theft.

Corporate events.

We may share certain personal information in the context of actual or prospective corporate events; for more information, see How we share your personal information.

Aggregated, de-identified, or anonymized data.

We may create aggregated, de-identified, or anonymized data from your personal information and that of other individuals whose personal information we collect. We make personal information into de-identified or anonymized data by removing information that makes the data identifiable to you, and we will not attempt to re-identify any such data. We may use this data and share it with third parties for our lawful business purposes, including analyzing and improving the Service and promoting our business. We do not use your personal information or content to train generalized AI models.

Further uses.

In some cases, we may use your personal information for further uses, in which case we will ask for your consent if those uses are not compatible with the initial purpose for which the information was collected.

Account deletion.

When you request account deletion, we sign you out and block new sign-ins, revoke connected-account credentials, and schedule permanent deletion of your account and personal information seven calendar days later. An already-issued access token may remain valid until it expires. During that period, the account is held in a restricted deletion queue so the request can be cancelled through support; credentials revoked while processing the request may need to be connected again if it is cancelled. After the grace period, we delete or anonymize the personal information, except where we are required to retain specific records for legal, billing, or dispute-resolution purposes. Shared organization records may be retained for the remaining organization members, with your personal attribution removed where appropriate.

Connected-account and AI data.

Mailbox projections expire within 24 hours and are invalidated after mailbox changes. Each Inbox Copilot turn runs in its own provider session that we delete when the turn completes; conversation memory lives only in our own database. Disconnecting an integration revokes our access to that system and stops further collection from it.

Website Visitor Intelligence.

Matched visitor profiles and detailed visits that have not been saved to CRM are retained for up to 180 days. Unmatched or quota-blocked page metadata is removed within 24 hours, and a non-sensitive replay receipt may remain for seven days. Network-resolution cache entries remain for up to seven days for matches or 24 hours for negative results. Provider usage accounting without visitor content may be kept for 13 months. Visits explicitly saved to CRM follow the customer's normal CRM retention. If a customer's eligible plan ends, collection stops immediately; existing visitor data remains available to the customer for up to 30 days, is then hidden, and is deleted at each record's normal 180-day expiry unless service is restored. Deleting the organization removes its visitor data immediately, apart from non-personal operational records needed to remove a configured provider domain.

Your privacy rights.

The State Privacy Laws may provide residents with some or all of the rights listed below. These rights are not absolute, and some State Privacy Laws do not provide these rights to their residents; we may decline your request in certain cases as permitted by law.

• Information. You can request the categories of Personal Information we have collected, the categories of sources, the business or commercial purpose for collecting it, the categories of third parties with which we share it, and the categories of Personal Information we sold or disclosed for a business purpose and to whom.
• Access. You can request a copy of the Personal Information that we have collected about you.
• Appeal. You can appeal our denial of any request validly submitted.
• Correction. You can ask us to correct inaccurate Personal Information that we have collected about you.
• Deletion. You can ask us to delete the Personal Information that we have collected from you.
• Opt-out of targeted advertising. We do not process your Personal Information for targeted advertising purposes.
• Opt-out of profiling or automated decision-making. We do not use your Personal Information to engage in profiling or to perform automated decision-making that results in legal or similarly significant effects, such as significant financial impacts or impacts on housing, education, employment, health care, or criminal justice.
• Opt-out of sales. We do not sell your Personal Information within the meaning of the State Privacy Laws.
• Consumers under 16. We do not have actual knowledge that we collect, sell, or share the Personal Information of consumers under 16 years of age.
• Sensitive Personal Information. We do not intentionally collect or process Sensitive Personal Information, and we ask that you not submit it through the Service.
• Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the State Privacy Laws.

Exercising your rights.

You may submit requests to exercise any of the state privacy rights listed above by emailing team@vsyble.com or writing to us at the address in Section 12. Because we do not sell or share Personal Information for cross-context behavioral advertising, there is no sale or sharing to opt out of; if that changes, we will honor Global Privacy Control ("GPC") signals as valid opt-out requests as required by applicable law.

Verification of identity; authorized agents.

We may need to verify your identity in order to process your information, access, appeal, correction, or deletion requests and reserve the right to confirm your residency. To verify your identity, we may require confirmation from the email address associated with your account, a declaration under penalty of perjury, or other information, where permitted by law. Under some State Privacy Laws, you may enable an authorized agent to make a request on your behalf. We may need to verify your authorized agent's identity and authority to act on your behalf, and may require a copy of a valid power of attorney or your written and signed permission, the information we request to verify your identity, and confirmation that you have given the agent permission to submit the request.

Information practices.

The following describes our practices currently and during the past 12 months:

• Sources and purposes. We collect all categories of Personal Information from the sources and use them for the business and commercial purposes described above in this Privacy Policy.
• Retention. The criteria for deciding how long to retain Personal Information are described in Section 4.
• De-identification. We do not attempt to re-identify de-identified information derived from Personal Information, except for the purpose of testing whether our de-identification processes comply with applicable law.

The chart below summarizes the Personal Information we collect, the purposes for which we collect it, and the third parties to whom we may disclose it, by reference to the categories in Section 1 and the categories specified in the CCPA (Cal. Civ. Code §1798.140). Information you voluntarily provide to us, such as in free-form fields, may contain other categories not described below. We do not sell or share Personal Information in any category.

Additional information for California residents.

