Privacy Policy

Adrata Inc. ("we," "us," or "our") operates Adrata buyer-room intelligence services (the "Service") available at adrata.com. This Privacy Policy describes how we collect, use, protect, and disclose your personal information when you use our Service, including when you sign in using Google, connect a mailbox or calendar, call or text through Adrata, or appear in a customer’s workspace as a business contact.

At a glance. The short version; the full policy below controls.

We never sell personal information and we run no advertising or retargeting.
Your connected Google data is used only to provide the features you turned on, is never used to train generalized or non-personalized AI models, and follows Google’s Limited Use rules (Section 4).
AI features run on foundation models hosted by Amazon Web Services in the United States. We do not train generalized AI models on your content, and Amazon does not use it to train the models it hosts for us (Section 3.3).
If you are not an Adrata user but appear in a customer’s workspace, Section 6 explains where that information comes from and how to opt out.
Calls placed through Adrata can be recorded; a recording notice plays where the law requires it, and you can ask us to delete a recording (Section 7).
Our data is hosted on AWS in the United States. The vendors that process it are listed on our sub-processor page.
To access, correct, export, or delete your data, use our request form or email privacy@adrata.com (Section 10).

1. Who We Are and the Roles We Play

Adrata Inc. is a Delaware corporation headquartered in Phoenix, Arizona. We play two different roles, and which one applies decides who answers your privacy questions:

Adrata as controller. We decide how and why to process personal information about visitors to adrata.com, people who request a demo or contact us, people who hold an Adrata account, and our own sales prospects and vendors. This policy applies in full.
Adrata as processor (service provider). When a customer uses the Service to store, enrich, and act on information about their contacts, prospects, and deals ("Customer Data"), the customer decides how and why that data is used and we process it on their instructions under our customer agreement and data processing addendum. If your information is in a customer’s workspace and you want it accessed, corrected, or deleted, the fastest route is to contact that customer. You can also contact us and we will forward your request and help the customer respond.

Section 6 explains how both roles apply to information about people who are not Adrata users.

2. Information We Collect

2.1 Account Information

Name and email address
Company name and role
Communication preferences, including a mobile number if you opt in to text notifications
Payment information (processed securely by Stripe; we do not store card numbers)
Sign-in and security records, such as login times and IP addresses. Authentication is provided by WorkOS

2.2 Data Collected via Google Sign-In

When you choose to sign in with Google, we request the following OAuth scopes through Google’s OpenID Connect protocol:

openid: Authenticates your identity
email: Your Google account email address
profile: Your name and profile picture

2.3 Data Collected When You Connect a Google Account

Signing in with Google does not grant access to your mail, calendar, or contacts. Those are separate, optional connections that you initiate from Settings and can disconnect at any time. If you choose to connect them, we request the following additional scopes and store the data described:

gmail.readonly: Reads your Gmail messages so your conversations, threads, and reply history appear inside Adrata. We store message content — including subject, body, sender and recipient addresses, cc and bcc, attachment metadata, labels, read state, and message headers. Attachment names, types, and sizes are stored; the files themselves are opened from Gmail when you view them and are not stored on Adrata’s servers. We also read your Gmail signature (send-as settings) so messages sent from Adrata carry it, and register a Gmail push notification so new mail appears promptly.
gmail.send: Sends email on your behalf for messages you compose or approve in Adrata, and for sequences or automations you explicitly enable to send automatically.
gmail.modify: Keeps message state in sync in both directions — read, starred, and archived state and labels — so Adrata and your Gmail inbox do not diverge, and saves drafts you write in Adrata to your Gmail Drafts folder. We do not permanently delete your mail.
gmail.settings.basic: Requested separately, only if you turn on signature sync, to write the signature you edit in Adrata back to your Gmail account. We do not use it to change forwarding, filters, delegation, or any other setting.
calendar.readonly: Reads your calendar events and free/busy availability so meetings appear alongside the related account and deal and suggested times fit your calendar. We store event title, description, location, start and end times, recurrence, organizer, attendees, meeting links, and visibility.
calendar.events: Creates, updates, and cancels events you schedule, reschedule, or cancel through Adrata, including their meeting links.
contacts.readonly and contacts.other.readonly: Reads your Google Contacts so the people you already know are recognised rather than duplicated. Contact records are stored as people in your workspace.
drive.file: Requested separately for new connections to the optional Google Sheets integration. Google’s file picker lets you select the spreadsheets Adrata can access. Adrata reads those sheets to import the columns you choose into your workspace and writes back only to columns you enable. This does not grant access to your whole Drive. Older Sheets connections may retain earlier permissions; Adrata uses them only for existing approved spreadsheets and column mappings.

Google Drive access is limited to spreadsheets you select for the optional Sheets integration; we do not request access to your photos or other Google services not listed above. When you disconnect a Google account, Adrata asks Google to revoke its access and removes synced mail and calendar events together with the records computed from them, such as labels, participant links, inbox classifications, and thread triage decisions. Saved SRM contacts, logged activities, and derived relationship records can remain in your workspace. Request deletion of retained data using the contact details below.

2.4 Other Accounts You Connect

You can also connect a Microsoft 365 mailbox and calendar, a CRM such as HubSpot or Salesforce, and meeting platforms such as Zoom or Microsoft Teams. Each connection is optional, is started by you from Settings, asks only for the permissions the feature needs, and can be disconnected at any time. For a connected Microsoft mailbox we store the same kinds of mail and calendar data described in Section 2.3. For a connected CRM we sync the records you choose in both directions. For a connected meeting platform we import the recordings and transcripts that you or your organization already created there.

2.5 Calling, Texting, and Recordings

If your workspace uses Adrata’s calling and texting features, we collect the phone numbers involved, call and message metadata (time, duration, direction, outcome), the text of messages sent and received, and, where recording is turned on, the audio of calls and voicemails and the transcripts we generate from them. Phone numbers you verify as your own caller ID are stored with your account. Section 7 explains recording notices, consent, and retention.

2.6 Information About People Who Are Not Adrata Users

Adrata workspaces hold business contact information about the people our customers sell to, most of whom are not Adrata users: name, job title, employer, work email address, work phone number, public professional profile URL, and company details such as industry, size, and location. This comes from three places: what the customer uploads or syncs from their own mailbox, calendar, and CRM; public sources such as company websites and public filings; and licensed business-data providers listed on our sub-processor page. We record the source of each enriched field. Section 6 explains how this information is used and how to opt out.

2.7 Website, Demos, and Marketing

When you request a demo, book time with us, or contact us, we collect the details you give us (name, work email, company, phone number if you choose to leave one, and your message). Demo bookings on our branded calendar pages are processed by Adrata and the host’s connected calendar provider. Calls take place in Portals. Onboarding bookings made through a Cal.com scheduling embed are processed by Cal.com. Live demo sessions may be recorded as described in Section 9.3.

2.8 Usage Data

Device information, browser type, and IP address
Pages visited and features used within the Service
Performance and error data to improve reliability

3. How We Use Your Information

3.1 General Use

Provide, operate, and maintain the Adrata platform
Authenticate your identity and manage your account
Display your name and profile picture within the application
Communicate with you about your account, updates, and support requests
Send product updates and marketing communications (only with your consent)
Ensure security, detect fraud, and prevent abuse
Comply with legal obligations

3.2 Use of Google User Data

Google user data is used solely for the following purposes:

Authentication: Verifying your identity when you sign in to the Service
Account creation: Creating and linking your Adrata account
User identity display: Showing your name and profile picture within the Adrata platform so your teammates can identify you
Mail and calendar features: If you connect a Google account, showing your conversations and meetings against the related account, contact, and deal; sending messages you compose or approve, including automatic sends through sequences or automations you explicitly enable; and keeping read state and labels in sync with your inbox
Contact recognition: Matching people you already know so records are not duplicated
Search and relationship context: Processing connected email content with AI and embedding services to support search and conversation context in your workspace
Google Sheets: Reading and writing only the sheets you explicitly connect

Google user data is used exclusively to provide and improve the core functionality of the Adrata platform. We do not use Google user data for advertising, profiling unrelated to the Service, or any purpose beyond providing the Adrata platform to you.

