We do not sell personal information. We name every company that handles it for us (Section 4). We look up an email address or phone number only when a Customer asks for that one person, and an email goes out only after the Customer has approved that email, from their own mailbox.
1. Who this policy applies to
This policy covers:
- Visitors to iqlity.com, including anyone who scans their website there
- People on our waitlist
- Customers and the people they authorise to use IQlity
- Business contacts IQlity finds on a Customer's behalf (Section 2.f)
It does not cover information a Customer collects about their own prospects and customers and brings into IQlity ("Client Data"). For Client Data the Customer is the data controller and IQlity is a processor acting on their instructions, so requests about it should go to that Customer. We pass on any that reach us.
2. What we collect and why
a. Website scan
The web address you enter on iqlity.com. We read the public pages of that site to show you what it sells, and reuse the result for 30 days so a repeat scan of the same site costs nothing.
Legal basis: legitimate interest, in answering the request you made.
b. Waitlist
Your first and last name, work email, role, team size, the CRM you use, anything you choose to add, and your choices on the privacy and marketing boxes, with the wording you agreed to and when. We use them to manage your place and send you updates on the waitlist and the build.
When you join with a work email, we also research your company from public sources, such as its website and news, to understand how we could help. We research the company, not you.
Legal basis: legitimate interest, in the request you made and in understanding who has asked to hear from us; consent, for marketing beyond the waitlist, which you can withdraw at any time.
c. Account and access
Once your place opens: your name, work email and a password, which our sign-in provider stores only as a secure hash. We use them to set up and run your account and to support you.
Legal basis: contract.
d. Usage data
Which parts of the app you use and any errors it reports, so we can fix problems, improve the product and spot abuse.
Legal basis: legitimate interest.
e. Website analytics and cookies
On iqlity.com we use Google Analytics, Google Ads conversion tracking and IQlity's own pixel to see how the site is used and measure our own campaigns, and PostHog to see how the app is used. Analytics and advertising measurement stay off until you accept them in the cookie banner, and you can change your cookie choices at any time. Cookies that keep you signed in and remember your choice are always on. IQlity's pixel also records which network a visit came from: the organisation an internet address is registered to, such as a company or a broadband provider. The address itself is not stored, and we do not match visitors to email addresses or identify individuals.
Legal basis: consent, for analytics and advertising cookies.
f. Business contacts IQlity finds for Customers
When a Customer asks, IQlity finds companies that fit the Customer's criteria and the decision-makers in the roles the Customer sells to. For each person we hold their name, job title, company and public LinkedIn link. A business email address or a mobile number is looked up only when the Customer asks for that one person.
Source: our data provider (Section 4), the company's own website, public registers such as Companies House, public job postings and news.
Purpose: helping Customers find the right people at the right companies for business-to-business outreach.
Customers' responsibility: Customers decide whether and how to contact the people they find, and are responsible for doing so lawfully, including the rules on calling, email and recording where those people are. An email goes out only after the Customer approves it, from their own mailbox.
If IQlity found you and you want to be removed, email info@getmeetiq.com. We delete what we hold about you within 30 days and keep a record of your request so that you are not added again.
Legal basis: legitimate interest, in business-to-business prospecting.
g. Client Data
- Website and forms: when a Customer installs the IQlity pixel on their own site, it records a visitor identifier, pages viewed, ad click IDs and UTM parameters, the network a visit came from (the organisation the internet address is registered to, never the address itself), and the fields of forms visitors submit. Password, card, hidden and similar fields are never read, and no IP address is stored with a form.
- Imports: contacts, companies and won and lost deals a Customer uploads from their CRM or a spreadsheet.
- Connected accounts: a Customer's business email conversations, and Google Ads conversions, once the Customer connects those accounts, and LinkedIn connections a Customer uploads from LinkedIn's own export (Section 4).
- Calls and meetings: calls a Customer makes or takes in IQlity, recordings and transcripts they upload, and the transcript of a meeting they scheduled from IQlity if they switch that on. People are told a call is recorded: a spoken notice before it connects outside North America, and in North America the caller tells them and starts the recording only after that. IQlity does not build voiceprints.
IQlity processes Client Data as a processor, on the Customer's instructions and under their legal basis.
h. Communication
If you write to us or speak to us on a call, we keep your message and contact details to help you and improve the service.
Legal basis: legitimate interest; consent where you give it.
3. How we use your information
- To provide and run IQlity
- To find, rank and research companies and people for a Customer's outreach
- To draft emails for a Customer to approve
- To communicate with you
- To improve IQlity and keep it secure
- To meet our legal obligations
A Customer's data is used only inside that Customer's workspace. It is never used to train a model, and never used to shape results for another Customer.
AI processing. IQlity uses AI models to read websites, research companies, draft emails, transcribe calls and classify text. Each request carries only the fields that task needs. Pages a person visited on a Customer's site are never sent to a model, so they can never appear in an email. Anthropic and OpenAI do not train on data sent through their business APIs. The public website scan on iqlity.com sends the public text of the site you enter to Google Gemini on Google's free tier, under which Google may use it to improve its services; it is public business content, not information about you.
4. Data sharing
We do not sell your personal information. We share it only with:
- Sub-processors that run our infrastructure, data lookups, AI and email, listed below. We give Customers 30 days' notice before adding one.
- Accounts a Customer connects, as described below.
- Public authorities, where the law requires it, limited to what is required.
- A buyer of IQlity, if the business is sold, on terms at least as protective as these.
