Privacy Policy

This policy covers aidealigence.com, the Access Agent web app, the Agent API (aidealigence.com/api/v1), the MCP server (aidealigence.com/mcp/), and the Playground - collectively, “the Service.” It applies whether you use the Service as a signed-in human researcher or as a developer/agent calling the API directly with a key.

Account information. Email address, name, and a salted hash of your password (never the password itself) when you create an account. If you subscribe to a paid plan, Stripe collects and processes your payment details directly - we store a Stripe customer/subscription reference, never your card number.

Objective queries and research data. The text of the objectives you submit (“find the person responsible for …”), and everything the research pipeline produces from it: organisations, people, evidence, sources, and scores. This is the core data the Service exists to generate, and it is retained so you can view past research and so a completed run doesn’t have to be re-run (and re-billed) to be read again.

API usage. Every billable API/MCP call is logged as a usage event - operation, credits charged, duration, and outcome - against your API key, so your usage dashboard and billing are accurate. API keys themselves are stored only as a hash, the same as your password; the raw key is shown once, at creation, and is not recoverable by us.

Technical data. IP address and basic request metadata (timestamp, endpoint, status code), used for rate limiting, fraud prevention, and debugging. The homepage’s anonymous demo widget rate-limits by IP for the same reason, before any account exists.

• To run the research pipeline and return your results.
• To authenticate you and your API keys, and enforce rate limits and credit balances.
• To bill subscriptions and metered usage via Stripe.
• To operate webhooks you’ve registered (delivering event payloads you configured).
• To investigate abuse, security incidents, or violations of the Terms.
• To improve the Service’s accuracy and reliability - we do not sell your data or use your objective queries to train third-party models beyond the provider calls described below.

The people an objective surfaces - a recommended decision-maker, an alternative candidate - are usually not our customers or account holders; they are third parties whose publicly available professional information (name, job title, employer, publicly stated role or remit) we process on a customer’s behalf: name, job title, employer and publicly stated role or remit, and, where they or their organisation have published them, contact details (see Section 4A). Our lawful basis for this is legitimate interests (UK GDPR / GDPR Article 6(1)(f)): identifying the person most likely to hold relevant authority for a specific, legitimate business objective (a partnership, a procurement decision, an investment introduction) is exactly the kind of professional-context research a company or individual has always been able to do manually, and we only ever process information that is already public. Contact details, including personal email addresses and phone numbers, are handled under the extra safeguards in Section 4A.

We’ve balanced this against the individual’s own interests: we surface current professional role information and published contact details, never home addresses or sensitive personal data; we never fabricate a claim about someone (every recommendation is grounded in cited evidence, see Section 3); and anyone can object to how we process their information or request its removal by emailing privacy@aidealigence.com, the same route Section 6 describes for our own account holders.

For a person an objective surfaces, you can ask us to build a contact package: the contact details we can find for them, how reliable each is, who could introduce you, and a suggested way to approach them. This section explains what that involves.

What we collect. Work email address, personal email address, office and direct phone numbers, mobile and landline numbers, WhatsApp number, and links to their LinkedIn profile, X (Twitter) profile, website or biography page, speaker pages and (for UK company officers) their Companies House appointments page. Phone numbers are stored in international format with the country shown. Each item is labelled Personal or Business. We do not collect home addresses, family details, health, religion, political or other special-category information, and we discard any passage that touches those subjects.

Where it comes from. Publicly available sources only: the person’s own website or biography, their organisation’s website, press releases, event and speaker pages, podcasts, filings and public registers, and search results (for LinkedIn and X profile links we use only the search result; we never log in to or scrape LinkedIn). Where a customer on a paid plan has the feature enabled, a licensed data provider (currently Clay) may also supply values; that provider must state how it sourced them and we store its statement. We do not use leaked, breached or hacked data, or data taken from hacked or stolen sources. We record the source address, the date we found each value, how we found it, and how confident we are, and show all of that to you.

Checking an email. We may check that a work email address exists by asking the recipient’s mail server whether it accepts the mailbox. This does not send any email. It runs from a separate server, not from the systems we send mail from.

Lawful basis. Legitimate interests (UK GDPR Article 6(1)(f)): enabling a professional to reach the right person about a relevant business matter. We record the basis, source and collection date for every item. For personal email addresses, mobile and landline numbers we apply extra caution: they are shown only as unconfirmed unless the person or their organisation published them, and they are for relevant one-to-one outreach only, not bulk marketing. Where a country has a do-not-call register (for example the UK TPS and CTPS, the US National Do Not Call Registry), we show a reminder to check it before calling. Customers are responsible for complying with the laws that govern their own outreach, including PECR in the UK, and the UAE and Saudi Arabia personal data protection laws where those apply.

