Privacy Policy

RepuFix is a data conditioning and analysis platform. It is not an email sender, campaign manager, CRM, or outreach tool. RepuFix enables users to upload their own lead data for the purposes of cleaning, deduplication, scoring, classification, verification, and simulation analysis.

This Policy applies to all users of the Service, including individuals and businesses located in the United States, Canada, the European Union, the United Kingdom, and all other jurisdictions. This Policy governs all personal data processed by RepuFix in connection with the Service.

RepuFix acts as a Data Processor with respect to lead data uploaded by users, and as a Data Controller with respect to account data and operational data we collect directly from users. For further information on these roles, please refer to our Data Processing Agreement.

We use the information we collect for the following purposes:

• —To provide, operate, and maintain the Service, including processing lead data uploads, running cleaning and classification algorithms, executing verification requests via third-party APIs, and generating simulation outputs.
• —To authenticate users and maintain the security of accounts.
• —To process credits, billing transactions, and subscription management.
• —To communicate with you about account activity, service updates, security alerts, and support requests.
• —To monitor and analyze usage patterns for the purpose of improving performance, identifying bugs, and developing new features.
• —To detect, investigate, and prevent fraudulent transactions, abuse, or other violations of our Terms of Service.
• —To comply with applicable legal obligations, respond to lawful requests from government authorities, and enforce our agreements.
• —To fulfill contractual obligations to you under our Terms of Service and any applicable Data Processing Agreement.

We do not use your data for advertising. We do not sell, rent, or license your data to third parties. We do not use your uploaded lead data to train machine learning models, large language models, or any artificial intelligence system. This prohibition applies permanently and unconditionally.

You retain full ownership of all lead data you upload to the Service. RepuFix acquires no ownership interest, intellectual property right, or license in your lead data beyond what is strictly necessary to deliver the Service to you.

Derived data (scores, classifications, flags, simulation outputs) generated from your lead data is also owned by you. You may export it at any time and request its deletion subject to the data retention terms below.

You represent and warrant that you have all necessary rights, consents, and lawful bases to upload the lead data you provide to RepuFix, and that doing so does not violate any applicable law, third-party rights, or contractual obligation.

RepuFix engages certain third-party service providers to operate the Service. These providers are contractually bound to process your data only as necessary to perform their designated functions and to maintain appropriate security measures.

A current list of subprocessors is maintained and available upon request. We will provide reasonable notice before adding new subprocessors that materially affect the processing of your data.

We retain your account data for as long as your account remains active. If you close your account, we will delete or anonymize your account data within 90 days, except where retention is required by applicable law, fraud prevention obligations, or unresolved billing disputes.

Uploaded lead data and derived data (scores, flags, classifications) are retained for as long as you maintain them in the Service. You may delete individual lists, leads, or segments at any time through the interface. Deleted data is permanently removed from production systems within 30 days. Backup retention: encrypted backups may retain copies of deleted data for up to 90 days following deletion from production, after which they are purged from all backup systems.

Usage logs and technical records are retained for up to 12 months for security and operational purposes, after which they are deleted or anonymized.

To request the deletion of your data, contact us at privacy@repufix.io. We will acknowledge your request within 5 business days and complete the deletion within 30 days, subject to any legally required retention exceptions.

RepuFix operates globally and may process your data in the United States and other countries where our infrastructure and subprocessors are located. If you are located in the EU/EEA or UK, your data may be transferred to and processed in countries that do not have the same level of data protection as your home country.

Where such transfers occur, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Agreement (IDTA), or other lawful transfer mechanisms. For transfers to verification API providers, we ensure that data transfer agreements are in place or that providers are certified under applicable frameworks.

You may request information about the specific mechanisms used to protect your data in international transfers by contacting privacy@repufix.io.

RepuFix implements reasonable and industry-standard technical and organizational security measures designed to protect your data against unauthorized access, disclosure, alteration, or destruction. These measures include, where applicable, encryption of data in transit using TLS, access controls and authentication requirements, regular security assessments, and monitoring for unauthorized access.

No security system is impenetrable. RepuFix cannot guarantee the absolute security of your data. In the event of a data breach that affects your personal data, we will notify you and applicable regulatory authorities as required by law.

You are responsible for maintaining the security of your account credentials. You should use a strong, unique password, enable multi-factor authentication where available, and notify us immediately at security@repufix.io if you suspect unauthorized access to your account.

RepuFix processes lead data on your behalf as a data processor. You are solely responsible as the data controller for ensuring that your collection, use, and processing of lead data — and any subsequent outreach you conduct using that data — complies with all applicable laws and regulations, including but not limited to:

• —CAN-SPAM Act (United States): You are responsible for ensuring that any commercial email sent using leads processed through RepuFix complies with the CAN-SPAM Act, including accurate header information, non-deceptive subject lines, a valid physical postal address, a functional unsubscribe mechanism, and prompt honoring of opt-out requests.
• —CASL (Canada): You are responsible for ensuring that any commercial electronic messages sent to Canadian recipients comply with Canada's Anti-Spam Legislation (CASL), including obtaining express or implied consent as required, providing sender identification, and including an unsubscribe mechanism in every message.
• —GDPR (EU/EEA/UK): You are responsible for ensuring a lawful basis for processing any personal data contained in your lead lists, for honoring data subject rights requests, and for ensuring that any transfer or use of lead data complies with GDPR requirements applicable to you as controller.
• —Other applicable laws: You are responsible for compliance with all other applicable privacy, data protection, electronic communications, and anti-spam laws in the jurisdictions where you operate and where your leads are located.

RepuFix does not guarantee that use of the Service ensures compliance with any of the above regulations. The Service is a data conditioning tool only. Compliance with applicable law remains your obligation.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are material, provide notice via email or prominent display within the Service. Your continued use of the Service after any such change constitutes acceptance of the updated Policy.

For privacy-related inquiries, data subject rights requests, or questions about this Policy, contact us at: