GDPR & Compliance

How we protect your data: protected login, clear contracts, permanent deletion.

Everything about data protection and security of the platform, with a source to check.

Sign up for freeMarlon PulatYour contactBook a call with Marlon

At a glance

  • Germany

    Application and database

    With Hetzner Online GmbH.

  • Online

    Data processing

    Sign the agreement in your account, see the provider list.

  • Second factor

    Optional at login

    Authenticator app, passkey, recovery codes.

  • No training

    AI models

    According to the contract, not with your data.

What data does Sales Automation process?

Everything you store or connect in the platform, sorted by type. The fields are a selection.

Whose data?

  • Account and users

    Fields

    • Name
    • Job title
    • Email
    • Phone
    • Language
    • Password (hash only)
    • Session data (IP, last activity)

    Purpose

    Account, login, protection against abuse

    ResponsibleSales Automation

  • Contacts of your prospects

    Fields

    • Name
    • Position
    • Company
    • Email
    • Phone
    • LinkedIn profile
    • Location
    • Notes

    Purpose

    Outreach, enrichment, pipeline

    ResponsibleYou

  • Company data

    Fields

    • Name
    • Website
    • Size
    • Revenue
    • Address
    • Legal form
    • Register number

    Purpose

    Check target groups, classify companies

    ResponsibleYou

  • Messages

    Fields

    • Text of email, LinkedIn, WhatsApp and other channels
    • Sender and recipient
    • Attachments
    • AI classification (category, sentiment)

    Purpose

    Inbox, reply suggestions

    ResponsibleYou

  • Calendar and meetings

    Fields

    • Free or busy
    • Meetings booked by you
    • Title and attendees of other meetings only with your consent
    • Already imported meetings remain stored

    Purpose

    Booking, conversation context

    ResponsibleYou

  • Recorded meetings

    Fields

    • Video (default: deleted after 30 days)
    • Transcript (stays stored)
    • Summary and coaching

    Purpose

    Meeting notetaker

    ResponsibleYou

  • Telephony

    Fields

    • Phone numbers
    • Duration
    • Outcome
    • Notes
    • Recording (only if you enable it)

    Purpose

    Document calls

    ResponsibleYou

  • Website visitors

    Fields

    • Matching to companies by IP address
    • IP address and browser details
    • Referrer and pages visited
    • Time on site
    • Company details from the provider, e.g. managing directors

    Purpose

    Recognise companies on your website (optional)

    ResponsibleYou

  • Billing

    Fields

    • Billing address
    • Payment details
    • Subscription

    Purpose

    Invoices and payments

    ResponsibleSales Automation

  • Technical logs

    Fields

    • Calls to enrichment and register services (service, status, response time, error)

    Purpose

    Operations and troubleshooting

    ResponsibleSales Automation

  • Records about your data

    Fields

    • Deletion log
    • AI decisions in the inbox

    Purpose

    Traceability for you

    ResponsibleYou

Who is responsible?

  1. You

    Controller

    Controller for the data you store and use in your workspace.

  2. Sales Automation

    Processor

    Processes this data on your behalf. We are responsible ourselves for website, marketing, billing and account.

  3. Independent data sources

    Own responsibility

    Lusha and OpenRegister supply data under their own responsibility. You remain responsible for its use.

Data processing agreement, sections 1, 3 and 10, and privacy policy

Where does the data come from?

Depending on the module, for example by these routes. For each route, it says who is responsible.

Choose a route.

From you

What comes from there
CSV lists, import from HubSpot and Salesforce, notes and corrections.
Country
Depending on your source
Responsibility
You are responsible.
You ensure the legal basis and the information duties.

The list gives examples and is not exhaustive. The providers in the data processing agreement are listed in Annex 2.

Four layers of protection at a glance.

Example

Schematic view with made-up data.

Two-factor authentication in your account settings.

Turn it on yourself. Login then asks for a second step.

How to find it

  1. Profile picture top right
  2. Profile
  3. Two-factor authentication

  • Authenticator app

    Six-digit code from your app.

  • Device passkey

    Unlock with fingerprint, face or device PIN.

  • Recovery codes

    Eight codes for emergencies, also as PDF.

  • Accounts can turn it on themselves
  • Entry limited to 5 attempts per minute
  • A passkey does not replace the password

AI and AI transparency.

Which models work, what goes to the providers and who decides in the end.

  • No training with your data

    According to the contract, neither we nor our sub-processors train AI models with your data.

    Data processing agreement, section 4

  • You choose the model too

    For AI replies in the inbox you choose model and fallback model per workspace from a selected list from OpenAI, Anthropic and Google.

    Inbox automation settings

  • Your data belongs to you

    You remain the owner of the data you bring in or that arises in your workspace. You export leads, statistics and replies as CSV or Excel.

    Terms and conditions, section 10

  • Separated per workspace

    Knowledge base, tone of voice, pitch and reply examples apply only to your workspace. The separation is logical, in software.

    Data processing agreement, Annex 3

How an AI reply in the inbox comes about.

Flow

  1. Message arrives

    A contact replies to your message.

  2. Your model reads

    The model you chose classifies the reply and writes a draft. If it fails, your fallback model takes over.

  3. Rules check

    If the classification is less than 80 percent certain, a human always decides.

  4. You approve

    Automatic sending is off by default, new mailboxes start with drafts. Autopilot only answers interest, meeting proposals and follow-up questions.

  5. Everything is logged

    The decision log shows model, classification and outcome of every AI decision.

