Privacy Policy

Effective date: 30 October 2026

This policy explains how Vulpergen ("Vulpergen", "we", "us") collects, uses, shares and protects information when you visit vulpergen.com or use the Vulpergen application, an AI-powered B2B lead generation platform that researches companies, prepares personalized outreach and, with your approval, sends it from your own mailbox.

Questions or requests: support@vulpergen.com.

1. Information we collect

Account information

Your name, business email address, organization and role, and the credentials used to sign in.

Connected mailboxes (Google and Microsoft)

You can connect a company mailbox so Vulpergen can send the emails you approve. We request only the permissions needed for that:

• Google: https://www.googleapis.com/auth/gmail.send (send email on your behalf), plus openid and email (to confirm which Google account was connected).
• Microsoft 365: Mail.Send (send email on your behalf), User.Read, openid, email and profile (to confirm which account was connected), and offline_access (to keep the connection active).

From these services we receive the connected account's email address and basic profile, and an access token and a refresh token. Vulpergen cannot read, search, delete or change the emails, contacts, calendar or files in your mailbox. We only send messages.

Content you create in Vulpergen

Campaign settings, writing samples, email drafts, approvals and rejections with their reasons, lists of customers, excluded companies and ideal prospects, and the BCC address of your CRM if you connect one.

Business prospect information

To find prospects, Vulpergen researches companies using publicly available sources, such as company websites. This includes company names, websites, business descriptions and professional contact details, such as a company email address.

Website

If you use the contact form on vulpergen.com, we collect your name, company, company email, job title and message. The website uses HubSpot to receive form submissions and to measure visits with cookies.

Technical information

Logs needed to operate and secure the service, such as request times, error codes and IP addresses.

2. How we use information

• To provide the service: research companies, prepare drafts and show results in your workspace.
• To send, from your connected mailbox, only the emails that you or an administrator of your organization approve, and the connection test emails you request. Test emails are sent from your mailbox to yourself.
• If you enable it, to add your CRM's BCC address to the emails you send, so they are logged in your CRM.
• To send account and verification emails, such as the link that confirms a new sender address.
• To give support, keep the service secure, prevent abuse and comply with the law.

3. Google user data

In particular:

• We use Google user data only to send the emails you approve from your own Gmail or Google Workspace account and to confirm which account is connected.
• We do not sell Google user data, use it for advertising, or use it to train or improve artificial intelligence or machine learning models.
• We do not transfer Google user data to third parties, except as necessary to provide the service, to comply with the law, or as part of a merger or acquisition with notice to you.
• No person at Vulpergen reads your Google user data, unless you ask us to (for example, for support), it is necessary for security or to investigate abuse, or it is required by law.

The same commitments apply to data received from Microsoft.

4. Artificial intelligence

Vulpergen uses OpenAI's API to research companies and to write and revise email drafts. We send it the context needed for that task, such as public company information, your campaign settings and your writing samples. We do not send it data from your mailbox, which Vulpergen does not have access to. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models by default.

5. How we share information

We do not sell personal information. We share information only with service providers that help us run Vulpergen, under agreements that limit how they may use it:

• Cloudflare: hosting, networking and email routing.
• Supabase: database and authentication.
• OpenAI: AI processing, as described above.
• Resend: delivery of account and verification emails.
• HubSpot: website contact form and analytics.
• Google and Microsoft: delivery of the emails you send from your connected mailbox.

We may also disclose information when required by law or to protect the rights and safety of our users and others.

6. Security

Mailbox refresh tokens are encrypted with AES-256-GCM before they are stored, and each token is bound to its organization and sender. Data is encrypted in transit with TLS. Access to your organization's data is restricted to its members and is checked by the database for every request.

7. Retention and deletion

• Mailbox tokens are kept while the mailbox is connected. When a sender is removed from Vulpergen, access is revoked and the stored tokens are deleted. You can also revoke access at any time in your Google account permissions or your Microsoft account settings.
• The record of companies already considered during research expires after 60 days.
• Other account data is kept while your account is active. You can ask us to delete it by writing to support@vulpergen.com. We will delete it unless we must keep it to comply with the law.

8. Your choices and rights

You can access, correct or delete your information, or object to its use, by writing to support@vulpergen.com. If you received an email sent through Vulpergen and do not want to be contacted again, reply to the sender or write to us. Organizations can add any company, domain or email address to a "never contact" list, and Vulpergen will not send to it.

9. Children

Vulpergen is a business service and is not intended for anyone under 18.

10. Changes to this policy

We will post any changes on this page and update the effective date. If the changes are significant, we will tell account owners by email.