Privacy policy.

The data controller is GREZY SOFTWARE (RCS Grenoble 933 476 632), publisher of the Grezy websites and platforms, including AutoClaude and AutoLeads (the "Service").

Contact: contact@grezy.org. Registered office: 8 Montée de la Voûte, 38114 Oz, France.

Depending on how you use the Service, we may process the following categories:

• Account data: email address, first name, last name, profile information.
• Usage data: technical logs, IP address, session identifiers, pages viewed, navigation events.
• Support exchanges: the content of your messages and any attachments.
• Service emails: data strictly necessary to send them (email address, sending and deliverability metadata).
• Billing data: payment and invoicing data. We do not store full payment card details.
• AutoClaude operational data: prompts, project metadata, tool outputs and run logs sent through the CLI.
• AutoLeads campaign data: keywords, target places, blocklists, delivered leads and any integration tokens you connect (HubSpot for instance).

• Providing the Service (account, features, support): performance of a contract.
• Customer relationship and support: performance of a contract and legitimate interests.
• Service security (fraud prevention, anomaly detection, security logs): legitimate interests.
• Billing and statutory obligations: legal obligation.
• Analytics: legitimate interests, and consent where required.

Our customers' data is hosted in the European Union:

• Application servers: Hetzner, Helsinki (Finland).
• Database: PostgreSQL, EU region.
• File storage: Supabase (S3-compatible object storage), EU region.

Some sub-processors (AI, payment) are located outside the European Union; these transfers are covered by the Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

Internally, your data is only accessible to authorized Grezy Software staff, on a need-to-know basis.

We rely on the following processors, depending on the product used:

• Hetzner Online GmbH (application hosting in Helsinki).
• Supabase (file storage) and database providers (EU region).
• Stripe (payments).
• Resend (transactional and service emails).
• PostHog (product analytics, EU region).
• GitHub (source code hosting and version control).
• Anthropic (Claude API and Claude subscriptions used on your behalf by AutoClaude agents).
• Cursor (Anysphere, Inc.): AI models used by the AutoLeads agents to qualify leads and write sequences.
• Unipile: sending and receiving messages from the mailboxes and the LinkedIn, Instagram and WhatsApp accounts you connect to AutoLeads.
• Lemlist, Emelia and HubSpot, only if you connect your account to push your AutoLeads leads and their sequences into it.
• Noota and Microsoft (Teams), only if you connect a note-taking tool to retrieve your meeting notes. Microsoft Teams is also how our team is notified of messages sent through the contact form.
• Data providers used to build and enrich the AutoLeads database: Google (Maps Platform, PageSpeed Insights), Pappers, DataForSEO, Hunter and OpenStreetMap (Nominatim).
• AbuseIPDB: IP address reputation checks, for security.

We select providers offering adequate safeguards and enter into the processor agreements required.

AutoLeads compiles publicly available business information (website, phone, address) to deliver leads to you. Two distinct processing operations coexist, and they do not carry the same responsibilities.

• Building and enriching the database: Grezy Software decides which sources are consulted, what is kept and how it is scored. We are therefore the data controller for it, not your processor. We owe prospected people the information required by article 14, we enforce their objections across every campaign of every client, and we apply a retention limit.
• Running your outreach: you decide who to contact and what to say, so you are the data controller for that. It is up to you to ensure your outreach complies with applicable law (GDPR, ePrivacy, CAN-SPAM in particular), including honoring opt-outs.

In practice, we append the article 14 notice and a one-click objection link to the first email of every sequence sent on your behalf. An objection recorded there applies platform-wide, including to any later re-collection of the same contact.

Prospected people can read that notice and object on the page Your prospecting data.

• Account data: for the lifetime of the account, then deleted or anonymized after closure, subject to legal obligations.
• Project and campaign data: for the lifetime of the account, then deleted after closure, following a grace period.
• AutoLeads lead records: a lead nobody ever attempted to contact is deleted 12 months after it was collected, whether or not it was delivered. Once a first contact has been made, the record is kept for as long as needed to follow up on the business relationship, then deleted.
• Objections from prospected people: kept as a keyed hash of the email or phone, never in plain text, for as long as the database exists. Deleting them would silently undo the objection the next time the same public source is consulted.
• Billing data: kept for the period required by law, in particular accounting law.
• Technical and security logs: kept for a limited period, unless needed for security.

We implement appropriate security measures, including:

• access control and least-privilege permissions;
• encryption in transit (HTTPS/TLS);
• monitoring and incident prevention measures;
• backups and recovery procedures.

No system is completely secure: we cannot guarantee absolute security, but we strive to reduce risks as much as possible.

We use analytics technologies to understand how the Service is used and improve it. Depending on their configuration, some tools operate without cookies, others require your consent. Where consent is required, an information and consent mechanism is in place.

You have the rights of access, rectification, erasure, restriction, objection and portability, under the conditions set out by the GDPR.

To exercise them, write to contact@grezy.org or use our GDPR request form.

If you are not a customer but a person whose professional contact details appear in the AutoLeads database, your rights are set out on a dedicated page, which lists the sources the data came from and lets you object or ask for erasure immediately: Your prospecting data.

To ask for the removal of content published on our websites, use our content removal form.

You may also lodge a complaint with the CNIL, the French data protection authority.

We may update this policy. The last updated date appears at the top of this page. If changes are material, we may notify you through the Service.