Privacy Policy

Last updated October 13, 2026

This Privacy Policy for Aphily, Inc. (doing business as Aphily) ("we", "us" or "our") describes how and why we might access, collect, store, use and/or share ("process") your personal information when you use our services ("Services"), including when you:

• visit our website at https://www.aphily.com, or any website of ours that links to this Privacy Policy;
• use Aphily. Aphily provides an AI platform that runs business-to-business outbound sales for companies: market and company research, prospect sourcing and verification, outreach by email and social messaging, a shared inbox for replies, and reporting. The Services include our website at https://www.aphily.com, our web application at https://app.aphily.com, and any related services we provide; or
• engage with us in other related ways, including any marketing or events.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you have any questions or concerns, please contact us at info@aphily.com.

1. What information do we collect?

Personal information you disclose to us. In short: we collect personal information that you provide to us. We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services, or otherwise contact us.

Personal information provided by you. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. It may include:

• names;
• email addresses;
• job titles;
• usernames;
• passwords;
• contact preferences;
• contact or authentication data;
• billing addresses;
• payment details, which our payment processor Stripe collects and stores (we do not receive or store full card numbers);
• company information, such as company name, website and the products or services you want to sell; and
• business content you upload to the Services, such as company presentations, customer and exclusion lists, campaign settings, approved messages and replies received in your inbox.

Sensitive information. We do not process sensitive information.

Payment data.All payment data is handled and stored by Stripe. Your card details are collected and stored by our payment processor, Stripe. We never receive or store your full card number. We receive only limited payment information, such as the card type, the last four digits, the expiry date and the billing address, to manage your subscription and invoices. You can find Stripe's privacy notice at https://stripe.com/privacy.

All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to it.

Information automatically collected. In short: some information, such as your Internet Protocol (IP) address and browser and device characteristics, is collected automatically when you visit our Services. We automatically collect certain information when you visit, use or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, approximate location, information about how and when you use our Services, and other technical information. We need this information mainly to maintain the security and operation of our Services and for our internal analytics and reporting. Like many businesses, we also collect information through cookies and similar technologies; see our Cookie Policy. The information we collect includes:

• Log and usage data. Service-related, diagnostic, usage and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, it may include your IP address, device information, browser type and settings, information about your activity in the Services (such as date and time stamps, pages and files viewed, searches and the features you use) and device event information (such as system activity, error reports and hardware settings).
• Device data. Information about the computer, phone, tablet or other device you use to access the Services, which may include your IP address (or proxy server), device and application identification numbers, approximate location, browser type, hardware model, internet service provider, operating system and system configuration information.
• Session recordings. On our website, and only if you accept analytics cookies, our analytics provider records how pages are used (clicks, scrolling and page errors) to help us improve the site. These recordings do not include the booking calendar, which runs in a separate frame.

Information collected from other sources. In short: we may collect limited business contact information from business data providers, public databases and public professional profiles. We obtain information about business professionals from other sources, such as business data providers, public databases and public professional profiles. This information includes names, job titles, employers, work email addresses and the addresses of public professional profiles. We use it to find and contact relevant business prospects for our customers and for our own sales. Section 14 explains this in full. We do not use these sources to add to the information we hold about our own users.

2. How do we process your information?

In short: we process your information to provide, improve and administer our Services, communicate with you, keep the Services secure, prevent fraud and comply with law. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To create and authenticate accounts and otherwise manage user accounts. So that you can log in to your account and keep it in working order.
• To deliver and facilitate delivery of services to the user. To provide you with the requested service.
• To respond to user inquiries and offer support to users. To answer your questions and solve any issues you may have with the Services.
• To send administrative information to you. Details about our products and services, changes to our terms and policies, and similar information.
• To fulfill and manage your orders. To manage your subscription, orders and payments made through the Services.
• To request feedback. To ask for feedback and contact you about your use of our Services.
• To send you marketing and promotional communications. If this is in line with your marketing preferences. You can opt out of our marketing emails at any time; see Section 11.
• To find, verify and contact business prospects.To find relevant business contacts for our customers, verify their contact details, run our customers' outreach and keep a do-not-contact list so that people who opt out are not contacted again (see Section 14).
• To protect our Services. As part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To identify usage trends. To understand how our Services are used so that we can improve them.
• To save or protect an individual's vital interest. Where necessary to prevent harm.