Shine the Light law. Under California's Shine the Light law (California Civil Code Section 1798.83), California residents may ask companies with whom they have formed a business relationship primarily for personal, family, or household purposes to provide the names of third parties to which they have disclosed certain personal information during the preceding calendar year for those third parties' own direct marketing purposes, and the categories of personal information disclosed. You may send us requests for this information to team@vsyble.com. In your request, you must include the statement "Shine the Light Request," provide your first and last name and mailing address, and certify that you are a California resident. We reserve the right to require additional information to confirm your identity and California residency. We do not disclose personal information to third parties for their own direct marketing purposes.

Additional information for Nevada residents.

Nevada residents have the right to opt out of the sale of certain personal information for monetary consideration. While we do not currently engage in such sales, if you are a Nevada resident and would like to make a request to opt out of any potential future sales, please email team@vsyble.com.

Where this notice applies.

The information provided in this section applies only to individuals in the United Kingdom and the European Economic Area (i.e., "Europe" as defined at the top of this Privacy Policy). References to "personal information" in this Privacy Policy should be understood to include a reference to "personal data" as defined in the GDPR.

Controller and processor.

Vsyble is the controller in respect of the processing of your personal information covered by this Privacy Policy for purposes of European data protection legislation (the EU General Data Protection Regulation and the UK GDPR, as and where applicable, together the "GDPR"). See How to contact us for our contact details. Where a customer submits or connects personal information about its prospects, contacts, or relationships, that customer is the controller and Vsyble acts as its processor under a data processing addendum; requests about that information should be directed to the customer.

Our legal bases for processing.

In respect of each of the purposes for which we use your personal information, the GDPR requires us to ensure that we have a "legal basis" for that use. Our legal bases are: where we need to perform a contract we are about to enter into or have entered into with you ("Contractual Necessity"); where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests ("Legitimate Interests"); where we need to comply with a legal or regulatory obligation ("Compliance with Law"); and where we have your specific consent ("Consent").

Retention.

We retain personal information for as long as necessary to fulfil the purposes for which we collected it, as described in Section 4. When we no longer require the personal information we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because it has been stored in backup archives), securely store it and isolate it from any further processing until deletion is possible. If we anonymize your personal information so that it can no longer be associated with you, we may use this information indefinitely without further notice to you.

Other information.

No sensitive personal information. We ask that you not provide us with any sensitive personal information (for example, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or trade union membership) on or through the Service, or otherwise to us. If you provide us with any sensitive personal information when you use the Service, you must consent to our processing and use of it in accordance with this Privacy Policy. If you do not consent, you must not submit it through the Service.

No automated decision-making and profiling. As part of the Service, we do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Research rankings and relationship paths are recommendations reviewed by a human user before any action is taken.

Your rights.

European data protection laws give you certain rights regarding your personal information. If you are located in Europe, you may ask us to take the following actions in relation to your personal information that we hold:

• Access. Provide you with information about our processing of your personal information and give you access to your personal information.
• Correct. Update or correct inaccuracies in your personal information.
• Delete. Delete your personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
• Restrict. Restrict the processing of your personal information, for example if you want us to establish its accuracy or the reason for processing it.
• Object. Object to our processing of your personal information where we are relying on Legitimate Interests. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Withdraw consent. When we use your personal information based on your consent, you have the right to withdraw that consent at any time.

Exercising these rights. You may submit these requests by email to team@vsyble.com or to our postal address provided above. We may request specific information from you to help us confirm your identity and process your request. Whether or not we are required to fulfil any request you make will depend on a number of factors (for example, why and how we are processing your personal information). If we reject any request you make (whether in whole or in part), we will let you know our grounds for doing so at the time, subject to any legal restrictions.

Your right to lodge a complaint with your supervisory authority. If you are not satisfied with our response to a request you make, or with how we process your personal information, you can make a complaint to the data protection regulator in your habitual place of residence. For users in the European Economic Area, the contact information for your data protection regulator can be found at edpb.europa.eu. For users in the UK, the regulator is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, tel. +44 303 123 1113, ico.org.uk.

Data processing outside Europe.

We are a U.S.-based company, and many of our service providers, advisers, partners, or other recipients of data are also based in the U.S. This means that, if you use the Service, your personal information will necessarily be accessed and processed in the U.S. It may also be provided to recipients in other countries outside Europe.

The U.S. is not the subject of a general "adequacy decision" under the GDPR, which means that the U.S. legal regime is not considered by the relevant European bodies to provide a level of protection for personal information equivalent to that provided by European laws. Where we share your personal information with third parties who are based outside Europe, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented:

• Transfers to territories with an adequacy decision. We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection for personal information by the European Commission or UK Government (as and where applicable), including to U.S. organizations certified under the EU-U.S. Data Privacy Framework and its UK Extension.
• Transfers to territories without an adequacy decision. We may transfer your personal information to countries or territories whose laws have not been deemed to provide such an adequate level of protection. In these cases, we may use specific appropriate safeguards designed to give personal information effectively the same protection it has in Europe — for example, standard contractual clauses approved by the relevant authorities — or, in limited circumstances, we may rely on an exception or "derogation," such as your explicit consent to that transfer.

You may contact us if you want further information on the specific mechanism used by us when transferring your personal information out of Europe, and you may have the right to receive a copy of the appropriate safeguards by contacting us at team@vsyble.com.