Privacy Policy
Last updated: 2026-06-30
This Privacy Policy explains how OpenWeb360 OÜ ("OpenWeb360", "we", "us") handles personal data when you use our AI sales agent platform, websites, and related services.
1. Who we are
OpenWeb360 OÜ · Registry code 17499268 · Tallinn, Estonia (EU). We are the data controller for the personal data described in this policy. For privacy requests contact: info@openweb360.eu.
2. What data we collect
- Account data: name, work email, company, password (hashed).
- Campaign data you enter: target company info, ICP, copy and inbox connections.
- Usage data: pages viewed, features used, device/browser, IP, timestamps.
- Cookies and analytics (only with your consent — see Cookie Policy).
- Communications you send us (email, contact form, support tickets).
- Billing data processed by Stripe (we do not store card numbers).
3. How we use your data
- Provide and operate the AI sales agent service.
- Run outreach campaigns you configure (find companies, draft emails, send, track).
- Improve product quality, debug, and ensure security.
- Billing, invoicing, fraud prevention.
- Customer support and account communications.
- Legal compliance (tax, accounting, GDPR requests).
4. Legal basis under GDPR
- Contract performance — delivering the service you signed up for.
- Consent — analytics and marketing cookies, optional communications.
- Legitimate interest — product improvement, security, fraud prevention.
- Legal obligation — tax, accounting, regulatory.
5. Data sharing and sub-processors
We use trusted sub-processors that process data on our behalf under GDPR-compliant agreements (DPAs). Data is primarily processed within the EU.
Sub-processorPurposeRegionSupabaseDatabase, auth, storageEUResendTransactional email deliveryEU / USVercelWeb hosting and CDNEU / GlobalStripeSubscriptions and paymentsEU / USApollo / FirecrawlB2B data enrichment and crawlingEU / USAnthropic (Claude)AI analysis of lead and company data and outreach email generationEU / USWhere data is transferred outside the EU, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards.
6. Data retention
Account and campaign data is retained while your account is active and up to 24 months after closure for legal and accounting reasons. Invoices are kept 7 years under Estonian law. You can request deletion at any time.
7. Your GDPR rights
- Access — get a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure — right to be forgotten.
- Restriction — limit how we use your data.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent at any time (where consent is the basis).
- Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
Send requests to info@openweb360.eu. We respond within 30 days.
8. Data security
Data is encrypted in transit (TLS) and at rest. Access is limited to authorized personnel via role-based controls and audit logs. Our infrastructure is EU-based.
9. International transfers
Some sub-processors may process data outside the EU. We rely on Standard Contractual Clauses and additional safeguards (encryption, pseudonymization) to ensure equivalent protection.
10. Children
Our service is intended for business use and is not directed to anyone under 16. We do not knowingly collect data from minors.
11. Changes to this policy
We may update this policy. Material changes will be announced by email or in-app. The latest version is always at this URL.
12. Contact
Privacy requests: info@openweb360.euGeneral: contact@openweb360.eu
Client acquisition service and website enquiries
This section was added on 24 October 2026 and covers our done-for-you client acquisition service and the enquiry form on openweb360.eu.
Enquiries. If you contact us through the form or book a call, we receive your name, email, company and message. We use them only to reply and to prepare a proposal, and keep them for up to 24 months unless we start working together. The form is delivered by FormSubmit and calls are booked through Calendly; both process the data you enter.
People we contact for our clients. For clients who use the service, we write to business contacts at companies that may need staffing services, using business contact details (name, job title, company, work email) from public registers, company websites and professional directories. The legal basis is the legitimate interest of our clients and ours in business development. Every message states who we are and how to opt out; if you ask us to stop, we add your address to a suppression list immediately and do not contact you again.