3.3 AI Features

Adrata uses artificial intelligence to summarize conversations, search your workspace, draft messages for review, score and rank accounts, and suggest next actions. Sequences and automations can also send messages or execute actions automatically when you explicitly enable that behavior. To do this, relevant workspace content (for example an email thread, a call transcript, or a contact record) is sent to foundation models that Amazon Web Services hosts for us in the United States through Amazon Bedrock, and to the AI and research providers named on our sub-processor page.

No training on your content. We do not use your content, or any Google user data, to train or improve generalized AI or machine-learning models. Amazon Web Services, which runs the models behind our AI features through Amazon Bedrock, does not use their inputs or outputs to train models and does not share them with the model makers. Our web-research and text-to-speech providers receive only the limited inputs described on the sub-processor page.
Learning inside your workspace. The Service tunes rankings and recommendations for your workspace from your own workspace’s outcomes, such as which deals closed. Learning shared across workspaces is built only from aggregated, de-identified signals contributed by workspaces whose administrators have opted in, and only where at least five workspaces contribute to the same segment.
You choose how actions run. Draft and approval modes let you review messages or actions before execution. If you explicitly enable automatic execution for a sequence or automation, it can act without a separate review of each message or action, within the permissions and settings you authorize. We do not use AI to make decisions that produce legal or similarly significant effects on any person.
Where the data goes. Content processed by AI is transmitted encrypted and processed in the United States. The providers involved are listed, with their purpose, on the sub-processor page.

4. Google User Data & Limited Use Compliance

This section provides a comprehensive summary of how Adrata Inc. handles Google user data, in compliance with Google’s API Services User Data Policy:

What we access: Your name, email address, and profile picture via Google Sign-In; and, only if you separately connect a Google account, your Gmail messages, Google Calendar events, Google Contacts, and spreadsheets you select or have already approved for Sheets sync. Section 2.3 lists each scope and the data stored. We do not request whole-Drive access or access to your photos.
How we use it: Sign-in data authenticates your identity, creates your Adrata account, and displays your name and profile picture to your teammates. Connected mail, calendar, and contact data is used to provide the product features described in Section 2.3 — surfacing your conversations and meetings against the right account, sending messages you compose or approve and messages sent by sequences or automations you explicitly enable, and recognising people you already know.
How we store it: Google user data is stored in encrypted databases on AWS infrastructure with AES-256 encryption at rest and TLS 1.2+ in transit.
How we share it: We do not sell, rent, or lease Google user data. Our hosting and AI service providers, including Amazon Web Services and the AI providers listed on our Trust page, process Google user data on our behalf only to deliver the workspace features described here. Access within Adrata is governed by workspace permissions.
How to delete it: Disconnect the Google account in Settings, delete your account in Settings, or email privacy@adrata.com. Account deletion is scheduled after a 30-day window in which you can cancel it; Section 9.2 describes what happens next and when backup copies expire.
Human access: People at Adrata do not read your Google user data unless (a) you ask us to, for specific messages, for example in a support request; (b) it is necessary for security purposes, such as investigating abuse or a security incident; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized and is used for internal operations.
No other transfers: We transfer Google user data only as necessary to provide or improve the user-facing features described here with your consent, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.
How to revoke access: Revoke Adrata’s access at any time via your Google Account permissions page.
No generalized AI training: We do not use Google user data, or data derived from it, to develop, improve, or train generalized or non-personalized AI or machine-learning models, including foundation models. Learning shared across customers is switched off for connected-account data.
No advertising: Google user data is never used for advertising, including retargeting and personalized or interest-based advertising, and is never used to determine credit-worthiness or for lending.
Limited Use compliance: Adrata’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy.

