Privacy Policy

Your privacy matters to us. This Privacy Policy explains how Sdrs ("we," "us," or "our") collects, uses, stores, and protects your personal information when you use our website at sdrs.ai and our AI-powered sales development platform (collectively, the "Service"). We want you to understand exactly what happens with your data and why.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree with any part of this policy, please do not use the Service.

Information We Collect

Account Information

When you create an account on Sdrs, we collect the following information:

  • Email address: used for account authentication, sending verification codes, and transactional communications such as billing receipts and important service updates
  • Full name: used to personalize your account and identify you within team workspaces
  • Password: stored in a securely hashed format using industry-standard bcrypt encryption; we never store or have access to your plaintext password
  • Team and organization details: if you create or join a team workspace, we store the team name and membership information

Usage Data

We automatically collect certain information about how you interact with the Service. This includes:

  • Pages visited and features used within the platform
  • Campaign creation and outreach activity metrics (number of leads discovered, messages sent, replies received)
  • Session duration and frequency of use
  • Browser type, operating system, and device information
  • IP address and approximate geographic location derived from your IP address
  • Referring URLs and how you arrived at our website

Content You Provide

When you use the Service, you may provide content that we store on your behalf:

  • Lead data: prospect information you import via CSV uploads or discover through our lead finder, including names, email addresses, phone numbers, job titles, company names, and LinkedIn URLs
  • Campaign content: email templates, subject lines, message sequences, and outreach copy you create or that our AI generates for you
  • Connected email account credentials, SMTP and IMAP settings for email accounts you connect to send outreach through; these credentials are encrypted at rest
  • ICP descriptions: the ideal customer profile descriptions you provide to guide AI-generated content and lead discovery

Payment Information

When you subscribe to a paid plan, your payment is processed by Stripe, our third-party payment processor. We do not directly collect, store, or have access to your full credit card number or banking details. Stripe handles all payment processing in compliance with PCI DSS Level 1 standards. We receive and store only a limited set of billing information from Stripe, including the last four digits of your card, the card brand (Visa, Mastercard, etc.), expiration date, and billing address if provided.

How We Use Your Information

We use the information we collect for the following purposes:

  • Providing the Service: to operate the platform, run your outreach campaigns, discover leads, send messages on your behalf, and deliver the features you expect from Sdrs
  • Account management: to create and maintain your account, verify your identity through email codes, manage team memberships, and handle your subscription
  • AI-powered features: to generate personalized outreach messages, classify replies, research prospects, and create campaign sequences tailored to your ICP descriptions
  • Improving the Service: to analyze usage patterns, identify bugs, optimize performance, and develop new features that better serve our users
  • Billing and payments: to process subscription charges, issue invoices and receipts, manage plan upgrades and downgrades, and enforce usage limits
  • Communications: to send you transactional emails such as verification codes, billing confirmations, and important service announcements; we do not send marketing emails unless you explicitly opt in
  • Security and fraud prevention: to detect and prevent unauthorized access, abuse of the platform, and fraudulent activity
  • Legal compliance: to comply with applicable laws, regulations, and legal processes

Third-Party Services

We use a limited number of third-party services to operate the platform. Each of these services has their own privacy policy governing their use of your data:

  • Stripe: processes all payment transactions; handles credit card data directly and is PCI DSS Level 1 compliant
  • Email delivery providers: we use transactional email services to send verification codes and billing receipts; these providers process your email address for delivery purposes only
  • Cloud hosting infrastructure: our servers and databases are hosted on reputable cloud infrastructure providers that maintain SOC 2 compliance and offer data encryption at rest and in transit
  • AI model providers: we send anonymized or pseudonymized prompt data to AI model providers to generate personalized outreach content; your personal account information is not shared with these providers

We do not sell, rent, or trade your personal information to any third party. We do not share your data with advertisers or data brokers.

Cookies and Tracking

We use a minimal set of cookies that are necessary for the Service to function properly:

  • Session cookies: essential for maintaining your logged-in state and remembering your preferences during a browsing session; these expire when you close your browser
  • Authentication cookies: used to securely identify your account across requests and prevent unauthorized access; these are encrypted and HttpOnly
  • CSRF tokens: used to protect against cross-site request forgery attacks on form submissions
  • Advertising measurement cookie: set only when you arrive from one of our ads; see below

We do not use third-party tracking cookies, advertising pixels, or analytics services that track you across other websites. We do not engage in cross-site tracking or behavioral advertising.

