Who owns your data
The contact records, conversations and pipeline built for your campaigns belong to your business. Where we contact your prospects for you, you decide the purpose and we process the data on your behalf.
The short answer
You own the data generated for your engagement. It is never pooled with other clients, it can be exported or returned to you, and opt-outs are honoured across every campaign. Outreach and website identification are run with consent and channel rules in mind.
Roles
Who decides, and who processes
The privacy policy describes the same split between controller and processor.
Deligatr decides
- Our website, chat and booking
- Our own sales and marketing
- Our free tools, such as the AI visibility checker
Deligatr processes for you
- Campaign and prospect data in your engagement
- Under your customer agreement
- Opt-outs passed on and honoured
You decide
- Who you contact and why
- How prospect data is used
- What is kept, returned or deleted
Six commitments on how we handle your data
Plain statements of how data is treated while we work together.
You own your records
Leads, conversations and pipeline stages live in your DeliHub CRM and belong to your business from the moment they are created.
Export or return
Your CRM data can be exported or returned to you during or after the engagement. There is no lock-in. Cancelling stops the next renewal and the service runs to the end of the period you have paid for; prepaid quarterly and annual fees are not refunded (see the Terms, section 5).
Dedicated, never pooled
Sending domains and the DeliHub CRM instance are dedicated per client. Nothing is shared or mixed across accounts.
Opt-outs apply everywhere
A contact who opts out is suppressed from all current and future outreach, not just the sequence they replied to.
Compliance review available
In regulated industries your compliance team can review messaging direction and cadence before launch, and a person approves every sequence.
No sale of personal information
We do not sell personal information for money, and your campaign data is not repurposed for other clients.
How outreach stays within the rules
We contact people in a business capacity, about services relevant to their role, and follow the rules for each channel and country.
Every email carries a working opt-out. If someone asks us to stop, we suppress them across every campaign and keep a minimal record so they are not contacted again. People can also ask what data we hold, where it came from and have it deleted. Where a client is the controller of a campaign, the request is passed to them and we help them respond.
| Channel and region | What generally applies | How we work |
|---|---|---|
| Email, US | CAN-SPAM: accurate sender identification, a physical address and a working unsubscribe. | Built in to every campaign. The FTC cites up to $53,088 per non-compliant email. |
| Email, UK and EU | Data protection law, where legitimate interests can be a basis for business contacts that are relevant and proportionate, plus PECR and national rules. | Relevant, role-based outreach, a clear opt-out and the right to object always honoured. |
| Email, Canada | CASL has its own consent rules. | Reviewed with you before outreach to Canadian contacts. |
| Phone and text | Marketing calls and texts often need consent, depending on the country. | We do not text or call for marketing without the consent the law requires. |
Summary only. Read the guide to cold email compliance and see how this runs in the Outbound overview. Sending protections are in deliverability.
Website visitors and consent
Identifying who is on a website depends on the visitor’s jurisdiction and consent, so we configure it with each client before it goes live.
DeliChat can identify the company behind a visit and, where the law and the visitor’s consent allow, the person. Rules differ most across the UK, the EU and California. See visitor identification for how it works.
We apply the same standard to our own site:
- Nothing outside the strictly necessary category runs until you accept it.
- Rejecting is as easy as accepting, and you can change your mind in Cookie Settings.
- A Global Privacy Control signal is treated as a rejection of optional categories.
- California and other US residents can opt out in one click on the Do Not Sell or Share page.
Our own site
Consent first, by category
Based on our Cookie Policy. The live settings are in the footer.
Nothing optional runs until you say yes
- Always on
Strictly necessary
Keeps the site working and secure
- Off until accepted
Analytics
Which pages are useful
- Off until accepted
Heatmaps and session replay
Where visitors click and get stuck
- Off until accepted
Chat and visitor identification
Chat, company-level identification, browser fingerprinting, session recording and form capture
- Off until accepted
Marketing and advertising
Ad measurement and remarketing
What happens if you cancel
You can leave at the end of a paid period without a negotiation, and the data you built stays yours.
Your CRM data can be exported or returned
Contacts, conversation history and pipeline stages. Tell us what you want and we help with the handover.No long-term commitment on monthly billing
Cancelling monthly billing is a request, not a negotiation. Quarterly and annual billing are paid up front, and the details are on pricing page.Sending infrastructure is wound down
Dedicated domains and accounts set up for your campaigns are wound down, not reused for another client.Prospect data is deleted or returned
Outreach prospect data is kept while the campaign runs and for a limited period after, then deleted or returned to you on request.
Policies and your rights
The legal documents are the binding detail. This page is the plain-English guide.
To use any right, such as access, correction, deletion or objection, email [email protected]. For the wider picture of what we will and will not claim, see the trust documentation.
Questions about data and privacy
Straight answers on ownership, compliance and what happens to prospect data.
Who owns the leads and data generated during our engagement?
You do. The contact records, conversations and pipeline built for your campaigns live in your dedicated DeliHub CRM instance and belong to your business. Where we contact your prospects on your behalf, you decide why and how that prospect data is used and we process it for you under your customer agreement.
What happens to our data if we cancel?
You can have your CRM data, including contacts, conversation history and pipeline records, exported or returned to you, during or after the engagement. Prospect data is kept while a campaign runs and for a limited period afterwards, then deleted or returned to you on request. Monthly billing has no long-term commitment.
Is cold outreach compliant with GDPR?
Outreach to business contacts can rely on legitimate interests under GDPR where it is relevant to the person’s role, proportionate and gives a clear way to opt out. That is not automatic: it depends on the country, the channel and the data. Every campaign includes a working opt-out and objections are honoured. This is general information, not legal advice, so take advice on your own situation.
Is cold outreach compliant with CAN-SPAM in the US?
Campaigns are built to meet CAN-SPAM requirements: accurate sender identification, a physical postal address and a working unsubscribe that is honoured promptly. The FTC states a maximum civil penalty of $53,088 per non-compliant email, which is why we treat it seriously. Other channels and countries have their own rules, such as PECR in the UK and CASL in Canada.
Is our data shared or pooled with other Deligatr clients?
No. Every client has dedicated sending domains and a dedicated DeliHub CRM instance. Nothing is shared or pooled across clients, and your own company domain is never used for outreach.
Do you sell our data?
We do not sell personal information for money. Data collected for your engagement is used to run your campaigns and support you. We use service providers such as hosting, CRM and communications platforms, under terms that limit how they use it, and the privacy policy lists the categories.
What happens to people who unsubscribe or ask not to be contacted?
Opt-out requests are honoured. The contact is suppressed from all current and future outreach, across every campaign rather than just the one they replied to, and a minimal suppression record is kept so they are not contacted again.
Is visitor identification on a website lawful?
It depends on the visitor’s jurisdiction and consent. Rules differ across the UK, the EU and California in particular, so identification is consent-aware and configured with each client around the markets they sell into before it goes live. This is general information, not legal advice.
Keep reading: Trust, research engine, deliverability, personalisation and the DeliHub CRM. Sector questions: industries.