3. What legal bases do we rely on to process your information?

In short: we only process your personal information when we believe it is necessary and we have a valid legal reason (a legal basis) to do so under applicable law, such as your consent, compliance with law, providing our Services under a contract, protecting your rights, or our legitimate business interests.

If you are located in the EU or UK, this applies to you. The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases we rely on to process your personal information. We may rely on:

• Consent. Where you have given us permission to use your personal information for a specific purpose, such as analytics cookies. You can withdraw your consent at any time (see Section 11).
• Performance of a contract. Where processing is necessary to fulfill our contractual obligations to you, including providing our Services, or at your request before entering into a contract with you.
• Legitimate interests. Where processing is reasonably necessary for our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, to: send customers information about our products and services; analyze how our Services are used so that we can improve them; diagnose problems and prevent fraudulent activities; and find and contact relevant business prospects, as explained in Section 14.
• Legal obligations. Where processing is necessary to comply with our legal obligations, such as keeping tax records, cooperating with a law enforcement body or regulator, exercising or defending our legal rights, or disclosing information as evidence in litigation.
• Vital interests. Where processing is necessary to protect your vital interests or those of a third party, such as in situations involving potential threats to the safety of any person.

If you are located in Canada, this applies to you. We may process your information if you have given us specific permission (express consent), or where your permission can be inferred (implied consent). You can withdraw your consent at any time. In some exceptional cases, the law may permit us to process your information without your consent, for example: if collection is clearly in the interests of an individual and consent cannot be obtained in a timely way; for investigations and fraud detection and prevention; for business transactions provided certain conditions are met; if it is contained in a witness statement and the collection is necessary to assess, process or settle an insurance claim; for identifying injured, ill or deceased persons and communicating with next of kin; if we have reasonable grounds to believe an individual has been, is or may be a victim of financial abuse; if it is reasonable to expect that collection and use with consent would compromise the availability or accuracy of the information and the collection is reasonable for investigating a breach of an agreement or a contravention of the laws of Canada or a province; if disclosure is required to comply with a subpoena, warrant, court order or rules of the court relating to the production of records; if it was produced by an individual in the course of their employment, business or profession and the collection is consistent with the purposes for which it was produced; if the collection is solely for journalistic, artistic or literary purposes; or if the information is publicly available and is specified by the regulations. We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

4. When and with whom do we share your personal information?

In short: we may share information in the situations described in this section and with the following categories of third parties.

Vendors, consultants and other third-party service providers. We may share your data with third-party vendors, service providers, contractors or agents who perform services for us or on our behalf and need access to the information to do that work. We have contracts in place with them that are designed to help safeguard your personal information. They may not do anything with your personal information unless we have instructed them to, they may not share it with any organization apart from us, and they commit to protect the data they hold on our behalf and to keep it only for the period we instruct. The categories of third parties we may share personal information with are:

• AI platforms;
• cloud computing services;
• communication and collaboration tools;
• data analytics services;
• data storage service providers;
• finance and accounting tools;
• government entities;
• payment processors;
• performance monitoring tools;
• messaging infrastructure providers that deliver and receive the messages of the campaigns you approve;
• providers that connect the accounts you link to the Services, so that we can run the campaigns you approve;
• website hosting service providers; and
• customer relationship and support tools we use to manage our relationship with you.

Our customers. For prospect information, we share it with the customer whose campaign you are part of (see Section 14).

Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or part of our business by another company.

5. Do we use cookies and other tracking technologies?

In short: we use cookies and similar technologies for analytics and to remember your choices. We do not use them for advertising.

