Privacy

CupidKnows (with CupidReach, our outbound specialist) is run by legal entity, registered address and company number. For the chat and your account we are the controller of your data. For the people we email on a client's behalf, the client is the controller and we process their data for the client (section 4).

Questions and requests about your data: ask in the chat, reply to any email we sent you, or write to privacy contact email. Each request is recorded and answered within one month.

• The messages you send in the chat and the files you upload, to understand your business, research it, make a proposal and do the work you approve. This is what you ask us to do (contract, GDPR Art. 6(1)(b)).
• Your website, and public pages, news and search results about your company, to make the proposal fit (our legitimate interest, Art. 6(1)(f)).
• Your name and email once you save your chat or approve a proposal, and your settings, to keep your account and email you about the work (contract).
• The basics that keep the service safe: a session id, rate limits per IP address and error logs (legitimate interest).

Your data isn't sold and isn't used for advertising.

Our agents use AI models (Anthropic's Claude and OpenAI's GPT models, reached through OpenRouter) to read and write. Text and files go to them only to do your work. We ask OpenRouter to route only to model providers that don't collect what they are sent or train on it, and we don't use your data to train models.

When a client hires us for outbound, we write to people at companies that may need what they sell, on the client's behalf. The client named in the email decided to contact people in your role and is the controller; we find, research and email you for them. The email links to the client's own notice.

• What we hold: your name, work email, job title, company, public profile link and location, public information about your role and company, the emails written and sent to you, and your replies.
• Where it came from: business contact databases (Apollo exports, and lead-finder tools run on Apify), your company's website, and public pages and news. We check that your work address accepts email with an email-verification service (run on Apify).
• Why we may: the client's legitimate interest in offering something relevant to your role (Art. 6(1)(f)), and only in markets where business cold email is allowed without prior consent. We don't keep health, religion, politics or similar details: our research drops them.
• How long: if you don't reply, your record is deleted 12 months after the last email of the sequence, here and in the sending tool. If you reply, the full email as received (quoted thread, signature) goes after 30 days and your reply stays with your record.
• Your choices: you can object at any time. Reply “no” and we stop: we then keep only your address and the reason on a do-not-contact list, so you aren't emailed for that client again. Say you don't want to hear from anyone we work for, and the entry covers every client. You can also ask for a copy of what we hold, or for it to be corrected or deleted, by replying or by writing to us (section 1).

These services process data for us:

• Lovable Cloud (managed Supabase, EU): hosting, database, sign-in and file storage.
• OpenRouter (US), and the model providers it reaches, Anthropic and OpenAI (US): the AI models.
• Apify (Czech Republic, with servers that can be outside the EU): web search, news and page reading; the lead-finder tools; email verification; a browser for tasks you approve.
• Apollo (US): business contact data, used under licence.
• Smartlead (521 Products Pty Ltd, Australia; hosted on Amazon Web Services in Sydney, per its data processing agreement): sends approved campaigns and warms up the sending mailboxes, and holds the lead lists, the emails written for each person and the reply threads.
• Google (Google Workspace): the mailboxes the emails are sent from and the replies arrive in, on sending domains registered for each client.
• Cheap Inboxes (United States): registers the sending domains and sets up the Google Workspace mailboxes on them. Its published terms name no company beyond “Cheap Inboxes”, are governed by the laws of Wisconsin, and come with no published data processing agreement.
• Resend (US): sign-in codes and notification emails.

Where data goes outside the EU/EEA or the UK, the transfer relies on the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, or on the standard contractual clauses in our agreement with it. Smartlead's data processing agreement uses the EU standard contractual clauses and the UK Addendum. For Cheap Inboxes: the agreement and the transfer basis, still to be signed.

• A chat that was never saved to an email: deleted 60 days after its last activity, with its files.
• An email address given for a sign-in code that was never entered: deleted two days after the last code was sent.
• Your account and conversation: while you work with us, then retention period after the work ends. Ask and we delete it sooner: the sign-in, the conversation, files, research and campaign data.
• People we found but never emailed: 30 days after we collected their details. People emailed who didn't reply: 12 months after the last email. Full received reply emails: 30 days.
• Delivery events from the sending tool, copies of notification emails and the update queue: 90 days. Message snippets in our routing logs: 30 days.
• The do-not-contact list: kept for as long as we send email, so an objection keeps working. It holds only the address and the reason.

You can ask for a copy of your data (also in a portable form), ask us to correct it, delete it or limit how we use it, and object to how we use it, including to direct marketing at any time. Ask in the chat, reply to our email, or write to us (section 1): we answer within one month. You can also complain to your data protection authority.

Only what keeps you signed in and the app working, kept in your browser. No analytics or advertising trackers. On a shared computer, your settings stay with your account, not with the browser.

• 17 October 2026: we now send through Smartlead instead of Instantly, from Google Workspace mailboxes on new sending domains that Cheap Inboxes registers for each client. Smartlead, Google and Cheap Inboxes were added to section 5; Instantly was removed, because it no longer receives any data. Zapmail, a fallback for the mailboxes that is switched off, will be listed here before any data goes to it.