Privacy Policy | Sales Morgan

This Privacy Policy describes how Sales Morgan ("we," "us," or "our") collects, uses, and discloses personal information when you visit our website, use our multi-channel cold outreach platform, connect email outboxes, or automate Instagram Business communications.

1. Identity of the Data Controller & Privacy Contact

Under Regulation (EU) 2016/679 (GDPR) and UK GDPR:

For Customer Account & Billing Data: Sales Morgan acts as the Data Controller regarding your account credentials, billing information, and platform telemetry.
For Imported Lead Lists & Campaign Contacts: When B2B customers import lead contact lists to run campaigns, the Customer acts as the Data Controller and Sales Morgan acts as the Data Processor under our Data Processing Agreement (DPA).
Data Protection Contact: You can contact our Data Protection Officer and privacy team directly at privacy@salesmorgan.com.

2. Information We Collect

We collect personal data across distinct categories depending on your interaction with the platform:

a. Customer Account & Connected Credentials

Account Profile: Name, work email address, company name, encrypted password hash.
Single Sign-On (Google, Meta, LinkedIn): If you choose to log in or register using Google, Facebook, or LinkedIn, we receive your verified email address, name, and account identifier to authenticate you securely without ever accessing or storing your external social passwords.
Billing Details: Payment tokens, billing addresses, and transaction histories processed securely by Stripe (we never store raw card numbers).
Connected Outboxes: SMTP/IMAP credentials and Microsoft Graph API tokens, encrypted at rest with AES-256-GCM.
Official Meta & Social OAuth: Social authorizations granted via official provider APIs (encrypted with AES-256-GCM; no raw passwords stored).

b. Lead & Campaign Sourcing Data (Processed for Customers)

Prospect Records: Business names, corporate email addresses, company names, and custom variables (e.g. {{First Name}}) uploaded via CSV, Excel, or Google Sheets.
Campaign Content: Email subject lines, message bodies, Spintax syntax, and inbound replies.

c. Telemetry & Technical Usage Data

Outreach Metrics: Email delivery timestamps, open event tracking pixels, click telemetry, and bounce codes.
Security Telemetry: IP addresses, TLS handshake metadata, Cloudflare Turnstile challenge responses, and audit logs.

3. How We Use Your Information

We process information exclusively for lawful business and service purposes:

Providing and orchestrating multi-outbox email rotation, Spintax synthesis, and deliverability monitoring.
Processing payments, plan package invoices, and maintaining financial ledgers via Stripe.
Executing official Meta Graph API webhooks and Instagram DM automation.
Preventing malicious bot activity, credential stuffing, and enforcing our Anti-Spam Policy.
Fulfilling legal obligations, maintaining suppression lists, and complying with statutory audit requirements.

4. Legal Basis for Processing (GDPR Article 6)

Contractual Necessity (Art. 6(1)(b))Processing account data and dispatching campaigns pursuant to our Terms of Service.

Legitimate Interests (Art. 6(1)(f))Network security, fraud detection, deliverability scoring, and B2B commercial outreach.

Legal Obligation (Art. 6(1)(c))Tax accounting, statutory recordkeeping, and maintaining suppression lists.

Consent (Art. 6(1)(a))Non-essential cookie categories and voluntary survey submissions.

5. Categories of Recipients & Subprocessors

We do not sell personal information. We transfer data only to verified third-party subprocessors bound by strict data protection agreements:

Payment Processors: Stripe, Inc. for direct plan package billing and invoicing.
Security & Edge Infrastructure: Cloudflare, Inc. for WAF, DDoS mitigation, and Turnstile bot protection.
Authentication & Social Platform APIs: Google LLC, Meta Platforms, Inc., and LinkedIn Corporation for secure single sign-on and official API interactions.
Hosting & Cloud Database: Encrypted PostgreSQL cloud databases and Redis worker nodes.

Review the complete list of vendors, locations, and safeguards on our Subprocessor Directory.

6. Data Retention Schedule

We adhere to strict data minimization principles and retain records only for specific, predefined periods:

Data Category	Retention Period	Purpose & Disposal Policy
Account Profiles & Invoices	Active Account + 7 Years	Required for statutory tax accounting and corporate compliance.
Imported Lead Lists	Duration of Campaign + 30 Days	Deleted within 30 days of account termination or upon user deletion request.
Campaign Logs & Telemetry	90 Days Post-Campaign	Automatically pruned and aggregated into anonymized conversion metrics.
Tracking Pixels & Click Logs	90 Days	Purged automatically after 90 days from dispatch.
Encrypted Credentials & Tokens	Until Account Disconnection	Permanently wiped from database upon outbox or social account deletion.
Global Suppression Lists	Permanent (Hashed)	Retained in one-way cryptographic hash format to prevent unlawful re-contact.

7. Your Statutory Data Protection Rights

Under GDPR, UK GDPR, and international data protection frameworks, you have the right to:

Access & Portability: Request a copy of your personal data in structured JSON or CSV format.
Rectification: Request correction of inaccurate or incomplete records.
Erasure (Right to be Forgotten): Request permanent deletion of your data from active systems.
Restriction & Objection: Object to processing for direct marketing or restrict automated sequences.
Withdraw Consent: Revoke consent at any time for consent-based processing without retroactive effect.

Submit a Verified Data Subject RequestExercise your rights online with our self-service portal (No fee required).

Open Request Portal →

8. Security Controls & Encryption Standards

We protect personal data with defense-in-depth security measures:

AES-256-GCM Database Encryption: Decoupled symmetric encryption for sensitive credentials and tokens at rest.
Cookie Security: RFC 6265bis __Host- prefixed HttpOnly cookies with SameSite=Lax and cryptographic CSRF token validation.
TLS 1.3 in Transit: Full cryptographic transport security with strict HSTS enforcement.

Read full architectural details on our Security Page.

9. International Data Transfers & Safeguards

If personal data originating in the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred to servers or subprocessors located in third countries (including the United States), we rely on:

The EU-US Data Privacy Framework (DPF), UK Extension, and Swiss-US DPF where certified.
The European Commission's Standard Contractual Clauses (SCCs) (Module 2 Controller-to-Processor and Module 3 Processor-to-Processor).

10. Regional Compliance Frameworks

California Consumer Privacy Act (CCPA / CPRA)

California residents can manage opt-out choices for sale/sharing and targeted advertising via our dedicated California Privacy Choices Page. We automatically detect and honor the Global Privacy Control (GPC) browser signal.

CAN-SPAM Act (United States)

We require all outbound campaigns to feature accurate headers, valid physical postal addresses, non-deceptive subject lines, and mandatory single-click unsubscribe links as detailed in our Anti-Spam Policy.

11. Contact Information & Supervisory Authorities

If you have questions, comments, or wish to lodge a grievance regarding our data practices:

Data Controller: Sales Morgan

Data Protection Officer: privacy@salesmorgan.com

General Support: support@salesmorgan.com

EU/UK residents also have the statutory right to lodge a complaint with their local supervisory data protection authority (e.g. the ICO in the UK, or their national Data Protection Authority in the EU).

Privacy Policy & GDPR Notice