We use cookies and similar tracking technologies to gather information when you interact with our Services. Some of them help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences and support basic site functions. Others, with your consent where the law requires it, help us understand how our website is used. We do not use advertising cookies or pixels, and we do not allow third parties to use tracking technologies on our Services for advertising. Specific information about the technologies we use and how you can refuse certain cookies is in our Cookie Policy.

Google Analytics. We may share your information with Google Analytics to track and analyze the use of the Services. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. For more information on Google's privacy practices, see https://policies.google.com/privacy.

6. Do we offer artificial intelligence-based products?

In short: we offer products, features and tools powered by artificial intelligence, machine learning and similar technologies.

As part of our Services, we offer products, features and tools powered by artificial intelligence, machine learning or similar technologies ("AI Products"). This Privacy Policy governs your use of the AI Products within our Services. Our AI Products are designed for the following functions:

• AI automation;
• AI document generation;
• AI insights;
• AI research;
• AI translation;
• AI bots;
• natural language processing;
• text analysis;
• AI search; and
• AI applications.

How we process your data using AI. All personal information processed using our AI Products is handled in line with this Privacy Policy and our agreements with third parties. Section 17 explains how we use AI, the decisions we do not make, and our commitment not to train AI models on your information.

7. Is your information transferred internationally?

In short: we may transfer, store and process your information in countries other than your own.

Our servers are located in the United States and Germany. Regardless of your location, your information may be transferred to, stored by and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information (see Section 4), including facilities in the United States, Germany and other countries. If you are a resident of the European Economic Area (EEA), the United Kingdom (UK) or Switzerland, these countries may not have data protection laws as comprehensive as those in your country. However, we take all necessary measures to protect your personal information in accordance with this Privacy Policy and applicable law. Section 19 gives more detail, including on Türkiye, Saudi Arabia and the UAE.

European Commission's Standard Contractual Clauses. We use the European Commission's Standard Contractual Clauses for transfers of personal information between us and our third-party providers. These clauses require all recipients to protect all personal information that they process originating from the EEA or UK in accordance with European data protection laws and regulations. Our Standard Contractual Clauses can be provided on request. We have implemented similar appropriate safeguards with our third-party service providers and partners, and further details can be provided on request.

8. How long do we keep your information?

In short: we keep your information for as long as necessary to fulfill the purposes in this Privacy Policy, unless the law requires otherwise.

We keep your personal information only for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements):

• Account and usage information: while the account is open, and up to 90 days after it closes.
• Billing, payment and tax records: 7 years.
• Support messages: 2 years after the last message.
• Security and log-in records: 12 months.
• Website analytics and session recordings: as set out in our Cookie Policy.
• Recordings and transcripts of calls with us: up to 24 months after the call.
• Prospect information, including our assessments and outreach history: up to 24 months after it was last used in a campaign.
• Do-not-contact and marketing opt-out records: as long as needed to keep the opt-out working.
• Information we process for a customer's campaigns: as the customer instructs, and deleted or returned when its contract ends, as set out in our Data Processing Addendum.

We may keep information longer where the law requires it, or to establish, exercise or defend legal claims. When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it, or, if this is not possible (for example, because it is stored in backup archives), we will securely store it and isolate it from any further processing until deletion is possible.

9. How do we keep your information safe?

In short: we aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. Do we collect information from minors?

In short: we do not knowingly collect data from or market to children under 18 years of age, or the equivalent age specified by law in your jurisdiction.

We do not knowingly collect, solicit data from or market to children under 18 years of age, or the equivalent age specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or the equivalent age specified by law in your jurisdiction. If we learn that personal information from users under that age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under that age, please contact us at info@aphily.com.

11. What are your privacy rights?

In short: depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland and Canada, you have rights that give you greater access to and control over your personal information. You may review, change or terminate your account at any time, depending on your country, province or state of residence.

In some regions (like the EEA, UK, Switzerland and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access to and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us using the details in Section 22. We will consider and act on any request in accordance with applicable data protection laws.

