Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you create an SDR.io account or use the Service, you provide us with:

• Account information: name, work email address, password (stored encrypted), and authentication credentials when you sign in with a third-party identity provider such as Google.
• Profile information: job title, company name, role, and any other details you add to your SDR.io profile.
• Campaign and ICP configuration: the criteria you define for your Ideal Customer Profile, including target industries, geographies, company sizes, roles, technologies, and other parameters used to score prospects.
• Payment information: if you subscribe to a paid plan, your payment details (such as credit card information) are collected and processed directly by our payment processor (Stripe). SDR.io does not store full payment card numbers.
• Support communications: messages, attachments, and other content you send to us when contacting customer support.

1.2 Information Collected Automatically

When you use the Service, we automatically collect certain information about your interactions with it:

• Usage data: features you use, buttons you click, ICP campaigns you create, profiles you score, leads you enrich, and the timestamps of these interactions.
• Device and technical information: browser type and version, operating system, language preference, time zone, and IP address.
• Cookies and similar technologies: we use cookies on sdr.io and app.sdr.io to keep you signed in, remember your preferences, and analyze how the Service is used.

1.3 Information Collected by the SDR.io Browser Extension

The SDR.io Chrome extension is the on-page interface to the Service. When you have the extension installed and active, it processes the following data:

• Current page context: when you open the SDR.io side panel on a LinkedIn profile, LinkedIn company page, LinkedIn search results page, or any company website, the extension reads basic page metadata (URL, visible profile or company name, headline, and similar visible elements) to determine which prospect or company to score and enrich.
• Pages where you used the extension: we record which LinkedIn profiles and company pages you score so that you can review your prospecting history inside the SDR.io web application.
• Extension interactions: we log clicks on extension UI elements (such as “Enrich” and “Add to Campaign”) for product analytics and to improve the Service.
• Locally stored preferences: the extension uses chrome.storage to remember your selected ICP campaign, UI preferences, and a session reference used to authenticate API calls. No passwords are stored locally.

The extension only activates on pages where you open the side panel. It does not silently scan or record pages in the background, and it does not read content from your other browsing activity.

1.4 Information from Third Parties

To deliver enrichment and intelligence features, SDR.io may receive information from third-party data providers, including contact details, company firmographics, technographic data, web traffic estimates, and news content related to companies and professionals you research through the Service. We select providers that represent their data as lawfully collected and authorized for B2B sales and marketing use cases.

2. Information About Prospects and Other Third Parties

SDR.io is a B2B sales intelligence tool. As part of normal use, the Service displays and processes professional information about people and companies you research (“prospect data”). Prospect data typically includes name, job title, company affiliation, work email patterns, professional location, and other B2B information that is publicly available or supplied by our authorized data providers.

If you are a prospect whose data has been processed through SDR.io and you would like to exercise rights regarding that data (including access, correction, or deletion), please contact privacy@sdr.io. We will respond consistent with applicable law (see Section 6).

3. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including authenticating your account, displaying intelligence panels, scoring prospects against your ICP, and enriching contact and company data;
• Process payments and manage subscriptions;
• Personalize your experience and remember your preferences;
• Send transactional communications (account verification, billing receipts, security alerts);
• Send product updates and marketing communications, where permitted by law (you can opt out at any time);
• Measure and improve product performance, debug issues, and develop new features;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our Terms of Service.

4. Legal Bases for Processing (EEA, UK, and Similar Jurisdictions)

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, the legal bases on which we rely to process your personal data include:

• Contract: processing necessary to provide the Service you have subscribed to.
• Legitimate interests: processing necessary for our legitimate interests in operating, improving, and securing the Service, in supporting B2B prospecting on behalf of our users, and in marketing to existing customers — balanced against your rights and freedoms.
• Consent: where required by law, for example for certain marketing communications or non-essential cookies.
• Legal obligation: processing necessary to comply with applicable laws and regulations.

5. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

5.1 Service Providers

We share information with third-party vendors that help us deliver the Service. These providers are contractually bound to use the information only to provide services to us and to protect it. Categories include:

• Cloud infrastructure and hosting providers;
• Database and storage providers;
• Payment processors (such as Stripe);
• Email delivery and customer support platforms;
• Analytics and product telemetry providers;
• Authentication providers (such as Google Sign-In);
• Third-party data enrichment partners, for the purposes described in Section 1.4.

5.2 Legal and Safety

We may disclose information if we believe in good faith that disclosure is necessary to comply with applicable law, respond to valid legal process, enforce our Terms, protect the rights, property, or safety of SDR.io, our users, or others, or detect and prevent fraud or security incidents.

5.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before personal information is transferred and becomes subject to a different privacy policy.

5.4 With Your Consent

We may share information for any other purpose disclosed to you and with your consent.

6. Your Rights

Depending on where you reside, you may have the following rights with respect to your personal data:

• Access: request a copy of the personal data we hold about you;
• Correction: request that we correct inaccurate or incomplete data;
• Deletion: request that we delete your personal data, subject to applicable legal exceptions;
• Restriction or objection: request that we restrict, or object to, certain processing;
• Portability: request that we provide your data in a portable, machine-readable format;
• Withdrawal of consent: withdraw consent at any time where processing is based on consent;
• Complaint: lodge a complaint with a supervisory authority (for EEA/UK residents, your local data protection authority).

To exercise these rights, email privacy@sdr.io. We will respond within the time required by applicable law (typically 30 days for GDPR requests). We may need to verify your identity before fulfilling a request.

6.1 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know what personal information we collect and how we use it, the right to delete personal information, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information (SDR.io does not sell personal information), and the right not to be discriminated against for exercising these rights. To exercise these rights, contact privacy@sdr.io.

7. Data Retention

We retain personal data for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account data is retained while your account is active and for up to 12 months after account deletion (for backup and dispute resolution).
• Usage and analytics data is typically retained in aggregated form for up to 24 months.
• Billing records are retained for the period required by applicable tax and accounting laws.
• You may request earlier deletion by contacting privacy@sdr.io.

8. International Data Transfers

SDR.io is operated from the Dubai International Financial Centre (DIFC), United Arab Emirates, and uses service providers located in various countries, including the United States, the European Union, India, and other jurisdictions. When we transfer personal data internationally, we rely on appropriate legal mechanisms (such as Standard Contractual Clauses where applicable) and require our service providers to maintain appropriate security and confidentiality measures.

9. Security

We implement technical and organizational measures designed to protect your information, including encryption in transit (TLS), encryption at rest, access controls, audit logging, and routine security reviews. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If you believe your account has been compromised, please contact security@sdr.io immediately.

10. Children's Privacy

The Service is intended for business use by professionals aged 18 and older. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact privacy@sdr.io and we will take steps to delete it.

11. Cookies and Tracking

We use cookies and similar technologies on sdr.io and app.sdr.io to:

• Keep you signed in and remember your session;
• Save your preferences (e.g., active campaign, UI settings);
• Measure how the Service is used so we can improve it.

Most browsers let you control cookies through their settings. Note that disabling cookies may prevent some features of the Service from functioning properly. The SDR.io browser extension uses chrome.storage rather than cookies for local preferences and does not set tracking cookies on the websites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service or by email and update the “Last updated” date at the top of this page. Your continued use of the Service after the effective date of any updates constitutes acceptance of the revised Privacy Policy.

13. Contact Us