Privacy notice

The AFILOW service operator identified on your order form or invoice is the controller for account and service data. Where a customer supplies data for its own purposes, the customer may be the controller and AFILOW acts as its processor.

We process account identity and authentication records; workspace and search inputs; public company and website facts with provenance; saved opportunities and workflow records; subscription and invoice identifiers; provider usage, cost and reliability records; security logs; and support communications. Stripe processes complete card details directly.

We use data to provide and secure AFILOW, authenticate users, isolate workspaces, execute requested searches, measure quotas and costs, process subscriptions, send transactional messages, diagnose failures and meet legal obligations. We do not sell personal data and do not use customer workspaces for automatic outreach.

Processing is based on performance of the service contract, legitimate interests in security and reliable operation, consent where required, and compliance with legal obligations. Public professional information is used only where relevant to business research and is accompanied by source information when available.

AFILOW may use Vercel for hosting, Postgres/Neon for application data, Stripe for billing, Resend for transactional email, xAI for requested analysis, and enabled discovery or enrichment providers shown in the administrator’s Data Providers page. Google services are not required for core discovery and are used only after explicit configuration.

Some processors may handle data outside the European Economic Area using their published transfer safeguards. Provider selection and credentials are visible to administrators so optional providers can be disabled.

Account and workspace data is kept while the service is active and for the period reasonably required for recovery, security, billing and legal records. Provider rate buckets and operational events are kept only for service control and audit. You may request workspace or account deletion, subject to mandatory financial and security retention.

Credentials stay server-side. Provider secrets stored in the database are encrypted, full secret values are not returned to the browser, access is scoped by role and workspace, and external fetches use URL and network protections. No system can promise absolute security.

AFILOW uses essential authentication cookies. Optional privacy-focused analytics may be enabled to understand product usage. The application does not require advertising cookies to operate.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may complain to your supervisory authority. Use the support channel associated with your account and identify the relevant workspace.

We will update the effective date and notify account contacts when a change materially affects how their data is handled.