If you are located in the UK and are unhappy with how we have handled your personal information, you can complain directly to us, in addition to your rights under the UK GDPR and the Data Protection Act 2018. Email info@aphily.com or write to us at the address in Section 22. We will acknowledge your complaint within 30 days of receiving it, investigate without unjustifiable or excessive delay, keep you informed of progress and explain the outcome. If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office (ICO), the UK supervisory authority: website ico.org.uk/make-a-complaint; helpline 0303 123 1113; post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority (https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm) or the UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/edoeb/en/home.html).

Withdrawing your consent. If we are relying on your consent to process your personal information, which may be express or implied consent depending on the applicable law, you can withdraw it at any time by contacting us using the details in Section 22. This will not affect the lawfulness of the processing before its withdrawal nor, where applicable law allows, processing based on lawful grounds other than consent.

Opting out of marketing and promotional communications. You can unsubscribe from our marketing and promotional communications at any time by replying "unsubscribe" or "stop" to any of our marketing emails, or by emailing us at info@aphily.com. We will stop sending you marketing emails, but we may still send you service and billing messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account information. If you would like to review or change the information in your account, or terminate your account, contact us using the details provided. We create your account after purchase and send your login details to the email address you gave us. To change your details or close your account, email us at info@aphily.com. When you ask us to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may keep some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms or comply with applicable legal requirements.

Cookies and similar technologies. Most web browsers are set to accept cookies by default. If you prefer, you can usually set your browser to remove or reject cookies. If you choose to remove or reject cookies, this could affect certain features of our Services. For more information, see our Cookie Policy.

If you have questions or comments about your privacy rights, you may email us at info@aphily.com.

12. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems and applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal that you do not want data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will tell you about that practice in a revised version of this Privacy Policy. California law requires us to let you know how we respond to web browser DNT signals: because there is currently no industry or legal standard for recognizing or honoring them, we do not respond to them at this time.

Global Privacy Control. We recognize and honor Global Privacy Control (GPC) signals. If you use a browser or extension that supports GPC, we will treat this as a valid request to opt out of the sale or sharing of your personal information for targeted advertising under applicable state privacy laws, including the California Consumer Privacy Act (CCPA). When we detect a GPC signal from your browser, we automatically apply your opt-out preference without requiring you to take any additional action. For more information about GPC and how to enable it, visit globalprivacycontrol.org.

13. Do United States residents have specific privacy rights?

In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect. The table below shows the categories of personal information we have collected in the past twelve (12) months. For a full description, see Section 1.

We may also collect other personal information outside these categories when you interact with us in person, online, or by phone or mail in the context of: receiving help through our customer support channels; participating in customer surveys or contests; and the delivery of our Services and responses to your inquiries.

We use and keep the collected personal information as needed to provide the Services, and for:

• Category A: account information for as long as your account is active and up to 90 days after, billing records for 7 years, security and login logs for 12 months, website analytics data for the periods set out in our Cookie Policy, prospect records for up to 24 months after their last use, and a minimal do-not-contact record for as long as needed to honour an opt-out.
• Category B: account information for as long as your account is active and up to 90 days after, billing records for 7 years, prospect records for up to 24 months after their last use, and a minimal do-not-contact record for as long as needed to honour an opt-out.
• Category C: up to 24 months after it was last used in a campaign.
• Category D:purchase and billing records for 7 years, and records of a prospect's replies or interest for up to 24 months after their last use in a campaign.
• Category F: website analytics data for the periods set out in our Cookie Policy, product usage data for as long as your account is active and up to 90 days after, and security and login logs for 12 months.
• Category G: approximate location data derived from IP addresses for the periods set out in our Cookie Policy. We do not collect precise location.
• Category H: recordings and transcripts of sales and customer meetings for up to 24 months after the meeting, and website session recordings for the periods set out in our Cookie Policy.
• Category I:professional information about prospects for up to 24 months after its last use in a campaign, and our users' role and company details for as long as their account is active and up to 90 days after.
• Category K: inferences are kept with the prospect record for up to 24 months after its last use in a campaign.

Sources of personal information. See Section 1 and Section 14.