Advertising measurement

We advertise on Google and Microsoft Bing. When you arrive from one of our ads, we keep the ad click identifier (such as gclid or msclkid) and the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term) in a first-party cookie for up to 90 days, and store them with your account when you sign up and with your checkout when you subscribe, so we know which ads lead to signups and purchases. The cookie is set only when the page address carries one of these parameters, and it is read only by this site. We do not load advertising tags or pixels, and we send no names, email addresses or payment details to advertisers. You can block or delete this cookie in your browser settings.

Data Retention and Deletion

We retain your account data and associated content for as long as your account exists.

Cancelling a paid subscription does not delete anything. Your campaigns, leads, replies and other content stay in your account after the paid period ends, and they are still there if you subscribe again later.

When you cancel, you can ask us to delete that content. We only do this for accounts that ask for it. If you do ask, we remove the content 30 days after your paid period ends, and we email you before that happens, so you have time to export your data or tell us to stop.

If you ask us to close your account, we will delete your personal data within 30 days of your request, subject to the following exceptions:

  • We may retain anonymized, aggregated data that cannot be used to identify you for analytics and product improvement purposes
  • We are required to retain certain billing and transaction records for a period of up to 7 years to comply with tax and accounting regulations
  • Data that is part of an active legal hold or investigation may be retained until the matter is resolved
  • Backups containing your data may persist for up to 90 days after deletion before they are fully purged from backup systems

You can request deletion of your account and associated data at any time by emailing us at [email protected]. We will confirm receipt of your request and process it within 30 days.

Data Security

We take the security of your data seriously and implement a range of technical and organizational measures to protect it:

  • All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
  • Sensitive data stored in our database, including email account credentials, is encrypted at rest using AES-256 encryption
  • Passwords are hashed using bcrypt with appropriate cost factors and are never stored in plaintext
  • Access to production systems is restricted to authorized personnel only and requires multi-factor authentication
  • We conduct regular security reviews and keep our software dependencies up to date to address known vulnerabilities
  • Rate limiting is applied to authentication endpoints to prevent brute-force attacks

While we strive to protect your data with industry-standard security measures, no method of electronic storage or transmission over the internet is completely secure. We cannot guarantee absolute security, but we are committed to promptly notifying affected users in the event of a data breach.

Your Rights Under GDPR (European Union Users)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have certain rights under the General Data Protection Regulation (GDPR) and equivalent legislation. These include:

  • Right of access: you can request a copy of the personal data we hold about you
  • Right to rectification: you can ask us to correct any inaccurate or incomplete personal data
  • Right to erasure: you can request that we delete your personal data, subject to certain legal exceptions
  • Right to restriction: you can ask us to temporarily restrict the processing of your personal data under certain circumstances
  • Right to data portability: you can request to receive your personal data in a structured, commonly used, machine-readable format
  • Right to object: you can object to the processing of your personal data for certain purposes, including direct marketing
  • Right to withdraw consent: where processing is based on your consent, you can withdraw that consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in your jurisdiction.

Our legal basis for processing your personal data depends on the specific context:

  • Performance of a contract: processing necessary to provide you with the Service you signed up for
  • Legitimate interests: processing necessary for our legitimate business interests, such as improving the Service and preventing fraud, provided those interests are not overridden by your rights
  • Consent: where you have given us specific consent to process your data for a particular purpose
  • Legal obligation: processing necessary to comply with legal requirements

California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). You have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information. To exercise your California privacy rights, please contact us at [email protected].

Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we discover that a child under 18 has provided us with personal information, we will promptly delete that information. If you believe a child has provided us with personal data, please contact us at [email protected].

International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your jurisdiction. When we transfer data internationally, we implement appropriate safeguards, including standard contractual clauses approved by relevant authorities, to ensure your data receives an adequate level of protection.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on our website and, where appropriate, sending you an email notification. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please reach out to us:

We are committed to working with you to resolve any privacy-related concerns promptly and transparently.