Privacy Policy

1. Who We Are & Scope

This Privacy Policy applies to the products, services, websites (retriever.run, app.retriever.run), and applications provided by Retriever(“Retriever”, “we”, “us”, or “our”).

Retriever provides a semantic Ideal Customer Profile (ICP) search engine and AI agent that helps B2B sales and go-to-market teams discover, qualify, and enrich prospective business leads. If you have any questions about this policy, you can reach us at emma@retriever.run.

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information from third-party integrations.

4. How We Use Your Information

We use the information we collect for the following business purposes:

• Provide and maintain the service: Executing your B2B search requests, scoring companies against your criteria, enriching records, and building exportable lead tables.
• Account management: Creating and administering your account, authenticating access, billing, and processing transactions.
• Customer support & Communication: Answering questions, sending critical product updates, service notices, and onboarding guidance.
• Security & Abuse Prevention: Detecting fraudulent activity, unauthorized access, and ensuring platform reliability.
• Platform improvements: Analyzing aggregate usage patterns to optimize query speed, user experience, and search accuracy.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We only share information with trusted third-party service providers (sub-processors) who assist us in operating our services under strict confidentiality and security obligations:

• Hosting & Cloud Infrastructure: Cloud hosting, serverless compute, and database storage (e.g., Vercel, Railway, Supabase).
• AI Frontier Models: Enterprise AI model APIs (such as Anthropic and OpenAI) used to interpret search instructions and score company match reasons under zero-data-retention training terms. Customer data sent via API is not used to train foundational AI models.
• Analytics & Error Monitoring: Privacy-conscious telemetry and error monitoring tools (e.g., Vercel Analytics) to maintain service uptime and diagnose software defects.
• Legal Compliance: If required by law, subpoena, or valid government request to protect Retriever's rights or the safety of our users.

6. Data Security & Retention

We implement industry-standard administrative, physical, and technical safeguards:

• End-to-end encryption in transit via TLS 1.3 / HTTPS.
• Database encryption at rest for stored records and authentication credentials.
• Least-privilege internal access controls and isolated tenant workspaces.

Retention: We retain your account data and saved lead tables for as long as your account is active or as needed to provide you with the service. If you close your account or request data deletion, we will delete or anonymize your data within 30 days, unless retention is required by legal obligations.

7. Your Privacy Rights (GDPR, CCPA & Global)

Depending on your location (including the European Economic Area, UK, Switzerland, and California), you possess specific rights regarding your personal data:

• Right of Access & Portability: Request a copy of the personal information we hold about you in a structured, commonly used format.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure (“Right to be Forgotten”): Request the permanent deletion of your personal data from our systems.
• Right to Restrict or Object to Processing: Object to or restrict certain processing activities.
• Right to Withdraw Consent: Revoke any previously granted consent (such as disconnecting Google OAuth access) at any time.

To exercise any of these rights, email us at emma@retriever.run. We respond to all verified requests within 30 days without discrimination.

8. International Data Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. When transferring data from the EEA or UK, we utilize appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations or operational practices. We will notify you of any material updates by updating the “Last updated” date at the top of this page, and, where appropriate, via an in-app notice or email notification.