5. Sharing and Disclosure of Information

5.1 Google User Data

We do not sell, rent, lease, or trade Google user data to any third party. We do not share Google user data with third parties for their own purposes. Our hosting and AI service providers, including Amazon Web Services and the AI providers listed on our Trust page, process connected Google data on our behalf to deliver the features described in Section 3.2. For example, email subjects and bodies are processed to support semantic search. Workspace permissions govern which members can access the resulting records.

We do not transfer Google user data to advertising networks, data brokers, or information resellers. Service-provider processing is limited to delivering the disclosed features for you, subject to Google's Limited Use requirements.

5.2 General Data Sharing

We may share non-Google personal information only in the following limited circumstances:

Service providers (sub-processors): Vendors who help us operate the Service, such as AWS for hosting and AI, Stripe for payment processing, WorkOS for sign-in, and the business-data, telephony, and video providers named on our sub-processor page. Each is bound by a contract that limits its use of your data to providing its service to us, and we give notice before adding a new one.
Your workspace: Information you add to a workspace, and activity you log there, is visible to other members of that workspace according to its permission settings, which your workspace administrator controls.
Services you connect: When you connect a CRM, mailbox, or other tool, data flows to and from that service at your direction, under that service’s own privacy policy.
Legal requirements: When required by law, court order, or government regulation. Where legally permitted we will tell you before we disclose your data
Safety: To protect the rights, safety, or property of Adrata, our users, or the public
Business transfers: In connection with a merger, acquisition, or sale of assets (you would be notified, and this policy would continue to apply to your data until it is changed with notice)

5.3 No Sale of User Data

Adrata does not sell any user data, including Google user data, to any party for any purpose. We have never sold user data and have no plans to do so. We also do not "share" personal information for cross-context behavioral advertising, and we do not sell or share the business contact information described in Section 6.

5.4 Text Messaging (SMS)

If you opt in to receive text messages from Adrata, we use your mobile number only to send the messages you requested and to respond to you. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. We do not sell, rent, or share mobile phone numbers or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. Mobile information may be shared with our messaging service provider (Telnyx LLC) and the wireless carriers that deliver messages, solely to deliver messages to you.

6. If You Are Not an Adrata User

You may be reading this because a company that uses Adrata has your business contact details in its workspace, or because you received a call, text, or email from someone using Adrata. This section is for you.

6.1 What we hold and where it comes from

Adrata processes business contact information only: the details described in Section 2.6, about you in your professional capacity. It comes from the customer’s own records and connected accounts, from public sources, and from licensed business-data providers. We do not collect personal email addresses, home addresses, or personal mobile numbers on purpose, and we do not process sensitive categories of data such as health, religion, or precise location about non-users. Each enriched field carries a record of which source it came from.

6.2 Why we process it and on what basis

The purpose is business-to-business sales and account management: helping a seller understand who is involved in a purchasing decision at your company and reach you professionally. We process this information on behalf of our customers as their service provider, and for our own account in the legitimate interest of maintaining accurate, de-duplicated business records (where the GDPR or UK GDPR applies, Article 6(1)(f)). We never use it for consumer marketing, advertising, credit, employment, insurance, or housing decisions, and our customers agree to the same restrictions in our Terms of Service.

6.3 Your choices

Opt out or delete. Email privacy@adrata.com or use our request form. We will confirm receipt, verify that the request relates to you, and respond within the time the law allows (at most 30 days under the GDPR and 45 days under the CCPA, extendable once with notice). We will delete the information Adrata holds for its own account. For each customer workspace where we find your record, we erase it and record a suppression entry (a one-way hash of your identifiers, not the identifiers themselves) so that workspace does not re-create the record from a data provider; where we cannot act for the customer, we tell you how to reach them.
Stop contact. Reply STOP to any text, ask the caller to stop, or use the unsubscribe link in an email. The Service records the opt-out and blocks further texts to your number from that workspace. Customers are responsible for honoring your request; if one does not, tell us.
See what we hold, or correct it. The same routes work for access and correction requests.
Object. Where the GDPR or UK GDPR applies you can object to processing based on legitimate interests at any time, and we will stop unless we can show compelling grounds.