We look at a Customer's data only to give support they ask for, or with their permission.
| Sub-processor | What it does for us | Location |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt) |
| Cloudflare | Hosts the app, the waitlist form and the pixel, and runs our DNS | Global network |
| Netlify | Hosts iqlity.com, and getmeetiq.com, which forwards to it | US, global network |
| Lovable | Hosts the earlier version of the app at app.getmeetiq.com until it moves to the infrastructure above | As set by Lovable |
| Prospeo (Defastra Tech Inc.) | Finds companies and decision-makers, and the business emails and mobile numbers a Customer asks for | Canada |
| Hunter | Finds the business email a Customer asks for, when Prospeo finds none | France |
| Tomba | Finds the business email a Customer asks for, when Prospeo and Hunter find none | Not confirmed |
| Microsoft, Google, Zoho | The Customer's own mailbox, calendar and meetings, when they connect them | As set by the provider and the Customer |
| Twilio | Carries calls made and taken in IQlity; its copy of a recording is deleted once IQlity holds it | US |
| Zoom | Zoom meetings, when a Customer connects their Zoom account | US |
| Anthropic | Drafts outreach, researches companies on the public web, and reads calls and emails the Customer connects for what they say about buying, and researches the companies of people who join our waitlist | US |
| OpenAI | Transcribes calls and analyses text | US |
| Google (Gemini) | Reads the public pages of a website entered into the scan, and classifies text | US |
| Firecrawl | Fetches public web pages and runs web searches for company research | US |
| Resend | Sends our emails from getmeetiq.com | US |
| PostHog | Product analytics in the app | EU |
| Google (Analytics, Ads, Tag) | Analytics and campaign measurement on iqlity.com, and Google Ads for Customers who connect it | US, EU |
| Tally | Holds waitlist entries made before our own form replaced it; no new entries | EU (Belgium) |
Connected accounts. Nothing is read or sent until a Customer connects an account, and disconnecting stops it.
- LinkedIn: IQlity does not sign in to LinkedIn or hold a LinkedIn password. A Customer may upload the connections file from LinkedIn's own export. When they approve an invitation or message, IQlity copies it and opens the profile, and the Customer sends it themselves.
- Mailbox (a company mailbox on Microsoft 365 or Zoho): the Customer signs in with their provider, so IQlity never sees their password and holds only an encrypted token. IQlity keeps a message when someone on it is a person or company on the Customer's list, or when it belongs to a conversation the Customer started or that person replied to. Colleagues and automated senders are left out, and mail with personal addresses waits until the Customer adds that person. Other mail is not kept. For a kept message it stores the participants, subject, date and the first 300 characters. An email such a person sends is read once by an AI model for buying signals (such as a stated deadline, a tool being replaced or a job title), and only those findings with short quotes from the email are kept; the full text is then deleted, and is deleted unread after 14 days if it has not been read.
- Calls and meetings: calls run on IQlity's Twilio account. A recording is kept in private storage until the Customer deletes it or closes their account. A meeting is created in the Customer's own Zoom, Teams or Google account, with a notice in the invitation where its transcript will be read; IQlity never joins a meeting, reads only meetings scheduled from IQlity, never reads an internal one, and deletes the transcript once read.
- Google Ads: connected through Google's own authorisation, with the token encrypted in our database. Each conversion sync starts switched off and is turned on by the Customer. Where an email address is sent for matching, it is trimmed, lowercased and hashed with SHA-256 before it leaves IQlity, and any contact can be excluded from every sync.
5. Data retention
- Waitlist entries: until launch and up to 24 months after, then deleted for anyone who has not taken up a place.
- Website scans and company research: a scan is reused for 30 days. Research on a waitlist company is kept with your waitlist entry and deleted with it.
- Email and phone lookups: a found address or number, or a "not found", is reused for 30 days so the same person is not looked up twice.
- Accounts: kept while the account is active, and deleted within 90 days of the account being closed.
- Client Data: as the Customer sets it, and deleted or returned within 90 days of the end of their agreement.
- Records the law requires, such as billing records once billing starts, for as long as the law requires.
6. International transfers
Our database is in the EU (Frankfurt). Some of our sub-processors are in the US and Canada, and our team accesses data from outside the UK and EEA, including from countries without a UK or EU adequacy decision. Where personal information leaves the UK or EEA we rely on Standard Contractual Clauses and the UK Addendum, a provider's Data Privacy Framework certification, or an adequacy decision. The safeguards for our own team's access are being put in place with legal advice before any Customer in the UK or EU goes live.
7. Your rights
Under the UK and EU GDPR you have the right to:
- Access your personal information
- Correct anything inaccurate or out of date
- Have it deleted
- Restrict or object to how we use it, including for direct marketing
- Receive it in a portable format
- Withdraw consent at any time
- Complain to a data protection authority, in the UK the Information Commissioner's Office at ico.org.uk
To use any of these rights, email info@getmeetiq.com. We may ask you to confirm your identity, and we reply within one month, or within three for complex requests.
8. US state privacy rights
If you live in a US state with a privacy law, such as California, Colorado, Virginia or Connecticut, you have the right to know what personal information we hold about you, to have it deleted or corrected, to opt out of its sale or sharing, and not to be treated differently for using these rights. We do not sell or share personal information as those laws define it. Use the same address, info@getmeetiq.com.
9. Security and breach notification
- Encryption in transit (TLS 1.2 or above) and at rest, with tokens for connected accounts encrypted again in the database
- Row-level security, so each Customer's data stays in their own workspace
- Production access limited to the people who run IQlity
- Passwords stored only as a secure hash by our sign-in provider
No system is completely secure, and you are responsible for keeping your login details safe. IQlity is not SOC 2 or ISO 27001 certified. If a breach affects personal information, we tell the people affected without undue delay, and within 72 hours of becoming aware where the law requires it.
10. Changes to this policy
We may update this policy. If we make a significant change, we tell registered users by email and in the app at least 30 days before it takes effect. The date at the top of this page always shows the latest version.
11. Contact
- Email: info@getmeetiq.com
- Registered name and address: available on request