How long we keep it. Each contact detail is re-verified or removed after 90 days. A detail we can no longer confirm is not shown.

Your choices. If you do not want to appear, use the removal form. You are added to our global do-not-contact list immediately and are not shown again in results, exports, the API or MCP; we keep only the minimum identifiers needed to keep you off the list. You can also exercise your access, correction and objection rights by emailing privacy@aidealigence.com.

Answering an objective requires real research, which means real calls to outside providers on your behalf. We use:

• DeepSeek (LLM reasoning) - the text of your objective and intermediate research findings are sent to DeepSeek’s API to analyse, extract, and score candidates. See DeepSeek’s own privacy policy for how they handle API-submitted content.
• Brave Search (web search, primary) - search queries derived from your objective are sent to Brave first to find and retrieve public web sources, which become the evidence attached to a recommendation. See Brave’s own privacy policy.
• Tavily (web search, fallback) - the same search queries route to Tavily instead whenever Brave is unavailable, so results keep coming back rather than the objective failing outright. See Tavily’s own privacy policy.
• Perplexity (web search, further fallback, and optional checks that a LinkedIn profile belongs to the right person) - search queries and a person’s name and employer are sent to Perplexity’s search API. See Perplexity’s own privacy policy.
• OpenRouter (LLM reasoning, fallback) - receives the same research text as DeepSeek whenever DeepSeek is unavailable.
• Clay (licensed contact-data provider) - used only for paid searches, only when switched on, and only to look up contact details for a named person at a named organisation. Clay must tell us how it sourced each value and we store that statement. See Section 4A.
• Companies House (UK public register) - we look up company officers and persons with significant control.
• Public web pages - we read pages that organisations and people have published (company sites, speaker and biography pages), respecting robots.txt. We do not log in to or fetch LinkedIn pages.
• Resend (email delivery) - sends account confirmation, password reset and notification emails.
• Google Sign-In (optional login) - if you choose it, Google tells us your verified email address and name.
• Stripe (billing) - processes subscription and pay-as-you-go payments; we never see or store full card details.

Apart from Clay (above, paid searches only, when switched on) we do not query any contact-database vendor: the Service researches each objective from public sources. If that changes, this section will be updated before the integration ships.

International transfers: some of the providers above may process data outside the UK/EEA. We are confirming the specific transfer mechanism (UK IDTA or EU Standard Contractual Clauses) in place with each provider and will state it here, provider by provider, once confirmed - this line will be replaced with the specifics, not left as a standing gap.

Account data (login, plan, API keys) is retained for as long as your account is active. Objective/research data - the text of an objective and the organisations, people, and evidence it surfaced - is retained for 12 months from when the research completed, then deleted, whether or not your account is still active; you can still delete it sooner yourself at any time. Usage events (billing records) are retained for at least as long as required for tax and accounting purposes after an account closes. You can request deletion of your account and any remaining associated data at any time (see Section 7) - we’ll delete what we can and retain only what we’re legally required to (e.g. billing records HMRC requires us to keep).

If you’re in the UK or EU, you have rights under UK GDPR / GDPR to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, email privacy@aidealigence.com - we’ll respond within 30 days. You can delete your own API keys and webhooks at any time from your account without contacting us.

Passwords and API keys are stored as one-way hashes, never in recoverable form. Webhook deliveries are signed (HMAC-SHA256) so a receiver can verify authenticity. Traffic to the Service is encrypted in transit (HTTPS/TLS). No system is perfectly secure; if we become aware of a breach affecting your data, we’ll notify you as required by applicable law.

We use strictly-necessary cookies/local storage for authentication (keeping you signed in) and no advertising cookies. If analytics is enabled, it runs cookieless (Plausible) by default; any tracking that does set a cookie will only run after you accept it in the cookie banner. See the banner on your first visit for current choices.

We’ll update the “last updated” date above when this policy changes, and post material changes on this page. Continued use of the Service after a change means you accept the updated policy.

Questions or data requests: privacy@aidealigence.com. General support: support@aidealigence.com.

Digital Pulse 365 Ltd. Company number 15351208.
Registered office: 128 City Road, London, United Kingdom, EC1V 2NX.

ICO registration: in progress. We’ll publish the registration number here once it’s issued.