How we use and share personal information. See Section 2 and Section 4.

Will your information be shared with anyone else?We may disclose your personal information to our service providers under a written contract between us and each service provider (see Section 4), and prospect information to the customer whose campaign the prospect is part of (see Section 14). We may use your personal information for our own business purposes, such as internal research for technological development and demonstration; this is not "selling" your personal information. We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months: Category A (identifiers); Category B (personal information as defined in the California Customer Records law); Category C (characteristics of protected classifications under state or federal law); Category D (commercial information); Category F (internet or other electronic network activity information); Category G (geolocation data); Category H (audio, electronic, visual and similar information); Category I (professional or employment-related information); and Category K (inferences drawn from collected personal information). The categories of third parties to whom we disclosed personal information are listed in Section 4.

Your rights.You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases we may decline your request as permitted by law. They include the right to know whether we are processing your personal data; to access your personal data; to correct inaccuracies in your personal data; to request the deletion of your personal data; to obtain a copy of the personal data you previously shared with us; to non-discrimination for exercising your rights; and to opt out of the processing of your personal data for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling"). Depending on the state where you live, you may also have the right to: access the categories of personal data being processed (for example, under Minnesota law); obtain a list of the categories of third parties to which we have disclosed personal data (for example, under California, Delaware and Maryland law); obtain a list of specific third parties to which we have disclosed personal data (for example, under Minnesota and Oregon law); obtain a list of third parties to which we have sold personal data (for example, under Connecticut law); review, understand, question and, depending on where you live, correct how personal data has been profiled (for example, under Connecticut and Minnesota law); limit the use and disclosure of sensitive personal data (for example, under California law); and opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (for example, under Florida law).

How to exercise your rights. Email us at info@aphily.com, write to us at Aphily, Inc., 2810 N Church St, STE 88768, Wilmington, DE 19802, USA, or use the contact details at the end of this Privacy Policy. We will honor your opt-out preferences if you enable the Global Privacy Control (GPC) opt-out signal in your browser. Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request verification. When we receive your request, we will need to verify your identity to determine that you are the same person about whom we hold the information. We will use personal information provided in your request only to verify your identity or authority to make the request. If we cannot verify your identity from the information we already hold, we may ask you for additional information for verification, security or fraud-prevention purposes. If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing the request, and the agent will need to provide written and signed permission from you to submit it on your behalf.

Appeals. Under certain US state data protection laws, if we decline to take action on your request, you may appeal our decision by emailing us at info@aphily.com. We will inform you in writing of any action taken or not taken in response to the appeal, with a written explanation of the reasons. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" law. California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits California residents to request and obtain from us, once a year and free of charge, information about the categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please send it in writing using the contact details in Section 22.

14. Business contacts we or our customers contact

This section is our notice to business professionals whose information we did not receive from them directly. We hold business contact information about professionals: name, job title, seniority, employer, work history, work location (city and country), the address of a public professional profile, work email address and whether it can receive mail, company details (such as industry, size and public business news), our assessment of whether the person is a relevant contact for a customer, and the history of messages sent through our platform and the replies. To address people correctly (for example "Mr" or "Ms", or "Bey" or "Hanım" in Turkish), we may infer a person's likely gender from their first name; if the result is uncertain, a person checks it or we use a neutral greeting.

We obtain this information from business data providers under contracts that permit this use, from public sources such as company websites, public professional profiles, business registries and news, from our own records and email verification checks, and, for a customer's campaign, from that customer. You can ask us which source your information came from.

We use it to find relevant business contacts for our customers, to verify contact details, to run our customers' outreach, to promote Aphily's own services to businesses, and to keep a record of anyone who has asked not to be contacted. Our legal basis is our legitimate interest in business-to-business communication. We limit what we do accordingly: we use only business information, contact people in their professional role, do not collect phone numbers or sensitive information for outreach, and do not use open-tracking pixels or tracked links in outreach emails.

We share the information with the customer whose campaign you are part of, and with our service providers. Our customers may not sell or pass on that information. We keep it for up to 24 months after it was last used in a campaign, and then delete it.

