Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide when you register for an account, subscribe to our services, fill out forms, or communicate with us. This may include:

• Name, email address, and phone number
• Company name, job title, and business address
• Billing and payment information (processed securely through Stripe; we do not store full payment card numbers)
• Content you create using our platform, including scripts, blueprints, and media files
• Communications you send us, including support requests and feedback

1.2 Information Collected Automatically

When you access our services, we may automatically collect:

• Device and browser information (type, operating system, unique device identifiers)
• Log data (IP address, access times, pages viewed, referring URL)
• Usage data (features used, actions taken, session duration)
• Cookies and similar tracking technologies

1.3 Business Contact Data (Indirect Collection)

Our platform maintains a business intelligence database containing professional contact information that was not collected directly from the individuals concerned. This data is obtained from publicly available professional directories and business registries, licensed commercial data providers, professional networking platforms where information is publicly shared, and business websites and corporate filings.

Categories of personal data in this database include: professional email addresses, full names, job titles and roles, company names and company information (size, industry, website, founding date), professional social media profile URLs (LinkedIn, etc.), general geographic location (city, state, country), and inferred professional attributes (salary range, years of experience, skills).

We process this data under the lawful basis of legitimate interest for B2B commerce intelligence, product recommendation, and marketing analytics. We have conducted an internal assessment and determined that our legitimate interests in providing these services do not override the rights and freedoms of the data subjects, considering the professional nature of the data, the business-to-business context, and the availability of opt-out mechanisms.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing, maintaining, and improving our services
• Processing transactions and sending related information
• Sending administrative information, such as updates, security alerts, and support messages
• Responding to your comments, questions, and requests
• Analyzing usage patterns to improve user experience and develop new features
• Generating AI-powered content recommendations, scripts, and blueprints using third-party AI models
• Providing product intelligence and commerce analytics
• Sending marketing communications (with your consent, where required by law; you may opt out at any time)
• Detecting, preventing, and addressing technical issues, fraud, and security threats
• Complying with legal obligations

When personal data is processed through third-party AI services (such as OpenAI or Anthropic) for content generation, that data is transmitted under our data processing agreements with those providers and is not used by them to train their models.

3. How We Share Your Information

3.1 Service Providers and Subprocessors

We share data with third-party vendors and subprocessors who perform services on our behalf. These providers are contractually obligated to protect your data and process it only for the purposes we specify. Current categories of subprocessors include:

• Cloud hosting and infrastructure: DigitalOcean, Hetzner
• Payment processing: Stripe
• Email delivery: Amazon SES
• AI and language model services: OpenAI, Anthropic
• Voice synthesis: ElevenLabs
• Analytics and monitoring tools

A current list of our subprocessors is available upon request by emailing privacy@warhorsesystems.com. We will notify customers of material changes to our subprocessor list where required by applicable agreements.

3.2 Data Sharing and Disclosure Practices

Warhorse provides AI-powered tools that help our customers create content and analyze commerce opportunities. In the course of providing these services, business contact data maintained in our intelligence database may be made available to authorized platform users for B2B marketing intelligence, product routing, and commerce analytics purposes.

We do not sell personal information of our registered platform users (account holders) to third parties for monetary consideration. With respect to business contact data maintained in our commerce intelligence database, access to this data is provided as part of our subscription services. We are evaluating whether this activity constitutes a "sale" or "sharing" under the California Consumer Privacy Act and will update this policy accordingly. California residents may exercise their right to opt out by contacting privacy@warhorsesystems.com.

3.3 Other Disclosures

• Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
• Business Transfers: If Warhorse is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.
• With Your Consent: We may share your information for other purposes with your explicit consent.

4. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy or as required by law. Our retention practices vary by data category:

• Account and profile data: Retained for the duration of your subscription plus 90 days. Upon account deletion, usage data, AI-generated content, and profile information are deleted or anonymized within 90 days.
• Transaction and billing records: Retained for 7 years to comply with US tax and accounting regulations (IRS requirements).
• Business contact data (intelligence database): Retained according to source data refresh cycles and ongoing legitimate business need, or until a valid deletion request is received and processed.
• Server logs and technical data: Retained for up to 12 months for security and debugging purposes, then automatically purged.
• Email marketing engagement data: Retained for the duration of the marketing relationship. Unsubscribe and suppression records are retained indefinitely to ensure we honor opt-out requests.

You may request deletion of your personal data at any time by contacting privacy@warhorsesystems.com.