Where the law requires us to tell people that we hold information about them that we did not collect from them directly, this policy is that notice. Providing individual notice to every person in every customer workspace would involve disproportionate effort, so we publish this policy, require our data providers to publish theirs, and honor every opt-out we receive.

7. Calling, Texting, and Recording

Who the sender is. Calls and texts placed through Adrata are made by our customer, from a number the customer owns or that we provision for them. The customer is responsible for having any consent the law requires before contacting you, and our Terms of Service require it.
Recording notice. Calls may be recorded and transcribed so the seller can review them later. Where the person being called is in a jurisdiction that requires every party’s consent, or where we cannot tell, the Service plays a spoken notice ("This call is recorded") before recording starts, and the call is not recorded if the notice cannot be played. A workspace can choose to play the notice on every call. Video meetings ask each participant for consent before capture begins.
Where recordings live. Recordings, voicemails, and transcripts are stored encrypted in Adrata’s AWS storage in the United States, are visible only to the workspace members who are permitted to see that call, and are transcribed by Amazon Transcribe. Our video provider (LiveKit) carries meeting media in transit and does not store it. Our telephony carrier (Telnyx) produces each call recording and keeps its own copy in its storage under the retention setting of our Telnyx account; that copy is not visible to anyone outside Adrata and Telnyx.
Getting a recording deleted. Anyone on a recorded call can ask us to delete the recording and transcript by emailing privacy@adrata.com. When a call record is deleted, or a recording is removed in response to a request, the stored audio is deleted from our storage by an automated job, normally within a day, and its versioned backup copy expires within 60 days. When a workspace closes, its recordings are deleted 30 days after closure (the export window in our Terms). A legal hold can pause deletion; we tell the workspace when one applies.
Text messages. Texts you exchange with an Adrata customer are stored in that customer’s workspace. Replying STOP opts you out and is recorded in a consent ledger that every send checks; replying START opts you back in. Sends are held outside reasonable hours in your local time. Section 5.4 covers texts that Adrata itself sends to people who opt in.
Caller ID. Calls show a real, working number, either the seller’s own verified number or a number we provision for the workspace. We do not permit caller-ID spoofing.

8. Data Security

We implement comprehensive security measures to protect your personal information, including Google user data:

Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
Encryption at rest: All data stored in our databases and file systems is encrypted at rest using AES-256 encryption via AWS
Access controls: Role-based access controls limit data access to authorized personnel only, and the database enforces row-level isolation between workspaces
Infrastructure security: Our application is hosted on Amazon Web Services (AWS) with industry-leading physical and network security
SOC 2: A SOC 2 Type II program is in progress. Adrata is not SOC 2 certified today, and we do not hold an audit report or attestation. See adrata.com/trust for current compliance status
Automated security scanning: Every change runs static analysis, secret scanning, dependency and infrastructure-as-code scanning in CI before it can be merged. No independent third-party penetration test has been performed to date
Secure authentication: Passwords are hashed using industry-standard algorithms; Google Sign-In uses OAuth 2.0 / OpenID Connect with no password stored
Incident response: If a security incident affects your personal information, we will notify affected customers and individuals without undue delay and within the time the law requires, and tell you what happened, what data was involved, and what we are doing about it

No system is perfectly secure. If you believe your account has been compromised or you have found a vulnerability, email security@adrata.com.