You can object at any time by replying to any message sent through our platform or by emailing info@aphily.com. We then add you to our do-not-contact list. That list applies to every Aphily customer, not only the one that contacted you, and it stays in force after that customer leaves Aphily. To keep that promise we keep a minimal record (such as your email address or a coded version of it, the date and the scope of your request) and use it only to stop further contact.

15. Our role and messages sent through Aphily

We decide how personal information is used (we are the "controller") for our website, customer accounts, billing and support, our own sales and marketing, the business contact information in our own database (including our decisions about which companies and people to source), and security and service-improvement data.

When we run outreach for a customer, the customer decides whom to contact, what to say and why, and approves the campaign before anything is sent. For that work we process personal information on the customer's behalf, as its processor and service provider, under our Data Processing Addendum. The company named in a message sent through Aphily is the sender and is responsible for it. If you contact us about such a message, we may tell you which customer sent it and pass your request on to that customer, and we also apply any opt-out to our own records.

If a court or a data protection authority decides that we and a customer are joint controllers, the customer is responsible for its legal basis for contacting each person and for the notices in its messages, we are responsible for the lawfulness of our own sourcing and for requests about our own database, and you can exercise your rights with either of us.

16. Connected accounts

If you connect a professional networking account or a mailbox to our platform, we access it only to send, receive and track the messages of the campaigns you approve and to show you the replies. We do not use it for any other purpose, and you can disconnect it at any time.

17. Artificial intelligence and automated decisions

Our AI agents research companies and markets, choose prospects that fit a customer's target market, write and classify messages, and prepare reports. A customer approves its campaigns before anything is sent. Our assessments are used only to decide whom to contact, when and with what message. We do not make decisions that have legal or similarly significant effects on people, such as decisions about employment, credit, insurance or housing. We do not use personal information from our customers or from our database to train AI models that are made available to others, except in an aggregated form that does not identify anyone, and our AI model providers may not use it to train their models.

18. Calls and meetings with us

If you have a video call with us, as a customer or a prospect, we may record and transcribe it with a meeting assistant so that we can keep accurate notes and follow up. You are told when a call is recorded, and you can ask us not to record it. We keep recordings and transcripts for up to 24 months after the call.

19. Location and where we process information

We do not collect your precise location. We work out your country, and, if analytics cookies are on, your approximate city, from your IP address. Our platform runs on Amazon Web Services servers in Germany and the United States, and our team works from the European Union and Türkiye. Where Turkish, Saudi or UAE law applies to a transfer, we use the transfer tools those laws require, such as the standard contract under Turkish data protection law, and we make any notification the law requires.

20. Türkiye, Saudi Arabia and the United Arab Emirates

If you are in Türkiye, Article 11 of the Personal Data Protection Law No. 6698 gives you the right to ask whether we process your personal data, to ask for information about it, to learn its purpose and whether it is used for that purpose, to learn to whom it has been transferred in Türkiye or abroad, to ask for correction or deletion and for those parties to be told, to object to a result against you that arises only from automated analysis, and to claim compensation for damage caused by unlawful processing. If we do not answer within 30 days, or you are not satisfied with our answer, you can complain to the Personal Data Protection Board.

If you are in Saudi Arabia or the United Arab Emirates, you have the rights given by their personal data protection laws, including the rights to be informed and to access, correct and delete your personal data. To exercise any of these rights, email info@aphily.com.

21. Do we make updates to this policy?

In short: yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Policy. If we make material changes, we may notify you either by prominently posting a notice of the changes or by sending you a notification directly. We encourage you to review this Privacy Policy regularly to stay informed about how we protect your information.

22. How can you contact us about this policy?

If you have questions or comments about this Privacy Policy, you may email us at info@aphily.com or contact us by post at:

Aphily, Inc.
2810 N Church St
STE 88768
Wilmington, DE 19802
United States

23. How can you review, update or delete the data we collect from you?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update or delete your personal information, email info@aphily.com.