What you should know

  • The providers receive the content needed for the request, for example message text and contact details, for meetings transcript and calendar title.
  • The contracting parties are OpenAI Ireland, Anthropic Ireland and Google Ireland. Access from the USA is possible and covered by standard contractual clauses, for Google additionally by the EU-US Data Privacy Framework.
  • Providers may log requests. We do not promise deletion immediately after the reply.
  • Setup data such as knowledge base and reply examples is stored in our application with Hetzner in Germany. Files are stored in Google Cloud.
  • You cannot store your own API keys today. We manage the providers' keys.

See it yourself

See the platform with your own data.

Sign up, set up a target group, review the settings.

Sign up for free

Where your data is processed.

We name what we can prove. More in Annex 2 of the data processing agreement. Ask us about further providers.

  • Application and database

    With Hetzner Online GmbH in Germany.

  • Files

    In Google Cloud, the contracting party is Google Ireland Limited.

  • AI providers

    The contracting parties are OpenAI Ireland Limited and Anthropic Ireland, Limited. According to the contract, no training of AI models with your data. Access from the USA is possible and covered by standard contractual clauses.

Security measures in detail

As stated in the data processing agreement, Annex 3. These are contractual commitments.

    • User and password
    • Optional two-factor authentication by authenticator app, with confirmed setup and recovery codes
    • Email confirmation of new accounts
    • Limited login attempts and code entries
    • Firewall for servers and network
Questions about data protectionData protection officergrace@sales-automation.ai

Evidence table: what we say and where you can check it.

Every statement on this page with its source. As of November 2026.

  • Statement

    No training of AI models with your data

    Where to check it

    Data processing agreement, section 4 and Annex 3 (M.5)

  • Statement

    Automatic sending of AI replies is off by default, decisions are logged

    Where to check it

    Data processing agreement, Annex 3 (M.5)

  • Statement

    You remain the owner of your data, return or deletion at contract end

    Where to check it

    Terms and conditions, section 10, and data processing agreement, section 17

  • Statement

    Data types and data subjects: default categories in Annex 1, you can request deviations

    Where to check it

    Data processing agreement, Annex 1

  • Statement

    You are the controller, Sales Automation the processor

    Where to check it

    Data processing agreement, section 3

  • Statement

    Lusha and OpenRegister supply data under their own responsibility

    Where to check it

    Data processing agreement, Annex 2 part B

  • Statement

    Two-factor login with authenticator app, passkey or recovery code

    Where to check it

    Account: Profile, Two-factor authentication

  • Statement

    Login and code entry limited, credentials and tokens stored encrypted

    Where to check it

    Data processing agreement, Annex 3 (technical and organisational measures)

  • Statement

    Data logically separated per workspace, support access per contract through impersonated sign-in

    Where to check it

    Data processing agreement, Annex 3

  • Statement

    Data processing agreement can be signed in the account, sub-processors listed in Annex 2

    Where to check it

    Data processing agreement, Annex 2

  • Statement

    Application and database in Germany, AI providers without model training

    Where to check it

    Data processing agreement

  • Statement

    Permanently delete contacts, block list, one-click unsubscribe in the email client

    Where to check it

    Platform: contacts and campaigns

  • Statement

    Meeting videos are deleted automatically after 30 days by default, transcript and summary remain

    Where to check it

    Meeting notetaker, automatic deletion setting

Not legal advice. The data processing agreement and the privacy policy are authoritative.

Frequently asked questions

Can I bring my own API key for AI?

Not today. We manage the AI providers' keys. You do choose the model and the fallback model for the AI replies in the inbox yourself.

Who decides whether an AI reply is sent?

You do. Automatic sending is off by default. Autopilot can be set per mailbox and only answers interest, meeting proposals and follow-up questions, when the classification is highly certain.

What happens to my data at the end of the contract?

Within 30 days you choose whether your data is returned in a machine-readable format (for example CSV or JSON) or deleted. Statutory retention obligations remain.

What data does Sales Automation process?

Contact and company data of your prospects, messages, calendar and meeting data, telephony, visitors of your website as well as account, billing and log data. Which of these apply to you depends on the modules you use.

Where does the contact data come from?

From your own lists and connections, from public registers and from data providers, depending on the module. Lusha and OpenRegister supply under their own responsibility. The providers named are examples, not a complete list. You remain responsible for the legal basis and your information duties.

Who is responsible for the data?

For all data you store in the platform, you are the controller and we are the processor. For our website, our marketing, billing and your account, we are responsible ourselves.

Where is my data stored?

The application and database run with Hetzner Online GmbH in Germany. Files are stored in Google Cloud. The sub-processors named in the contract are listed in Annex 2 of the data processing agreement. Ask us about further providers.

How do I turn on two-factor authentication?

Click your profile picture at the top right, choose Profile and enable the authenticator app under two-factor authentication. Then confirm the setup with a code. You can also register a device passkey.

What if I lose my device?

Use a recovery code. You get eight codes that you can show and download as PDF. Keep them apart from your device.

Does a passkey replace my password?

No. A device passkey is a second step after the password, not a replacement for it.

Is my data used to train AI?

According to the data processing agreement, OpenAI and Anthropic do not train their AI models with your data.

How do I sign the data processing agreement?

As a rule, the owner of the workspace signs it in the account and can retrieve the document afterwards. You can read the text beforehand at /avv.

How do I delete contacts?

Contacts can be permanently deleted in your workspace. This is logged internally. The contact itself is removed for good once it is no longer held in any workspace. It can be put on the block list at the same time, which is the default.

Next up

Personal call

Questions about data protection or technology? Talk to us.

We answer your questions and show the settings in the platform.

What you get from the call

  • Answers to your questions on data protection and technology.
  • A look inside the platform using an example from your industry.
  • A concrete proposal for the next steps, with no obligation.
Portrait of Marlon Pulat, Head of Growth at Sales Automation

Marlon Pulat

Head of Growth