9. Data Retention and Deletion

9.1 Retention

We retain your personal information, including Google user data, for as long as your account is active or as needed to provide you with the Service. If your account is inactive for an extended period, we may notify you before taking any action regarding your data. In more detail:

Account data: for the life of the account; after you delete your account, it is deleted or anonymized when the 30-day cancellation window ends (Section 9.2)
Workspace data: for the life of the workspace, and for 30 days after it closes so it can be exported. Call and meeting recordings are then deleted automatically, and the rest of the workspace is deleted or anonymized by our team within a further 30 days
Connected mail, calendar, and contacts: until you disconnect the account, at which point synced mail and calendar events are removed as described in Section 2.3
Business contact records (Section 6): for the life of the workspace that holds them, or until we receive and verify an opt-out
Call recordings, voicemails, transcripts, and text messages: for the life of the workspace that holds them, unless a workspace member deletes them or a participant asks us to (Section 7)
Live demo recordings: 90 days (Section 9.3)
Form and booking submissions that could not be matched to a record: 30 days, after which the submitted details are erased; they are also erased sooner if the person they name asks us to delete their information
Vendor call logs (which provider we asked about which record): 90 days
Billing and tax records: as long as tax and accounting law requires
Security logs and backups: for a limited period needed for security and disaster recovery; database backups are encrypted and expire on a rolling 35-day cycle, so deleted data leaves backups within 35 days
Website analytics: as set out in our Cookie Policy

9.2 Deletion

You may request deletion of your account and all associated personal data at any time by:

Contacting us at privacy@adrata.com
Using the account deletion option in your account settings
Using our data request form

When you delete your account in settings we sign you out on every device at once, and deletion is scheduled 30 days later so you can cancel it by writing to support@adrata.com. When the 30 days end we permanently delete your sign-in, sessions, API keys, synced email, calendar and contacts, and the tasks and activity you created, anonymize your profile, and ask Google to revoke Adrata’s access; if an automated step fails, our team completes it within a further 14 days. You can also revoke our access directly from your Google Account permissions page (Section 9.4). Encrypted database backups that still contain deleted data expire automatically within 35 days after it is deleted from production. Requests made by email or through the form are answered within the times in Section 10. Some data may be retained longer only if required by law or for legitimate business purposes (e.g., fraud prevention, financial records). Deleting your account does not delete Customer Data your organization holds about you in its workspace; ask your workspace administrator for that.

9.3 Live Demo Recordings

If you take a live demo with us and the session is recorded, we tell you before the room opens, and you can ask us for your own copy afterwards. We keep recordings for 90 days and then delete them automatically. Either of us may ask for a recording to be deleted sooner — write to privacy@adrata.com and we will remove it. If you leave a phone number or an email address so we can call you back, we use it only to reach you about that demo.

9.4 Revoking Google Access

You can revoke Adrata’s access to your Google account data at any time through your Google Account permissions page. Revoking access there stops Adrata from reading or sending on your behalf, but does not delete data already synced. Disconnecting the account in Adrata’s settings removes synced mail and calendar events and requests revocation from Google. If Google does not confirm revocation, Adrata retries the request; remote revocation can remain pending. To delete other retained data, contact us or delete your account.

10. Your Rights and How to Exercise Them

Depending on your location, you may have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your data
Object to or restrict certain processing of your data
Export your data in a portable format
Withdraw consent at any time (where processing is based on consent)
Not be discriminated against for exercising any of these rights

To exercise any of these rights, use our data request form or contact us at privacy@adrata.com. What happens next:

Verification. We will confirm receipt and verify the request, usually by replying to the email address on record or, for non-users, by matching the details you give us to the record. We ask only for what we need to verify you.
Authorized agents. Someone may make a request on your behalf if they give us written permission signed by you or proof of legal authority; we may still ask you to confirm directly.
Timing. We respond within 30 days where the GDPR or UK GDPR applies and within 45 days under US state privacy laws. If we need longer we will tell you why and when to expect an answer.
If we say no. We will explain why. You can appeal by replying to our decision, and you can complain to your data protection authority (in the EEA or UK) or your state attorney general.
Data held for a customer. If the data is in a customer’s workspace, we will forward your request to the customer and help them respond (Section 1).

