Privacy Policy

Who this policy covers

This policy applies to:

• Visitors to verditlabs.com
• Prospects we contact through outbound email as part of our services for clients
• Clients who engage VerditLabs directly

What data we collect

From prospects we contact on behalf of clients: business contact information sourced from public business directories, professional networking sites, and licensed B2B data providers. This typically includes name, job title, business email address, company name, company size, and publicly available information about the company's hiring activity.

From clients: name, business email, company information, and any data you share with us during our engagement (CRM exports, outreach templates, ideal client criteria).

We do not collect sensitive personal information as defined under state privacy laws. This includes government identifiers (Social Security numbers, driver's license numbers, passport numbers); financial account numbers, payment card numbers, or account credentials; precise geolocation; racial or ethnic origin; religious beliefs; union membership; genetic or biometric data; health, sex life, or sexual orientation information; the contents of mail, email, or text messages; and citizenship or immigration status. If we ever begin collecting any of this information, we'll update this policy and obtain opt-in consent where required.

How we use this data

We use prospect data to send relevant B2B outreach to people whose professional role matches what our clients offer. The outreach is tied to the recipient's professional responsibilities, not their personal life.

We use client data to deliver the services you've hired us for.

If you reply to our outreach, we may add your contact information and reply content to our CRM to manage the conversation.

We don't sell, rent, or share prospect or client data with anyone outside the vendors listed below. We don't use your data to train AI models.

Data minimization

We limit our collection of personal data to what is reasonably necessary and proportionate to the purposes described in this policy. We don't collect, retain, or use personal data for purposes that aren't disclosed here, and we don't collect more data than we need to send relevant outreach on behalf of our clients.

Universal opt-out signals

We do not currently use Google Analytics, Google Ads, Cookiebot, advertising pixels, retargeting, or targeted advertising technologies. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid opt-out signal where applicable, including for any future sale, sharing, or targeted advertising activity that could be covered by state privacy laws.

Vendors who process data on our behalf

We use the following third-party tools to run our service. Each operates under a Data Processing Addendum that restricts them to processing data only for our business purposes:

• Smartlead — email sending and campaign management
• Enrichment providers (such as Apollo, Clay, or similar) — prospect research and data verification
• CRM platforms (such as HubSpot, Bullhorn, or the CRM our client uses) — pipeline and contact management
• Website hosting and security providers — hosting the website, serving pages, maintaining uptime, and protecting against abuse
• YouTube/Google — privacy-enhanced embedded video playback when a visitor chooses to load or play the intro video

If you're a client, we'll tell you specifically which tools are in use for your engagement.

How long we keep data

Prospect data is retained only as long as it's useful for active outreach, and no longer than 24 months from collection. If you unsubscribe or ask us to stop contacting you, we keep a suppression record (just your email address) so we don't contact you again. We don't add you back.

Client data is retained for the duration of the engagement plus 12 months for accounting and reference purposes.

Our outbound emails

Every commercial email we send includes our valid postal address, accurately identifies the sender, uses a non-deceptive subject line, and contains a working opt-out mechanism. We honor opt-outs within 10 business days and usually the same day.

How to opt out

Two ways, either works:

• Reply to any email with "stop," "unsubscribe," or any similar message
• Email [email protected]

Your rights

Anyone we've contacted or collected data about can:

• Ask what data we hold about them
• Ask us to correct it
• Ask us to delete it
• Ask us to stop contacting them
• Ask for a portable copy of their data, where applicable state law provides that right

To exercise any of these rights, email [email protected] with your request. We'll confirm receipt within 10 business days and respond substantively within 45 days. If we need more time because of the complexity or volume of requests, we may extend this period by an additional 45 days, and we'll let you know within the original 45-day window. We won't penalize you for exercising these rights.

To verify your identity before fulfilling a request, we'll match the email address you contact us from against the data we hold. For deletion or access requests where the match isn't clear, we may ask for additional information sufficient to confirm you are the person the data relates to. We won't ask for more than is necessary.

If we deny your request, we'll explain why in writing. You can appeal by replying to our denial within 60 days. We'll review the appeal and respond within 60 days of receiving it, with a written explanation of the action taken and the reasons for that decision. If we deny the appeal, we'll provide you with a way to contact your state attorney general if you believe your rights have not been respected.

You can designate an authorized agent to submit a request on your behalf. For California residents, the agent must provide either (1) a power of attorney under California Probate Code sections 4000-4465, or (2) signed written permission from you authorizing the agent to act, plus proof of the agent's identity. We may also contact you directly to verify your identity and confirm you authorized the request. For residents of other states, we'll ask for similar written proof of authorization.

California residents

The California Consumer Privacy Act (CCPA) gives California residents specific rights over their personal information. This applies to business contacts as well as consumers, since California's B2B exemption sunset in January 2023.

Categories of personal information we collect:

• Identifiers - name, business email address
• Professional or employment-related information - job title, employer, company size, publicly available information about the company's hiring activity
• Internet or network activity (website visitors only) - basic technical logs, such as IP address, browser type, device type, requested pages, referring page, and timestamps, where processed by our hosting or security providers

Sources of this information: public business directories, professional networking sites, licensed B2B data providers, website hosting and security providers, and information clients share with us.

Purposes: sending relevant B2B outreach on behalf of our clients, delivering contracted services to clients, and operating our website.

We do not sell personal information for money, and we do not currently share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that would trigger the right to limit, but the right exists and you can invoke it.

You have the right to know, access, correct, and delete your personal information, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and the right to non-discrimination for exercising any of these rights.

Texas residents

The Texas Data Privacy and Security Act gives Texas residents the rights to access, correct, delete, and obtain a copy of their personal data, plus the right to opt out of processing for targeted advertising, sale of personal data, or profiling that produces legal effects. We don't sell personal data or engage in profiling that produces legal effects, but the rights apply.

Other US states

Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Utah, and Virginia have rights under their state's comprehensive privacy law. Depending on the state, these may include the right to access, correct, delete, and obtain a portable copy of personal data, plus the right to opt out of targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects. Many of these laws contain exemptions for personal data collected in a business-to-business context, but we'll respond to good-faith requests regardless of whether the law technically applies to us.

Where state law requires opt-in consent before processing sensitive personal data, we don't process sensitive personal data and so don't rely on consent for that purpose.

Data security

Data is stored in the systems listed above, all of which use industry-standard encryption and access controls. We limit access to data to what's needed to run the service.

Children's data

Our services are for businesses. We don't knowingly collect data from anyone under 18.

Changes to this policy

If we make meaningful changes, we'll update the "Last updated" date at the top and, where appropriate, notify affected parties.

Contact