Privacy policy

This policy explains how Aculio ("we") handles personal data when you use aculio.com, the Aculio web app, REST API and MCP server, including when you connect Aculio to Claude, ChatGPT or another AI agent. Questions or requests: support@aculio.com.

1. Data we collect

Account data. Your name, email address and a hashed password (or your Google account identifier if you sign in with Google).

Billing data. Your plan, subscription status and invoices. Card details are collected and stored by Stripe; we never see or store full card numbers.

Usage data. The lead requests you or your agent send (prompts and filters), the leads delivered to your account, credit usage, and outcomes you or your integrations report (for example contacted, replied, bounced).

Integration credentials. API keys or tokens you give us for Instantly, Smartlead, HubSpot or Attio. They are encrypted at rest (AES-256-GCM) and used read-only to sync outcomes.

Connection data. When you connect Aculio to an AI app, we store the OAuth client registration and access and refresh tokens so the connection keeps working. We receive only the tool calls and arguments the AI app sends to Aculio; we do not receive or store your conversations, chat history, memory or files.

Technical data. IP address, user agent and request logs needed to run and secure the service. We use one essential session cookie to keep you signed in, and no advertising or tracking cookies.

2. Data about the leads we deliver

To deliver leads we process business contact data about professionals (name, job title, company, work email, professional profile URL and location) obtained from third-party B2B data providers through our data routing provider. We process it to provide our service, on the basis of legitimate interest in business-to-business prospecting. Anyone whose data we process can ask us to access, correct or delete it, or object to its processing, by writing to support@aculio.com; we will add an objecting person to a suppression list so they are not delivered again.

3. How we use data

• Provide, operate and secure the service, including finding, verifying and ranking leads.
• Remember which leads your account already has so you are never charged twice for a person.
• Improve ranking using pooled, de-identified statistics about which lead signals (for example seniority or hiring) lead to replies. These statistics contain no contacts and are never attributable to your account.
• Bill you, prevent abuse, and meet legal obligations.

We do not sell personal data and do not use your data to train AI models.

4. Service providers (subprocessors)

• Hetzner Online (Germany): hosting and database.
• Stripe: payments, subscriptions and tax.
• Anthropic: understands natural-language lead requests and ranks candidate leads. Requests are sent via Anthropic's API, which does not train on them.
• treg and the B2B data and email-verification providers it routes to: lead search, enrichment and email verification. We send search criteria and candidate details, not your account data.
• Cloudflare: DNS.
• Instantly, Smartlead, HubSpot or Attio, only if you connect them.

5. Retention

Account, lead, search and outcome data are kept while your account is active and deleted within 30 days of account deletion, except billing records we must keep by law. Server logs are rotated and kept for up to 30 days. OAuth access tokens expire after one hour and refresh tokens after 60 days of non-use; disconnecting an AI app revokes its access.

6. Security

Data is transmitted over TLS. API keys are stored as hashes, integration credentials are encrypted, and access to production systems is restricted.

7. Your rights

Depending on where you live (for example under the GDPR or CCPA), you can access, correct, export or delete your personal data, object to or restrict processing, and complain to your data protection authority. Email support@aculio.com and we will respond within 30 days. You can export your leads as CSV and delete your account at any time.

8. International transfers

Some providers above process data outside your country, including in the United States. Where required, transfers rely on standard contractual clauses or equivalent safeguards.

9. Children

Aculio is a business service and is not intended for anyone under 18.

10. Changes and contact

We will post changes here and update the date above; material changes are notified by email. Contact: support@aculio.com. See also our terms of service.