11. Notice to California Residents

This section is our notice at collection under the California Consumer Privacy Act, as amended ("CCPA"), to the extent the CCPA applies to Adrata. In the 12 months before the date above we collected the following categories of personal information, from the sources and for the purposes described in Sections 2 and 3, and disclosed them for a business purpose only to the service providers described in Section 5 and listed on our sub-processor page:

Identifiers (name, email address, phone number, IP address, account ID) — Sections 2.1, 2.6, 2.7, 2.8
Professional or employment-related information (employer, job title, work contact details) — Sections 2.1, 2.6
Commercial information (subscription, billing history, demo and purchase records) — Sections 2.1, 2.7
Internet or other electronic network activity (pages visited, features used, device and browser data) — Section 2.8
Audio, electronic, or visual information (call, voicemail, meeting, and demo recordings and their transcripts) — Sections 2.5, 9.3
Contents of communications you connect or send through the Service (email, calendar, text messages) — Sections 2.3, 2.4, 2.5
Inferences about accounts and deals derived from the above for the Service’s features — Section 3.3
Sensitive personal information: account credentials only, used solely to sign you in. We do not collect other categories of sensitive personal information and do not use or disclose sensitive personal information for any purpose that would trigger a right to limit

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. Because we do not sell or share, we do not offer a "Do Not Sell or Share" link. We have no actual knowledge that we sell or share the personal information of anyone under 16.
Retention for each category is described in Section 9.1.
Your rights to know, delete, correct, and not be discriminated against, and how to exercise them including through an authorized agent, are described in Section 10. You can also reach us at privacy@adrata.com.
Business contact data we hold for our customers is processed as a service provider. Where we act as a service provider we will direct your request to the business that collected it and assist them (Section 1).

12. If You Are in the EEA, the UK, or Switzerland

Controller and processor. Adrata Inc. is the controller for the processing described in Section 1 as "Adrata as controller." For Customer Data, our customer is the controller and we are its processor under our data processing addendum.
Lawful bases. Performing our contract with you (running your account and the Service); our legitimate interests (securing the Service, improving it, maintaining accurate business records, and business-to-business marketing to professionals, in each case after balancing them against your rights); your consent (marketing emails, optional cookies, text notifications, connected accounts); and legal obligations (tax, security, and responding to lawful requests).
International transfers. We are based in the United States and host all Service data there; our sub-processors and their locations are listed on the sub-processor page. Where a customer transfers personal data to us from the EEA, UK, or Switzerland, we sign the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum with that customer on request, and apply the security measures in Section 8. Ask at privacy@adrata.com.
Your rights are listed in Section 10, and you may lodge a complaint with your supervisory authority. We do not carry out automated decision-making that produces legal or similarly significant effects on you.

Residents of other jurisdictions with privacy laws (for example Canada, Australia, Brazil, and other US states) have comparable rights, and the same request routes apply.

13. Cookies and Tracking

We use essential cookies to maintain your session and authentication state. We may use analytics cookies to understand how the Service is used and to improve it. You can withdraw consent for any optional cookie at any time using the "Cookie Settings" link in our website footer, or through your browser preferences.

We do not run advertising or retargeting pixels. Adrata does not sell your personal information, and does not share it for cross-context behavioral advertising as those terms are defined by the California Consumer Privacy Act. See our Cookie Policy for the full list of what we do and do not load.

14. Children’s Privacy

The Adrata platform is designed for business use and is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised "Last updated" date. If a change materially reduces your rights or changes how we use data we already hold, we will also notify account holders by email or in the product at least 14 days before the change takes effect, and we will not apply the change to data collected under the old policy without your consent where the law requires it. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. Earlier versions are available on request.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: privacy@adrata.com
Data requests: adrata.com/privacy/dsar-request
Legal notices: legal@adrata.com
Company: Adrata Inc., Phoenix, Arizona, United States
Website: adrata.com