5. Data Security

We implement administrative, technical, and physical security measures designed to protect your personal information. Depending on the nature of the service, these measures may include encrypted data transmission (TLS/SSL), encryption of data at rest, access controls and authentication mechanisms, and monitoring for potential vulnerabilities. We continuously work to improve our security practices.

However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. In the event of a confirmed data breach affecting your personal information, we will notify affected individuals and relevant authorities as required by applicable law.

6. Your Privacy Rights

6.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You can request disclosure of what personal information we have collected, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You can request deletion of your personal information, subject to certain legal exceptions (such as retention for legal compliance).
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You can opt out of the sale or sharing of your personal information by contacting privacy@warhorsesystems.com or using any opt-out mechanism provided on our website.
• Right to Limit Use of Sensitive Personal Information: If we process sensitive personal information beyond what is necessary to provide services, you can request that we limit such use.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, contact privacy@warhorsesystems.com. You may also designate an authorized agent to make a request on your behalf, subject to identity verification. We will respond to verifiable requests within 45 days (with a possible 45-day extension for complex requests).

If you disagree with our response to your request, you may appeal by contacting privacy@warhorsesystems.com with the subject line "CCPA Appeal." You also have the right to lodge a complaint with the California Privacy Protection Agency at cppa.ca.gov.

6.2 European and UK Residents (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights:

• Right of Access (Article 15): You can request a copy of your personal data.
• Right to Rectification (Article 16): You can request correction of inaccurate or incomplete data.
• Right to Erasure (Article 17): You can request deletion of your personal data where no overriding legal basis for retention exists.
• Right to Restrict Processing (Article 18): You can request that we limit how we use your data.
• Right to Data Portability (Article 20): You can request a copy of your data in a structured, machine-readable format.
• Right to Object (Article 21): You can object to our processing of your data, including for direct marketing purposes. Where you object to direct marketing processing, we will cease such processing without exception.
• Right to Withdraw Consent (Article 7): Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where the alleged infringement occurred. A list of EU supervisory authorities is available at edpb.europa.eu.

Our lawful basis for processing business contact data obtained from third-party sources is legitimate interest (Article 6(1)(f)) in providing B2B commerce intelligence services. To exercise any of these rights, contact privacy@warhorsesystems.com. We will respond within 30 days.

6.3 EU/UK Representative

Warhorse Systems, LLC is established in the United States. Where required under Article 27 of the GDPR, we will appoint a representative in the European Union. If you are an EU or UK resident and wish to exercise your rights, you may contact us directly at privacy@warhorsesystems.com. Information about any appointed EU representative will be published on our website when applicable.

6.4 All Users

• Opt-Out of Marketing Emails: You can unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email or contacting privacy@warhorsesystems.com.
• Cookie Preferences: You can manage cookie preferences through your browser settings.
• Account Deletion: You can request deletion of your account by contacting privacy@warhorsesystems.com.

7. Commercial Email Compliance (CAN-SPAM)

Warhorse complies with the CAN-SPAM Act across all outbound email systems operated by Warhorse, including transactional communications, marketing emails, and outreach conducted through any Warhorse-controlled sending infrastructure. All commercial emails include:

• Clear identification as a commercial message where required
• Our valid physical mailing address
• A clear and conspicuous unsubscribe mechanism
• Accurate "From" and "Reply-To" information
• Honest and non-deceptive subject lines

We honor all unsubscribe requests within 10 business days. Suppression lists are synchronized across all Warhorse-operated sending systems to ensure opt-outs are respected regardless of which system processes the communication.

Where our platform enables customers to send or initiate commercial email communications, customers are responsible for ensuring their campaigns comply with CAN-SPAM, applicable state laws, and any additional requirements such as GDPR consent rules for EU recipients.

8. International Data Transfers

Your information may be transferred to and processed in the United States and other countries where our servers and service providers are located. If you are located outside the United States, please be aware that data protection laws in the United States may differ from those in your country.

For transfers of personal data from the EEA, UK, or Switzerland, we aim to rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission where required. We enter into Data Processing Agreements (DPAs) with customers and vendors that incorporate appropriate transfer safeguards.

We are actively working to formalize all necessary transfer mechanisms and will update this section as our compliance program matures. If you have questions about international transfers of your data, please contact privacy@warhorsesystems.com.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information promptly. If you believe we have collected information from a child, please contact us at privacy@warhorsesystems.com.

10. Third-Party Links

Our services may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new effective date and, where required, by email. Your continued use of our services after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to submit a data subject access request, contact us at: