Privacy Policy

Last updated: November 5, 2026
Version: 1.4

Preb is a contact data enrichment service for recruiting teams. This Privacy Policy explains how Kranz & Gupta, Indiepal GbR ("Preb", "we", "us") collects, uses, shares and protects personal data when you visit preb.co, create an account, use the Preb application, receive our emails or contact our support.

It is written for two groups of people:

• Customers and Users: the people and companies who create a Preb workspace, sign in and use the service.
• Contacts: the people whose details our Customers upload to Preb and ask us to enrich (for example candidates and hiring managers). If you are a Contact, Section 12 is written for you.

We are a German company. The EU General Data Protection Regulation (GDPR) applies to everything we do, no matter where you live. Because most of our Customers are in the United States, Section 13 adds the information required by US state privacy laws.

1. Who is responsible for your data

The controller responsible for the processing described in this policy is:

Kranz & Gupta, Indiepal GbR
Brunnenstr. 11
53123 Bonn
Germany

Represented by: Leon Kranz and Arun Gupta
Email: hello@preb.co (also for all privacy requests)

We have not appointed a data protection officer because the legal thresholds for a mandatory appointment are not met. Our founders handle privacy requests personally.

2. Our two roles: controller and processor

Preb handles personal data in two different roles, and your rights depend on which one applies.

Preb as controller. We decide how and why to process the data of our Customers, Users, website visitors and support contacts. This covers your account, sign-in, billing, support conversations, product emails, security logs and cookies. Sections 3 to 11 describe this processing.

Preb as processor. When a Customer uploads a spreadsheet of Contacts and asks us to find work emails, personal emails or phone numbers, we act only on that Customer's documented instructions. The Customer is the controller of the Contact data and decides why it is processed. We do not use Contact data for our own purposes, we do not sell it, we do not combine Contact data across different Customers, and we do not build our own contact database from it. This processing is governed by our Data Processing Agreement (DPA), which forms part of our contract with every Customer and lists the categories of data, the retention periods, the security measures and our sub-processors.

One exception: sample lists we prepare ourselves. When one of our founders enriches a handful of profiles for a prospective customer as a free sample, nobody has instructed us. For those few Contacts we are the controller. Section 12 explains this under "Sample lists prepared by Preb".

If you are a Contact and want to know why a particular company processed your data, that company is your first point of contact. We will still help you, as described in Section 12.

3. The personal data we collect

We collect only what we need to run the service. The data falls into the following categories.

3.1 Account and profile data

When you sign up we collect your email address, your full name, the name of your workspace and the role you hold in it (owner, admin or member). You can also give us a phone number during onboarding or later in your profile settings. It is optional, it is never shown to your teammates, and you can change or remove it at any time. We use it to help you set up your trial and to reach you about support requests you raise or urgent issues with your account. If you sign in with Google, we also receive your Google profile picture and your Google account identifier. We record when you created your account, when you completed onboarding and when you were invited to a workspace.

Preb is a business tool. During sign-up we check the domain of your email address and do not accept addresses from free webmail providers or disposable email services, unless you were invited by an existing workspace. Invitations contain the invitee's email address and the role assigned by the inviter.

If you create your account through another Customer's invite link, we record the invite code it came from, the time of sign-up and whether and when your workspace later paid for its first plan, so that we can grant the inviting workspace its reward. We keep a hashed form (SHA-256) of your email address with that record so that nobody can be rewarded twice for the same person, also after an account is deleted. The inviting workspace sees only the first letter and the domain of your email address, the date you signed up and the status of the referral, never your name or your full address. If you share your own invite link, we count how often it was opened; we store no data about the visitors.

3.2 Sign-in and session data

Preb has no passwords. You sign in with a one-time magic link that we send to your email address, or with your Google account. We process the sign-in token, the time of sign-in and a session cookie that keeps you signed in. We limit the number of magic links per email address to protect against abuse.

If you use Google sign-in, Google shares your name, email address and profile picture with us. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use this information only to create and secure your account.

3.3 Billing data

Payments are handled by Stripe. When you buy a plan, Stripe collects your card details, billing address, an optional tax identification number and any promotion code you enter. We never see or store full card numbers. We store the Stripe customer and subscription identifiers, your plan, your billing period, your subscription status and your credit grants and consumption, because we need them to run your workspace and to issue invoices.

3.4 Usage, device and log data

When you use preb.co, our hosting provider records technical data about each request: your IP address, browser type and version, operating system, the pages and endpoints you call, timestamps, referring page and error codes. Our authentication provider keeps sign-in logs. We use no error monitoring or session recording service.

Inside the application we keep records of what happens in your workspace: lists created, enrichment runs started, stopped or paused, credits consumed, members invited and plan changes. Some of these events appear in your notification center.

3.5 Support and feedback data

Our support chat, help center and feedback board are provided by Featurebase. When you open them while signed in, we pass a signed identity token so that the support conversation shows who is writing. The token contains your user ID, email address, name, profile picture, account creation date, role, and your workspace's name, plan, monthly plan price, available credits, trial status, subscription status and billing period end. The content of your messages, feature requests and votes is stored by Featurebase.

3.6 Communication data

We keep a log of every email we send you (recipient address, type of email, provider message ID and time). We use this log to avoid sending duplicate emails, to enforce rate limits on sign-in emails and to prove delivery if there is a dispute. If you write to us, we keep the correspondence.

3.7 Customer Content (processed on behalf of our Customers)

Customer Content is the Contact data our Customers upload and the results we return. It includes:

• the uploaded CSV or XLSX file and every column it contains, including columns we do not use for enrichment;
• the input fields mapped by the Customer: first name, last name, full name, company name, company domain, LinkedIn profile URL and email address;
• contacts entered manually one by one;
• the results of enrichment: work email addresses and their deliverability status, personal email addresses and their status, phone numbers with line type, region and ownership match, job title, current company, company domain and logo, location, and public professional profile data returned by our data provider, which can include headline, employment history, education, skills, languages and professional network identifiers;
• the identity of a person identified from an email address (reverse lookup).

Customer Content is only processed as described in Section 2 and in the DPA. Each workspace can see only its own Customer Content.

3.8 AI assistant connections

You can connect an AI assistant you use, such as Claude or ChatGPT, to Preb so that you can start enrichments and read results from inside that assistant. The connection uses the OAuth standard: you sign in to Preb in your browser and approve the connection, and the assistant receives an access token that it stores. We never see your password for the assistant and the assistant never receives a Preb password or API key. For each connection we store the assistant's technical client identifier and name, the workspace you chose, when the connection was made, when it was last used and how many requests it made. We do not store the content of your conversations with the assistant.

When the assistant calls Preb, it sends us the names, companies, LinkedIn URLs or email addresses you asked it to look up, and we return the results to it. From that moment the assistant's provider (for example Anthropic for Claude or OpenAI for ChatGPT) processes that data under its own terms and privacy policy, on your instruction. The provider is not a sub-processor of Preb. You can end a connection at any time under Integrations in the application; the assistant then loses access immediately.

4. Why we process your data and on what legal basis

The GDPR requires us to name a legal basis for every purpose. The list below applies to the data we process as controller.

• Creating and running your account and workspace, signing you in, inviting team members. Data: account, sign-in and session data. Legal basis: performance of our contract with you (Art. 6 (1) (b) GDPR).
• Providing the enrichment service, showing progress, delivering exports. Data: account data, usage data; Customer Content as processor. Legal basis: performance of our contract (Art. 6 (1) (b) GDPR); for Customer Content, the Customer's instructions under the DPA.
• Connecting an AI assistant you chose to your account and answering its requests on your behalf. Data: connection data (Section 3.8), account data; Customer Content as processor. Legal basis: performance of our contract (Art. 6 (1) (b) GDPR); for Customer Content, the Customer's instructions under the DPA.
• Billing, invoicing, credit accounting, preventing double charges. Data: billing data, usage data. Legal basis: performance of our contract (Art. 6 (1) (b) GDPR) and our legal obligations under German tax and commercial law (Art. 6 (1) (c) GDPR, § 147 AO, § 14b UStG, § 257 HGB).
• Sending transactional emails: magic links, invitations, welcome message, enrichment finished, paused or stopped, low credits, trial ending, referral reward. Data: account and communication data. Legal basis: performance of our contract (Art. 6 (1) (b) GDPR).
• Sending product news and tips about Preb to existing Customers. Data: email address, name. Legal basis: our legitimate interest in keeping Customers informed about the product they use (Art. 6 (1) (f) GDPR, § 7 (3) UWG). You can opt out at any time, see Section 15.
• Reaching you by phone about a support request you raised or an urgent issue with your account (for example a failed payment or an enrichment run that needs your decision). Data: phone number, name, workspace. Legal basis: performance of our contract with you (Art. 6 (1) (b) GDPR).
• Calling a new Customer once to help them get started with their trial. Data: phone number, name, workspace. Legal basis: our legitimate interest in helping business customers succeed with the product they signed up for (Art. 6 (1) (f) GDPR) and the presumed consent of a business that gave us its number for this purpose (§ 7 (2) no. 1 UWG). You can opt out at any time in your profile settings, see Section 15.
• Running the referral programme: recording that an account was created through an invite link, checking the conditions, granting and where necessary withdrawing the reward, preventing abuse. Data: invite code, time of sign-up, hashed email address of the referred person, the referred workspace's first payment, the inviting workspace. Legal basis: performance of our contract with both Customers (Art. 6 (1) (b) GDPR) and our legitimate interest in running the programme fairly and preventing abuse (Art. 6 (1) (f) GDPR).
• Keeping the service secure: preventing fraud, account takeover, trial abuse and automated attacks, rate limiting, blocking free webmail domains. Data: sign-in, session, usage and log data. Legal basis: our legitimate interest in protecting the service and our Customers (Art. 6 (1) (f) GDPR).
• Finding and fixing errors, monitoring availability and performance. Data: usage and log data. Legal basis: our legitimate interest in running a reliable service (Art. 6 (1) (f) GDPR).
• Answering support requests and collecting product feedback. Data: support and feedback data. Legal basis: performance of our contract (Art. 6 (1) (b) GDPR) and our legitimate interest in improving Preb (Art. 6 (1) (f) GDPR).
• Showing a consent banner and remembering your cookie choices. Data: consent records. Legal basis: our legal obligation to obtain and document consent (Art. 6 (1) (c) GDPR, § 25 TDDDG).
• Measuring our advertising: understanding whether a visit, sign-up or purchase followed one of our ads on Meta platforms (Facebook, Instagram). Data: cookie identifiers, click identifier, IP address, browser details, and a hashed form of your email address and user ID at sign-up and purchase. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 TDDDG), which you can withdraw at any time, see Section 5.
• Website analytics and other non-essential cookies, where used. Data: usage data, cookie identifiers. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 TDDDG), which you can withdraw at any time.
• Preparing a free sample list for a prospective customer: enriching a few profiles the prospect names, showing the prospect the result behind a link and an access code, and recording whether the link was opened, unlocked, downloaded and whether the prospect signed up. Data: name, company and LinkedIn profile of the prospect, optionally their email address; names, employers and LinkedIn profiles of the people in the sample and the results found; engagement events without IP address or device data. Legal basis: our legitimate interest in demonstrating the service to business prospects and in following up on our outreach (Art. 6 (1) (f) GDPR). For the people in the sample, see Section 12.
• Internal administration: our founders viewing user, workspace and operations data to run the service, send announcements and resolve incidents. Data: account data, usage data, aggregated operations data. Legal basis: performance of our contract (Art. 6 (1) (b) GDPR) and our legitimate interest in operating the service (Art. 6 (1) (f) GDPR).
• Responding to legal requests, defending claims, enforcing our terms. Data: any of the above as needed. Legal basis: our legal obligations (Art. 6 (1) (c) GDPR) and our legitimate interest in protecting our rights (Art. 6 (1) (f) GDPR).
• Responding to privacy requests and keeping a record of them. Data: identity and contact data of the requester. Legal basis: our legal obligation (Art. 6 (1) (c) GDPR, Art. 12 to 22 GDPR).

Where we rely on legitimate interest, we have weighed our interest against your rights and concluded that your rights do not override it. You can object to any processing based on legitimate interest, see Section 11.

5. Cookies and similar technologies

We use a small number of cookies and browser storage entries.

Strictly necessary. These are required for the service to work and do not need your consent:

• Session cookies set by our authentication provider (names beginning with "sb-") that keep you signed in and refresh your session.
• The consent cookie set by our consent manager, Termly, which remembers your cookie choices.
• A short-lived cookie ("preb_prefill_email") that carries the email address you enter in the sign-up form on our website to the sign-in page, so you do not have to type it again. It expires after 10 minutes and is deleted as soon as the sign-in page has read it.
• A cookie ("preb_ref") set when you open an invite link and click Sign up or Sign in. It carries the invite code to the sign-up so that the inviting workspace can be credited. It expires after 30 days and is deleted once your workspace is set up.
• Browser storage used by the support widget to keep your conversation open.
• Local storage entries that remember your light or dark mode choice and the columns you show in a table. These never leave your browser.

Consent-based. Analytics, measurement or marketing cookies are only set after you accept them in the consent banner. Our consent manager blocks such scripts until you decide. You can change or withdraw your choice at any time through the "Cookie preferences" link in the account menu and in the website footer. We honour the Global Privacy Control (GPC) browser signal as an opt-out from non-essential cookies.

Advertising measurement (Meta). If you accept advertising cookies, we use the Meta Pixel and the Meta Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta") on preb.co and app.preb.co. The pixel sets the cookies _fbp (identifies your browser, 90 days) and _fbc (stores the click identifier of a Meta ad you clicked, 90 days) and reports page views to Meta. When you request a sign-in link for a new account, finish creating your workspace, open the checkout or pay for your first subscription, we additionally send Meta a server-side event with the event type, the time, the page, your IP address and browser details, the _fbp and _fbc values, the plan and amount where applicable, and your email address and user ID in hashed form (SHA-256) so that Meta can match the event to an ad click. We use this data only to measure and improve our advertising on Meta platforms. Meta is a joint controller with us for the collection and transmission of this data under Art. 26 GDPR, based on Meta's Controller Addendum, and sole controller for its further processing, which is described in Meta's privacy policy at facebook.com/privacy/policy. Meta is certified under the EU-US Data Privacy Framework. Nothing is sent to Meta, in the browser or from our servers, until you accept advertising cookies in the consent banner, and you can withdraw your consent at any time through "Cookie preferences", which stops all further transmission.

We use no other analytics or marketing cookies. If we introduce any, we will list them in the Cookie Policy and set them only after your consent.

A full list of cookies with names, purposes and lifetimes is published in our Cookie Policy.

6. Who receives your data

We share personal data only with service providers that help us run Preb, and only to the extent needed for their task. Each provider is bound by a data processing agreement, processes data on our instructions and may not use it for its own purposes. Our current providers are:

• Supabase, Inc. (USA). Service: database, authentication, file storage, live updates. Data: all account, billing, log and Customer Content data. Location: USA (AWS us-east-1).
• Vercel Inc. (USA). Service: hosting, application servers, scheduled jobs, request logs. Data: all data passing through the application, IP addresses, logs. Location: USA.
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA). Service: payments, invoices, customer portal. Data: name, email, billing address, tax ID, payment details, purchase history. Location: Ireland and USA.
• Resend, Inc. (USA). Service: sending transactional emails and product news, managing unsubscribes. Data: email address, name, email content. Location: USA.
• Google LLC (USA). Service: Google sign-in (only if you choose it). Data: name, email, profile picture, Google account ID. Location: USA.
• Cordnet OÜ, trading as Featurebase (Estonia). Service: support chat, help center, feedback board. Data: the data listed in Section 3.5 and the content of your messages. Location: Germany (hosting), Estonia.
• Termly LLC (USA). Service: cookie consent banner and consent records. Data: consent choices, truncated IP address, browser details. Location: USA.
• Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA). Service: advertising measurement (only with your consent, see Section 5). Data: cookie and click identifiers, IP address, browser details, event data, hashed email address and user ID. Location: Ireland and USA.
• Specialist B2B contact data providers. Service: finding and verifying work emails, personal emails, phone numbers and professional profile data for Customer Content. Data: contact names, company names and domains, LinkedIn URLs, email addresses, together with technical reference IDs. Location: USA and EU, see our Sub-processor List.

Our enrichment data providers process Contact data only on our instructions and only to deliver the result our Customer requested. They are named, together with their own sub-processors and locations, in our Sub-processor List, which forms part of the DPA.

AI assistants you connect. When you connect an AI assistant (Section 3.8), the assistant's provider receives the data you ask it to look up and the results Preb returns. It acts on your instruction and under its own privacy terms, not as our service provider.

Company logos. The application displays company logos by loading them from the URL our data provider returns. Your browser requests the image directly from the hosting server, which therefore sees your IP address. We send no referrer information with these requests.

Other recipients. We may disclose personal data to courts, authorities and law enforcement when we are legally required to do so, to our lawyers, accountants and auditors under confidentiality obligations, and to a buyer or successor if Preb or its assets are sold, merged or reorganised. In that case we will inform you before your data becomes subject to a different privacy policy.

We do not sell personal data and we do not share it with third parties for their own advertising.

7. International data transfers

We are based in Germany, but our main infrastructure is hosted in the United States. This means that your personal data is transferred to and stored in the USA.

The European Commission has decided that companies certified under the EU-US Data Privacy Framework (DPF) provide an adequate level of protection. Where a provider is DPF certified, we rely on that certification. Where it is not, we rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with a transfer impact assessment and additional safeguards such as encryption in transit and at rest.

• Vercel, Resend, Stripe, Google: EU-US Data Privacy Framework (and UK Extension), supplemented by Standard Contractual Clauses in the provider's data processing agreement.
• Termly: EU-US Data Privacy Framework as stated by the provider, supplemented by Standard Contractual Clauses.
• Meta: EU-US Data Privacy Framework (Meta Platforms, Inc.), supplemented by Standard Contractual Clauses in Meta's data transfer addendum.
• Supabase: Standard Contractual Clauses (Module 2 and Module 3) included in the Supabase data processing addendum.
• Enrichment data providers: Standard Contractual Clauses included in their data processing agreements.
• Featurebase: no third-country transfer for hosting (Germany). Its own sub-processors are covered by Standard Contractual Clauses.

You can request a copy of the relevant transfer safeguards by writing to hello@preb.co.

8. How long we keep your data

We keep personal data only as long as we need it for the purposes above or as the law requires. Afterwards we delete or anonymise it.

• Account and profile data: for as long as your account exists. Deleted within 30 days after you ask us to delete your account or workspace.
• Phone number and your choice about calls: until you remove the number in your profile settings or delete your account. The time of your last change to the call setting is kept with the number as a record of your choice.
• Workspace invitations: 7 days, then the invitation expires and is removed.
• AI assistant connections: until you disconnect the assistant under Integrations or delete your account. The assistant's access token expires on its own and is renewed only while the connection exists.
• Session and sign-in tokens: magic links expire after a short time. Sessions end when you sign out or after the session lifetime.
• Draft lists and uploaded files not yet enriched: deleted after 24 hours.
• Lists, Contact data, enrichment results and uploaded files (Customer Content): until the Customer deletes the list or the workspace is deleted. Deleting a list permanently removes its contacts, results and the uploaded file.
• Sample lists we prepare for prospective customers, the prospect's details and the engagement record: until our founder closes and deletes the sample, at the latest 12 months after the link was last opened. The prospect's workspace, if they sign up, follows the account retention above.
• Enrichment cache used to avoid charging the same workspace twice for the same contact: 90 days from the enrichment, or earlier when the related list is deleted. The cache is kept per workspace.
• Enrichment results at our data provider: 3 months, then deleted automatically by the provider.
• Raw notifications from our data provider and from Stripe (webhook payloads): 30 days after processing.
• In-app notifications: 90 days.
• Email send log: 12 months, or deleted at once with the account.
• Hashed email address and Google account identifier of a deleted account, used only to prevent repeated free trials: 12 months after deletion.
• Referral records (invite code, time of sign-up, status, hashed email address of the referred person): for the life of the inviting workspace. The hashed email address of a referred person is kept so that no second reward is paid for the same person.
• Server request logs at our hosting provider: up to 30 days.
• Support conversations and feedback: for as long as your account exists, unless you ask us to delete them earlier.
• Credit grants and ledger entries: for the life of the workspace, then as part of billing records.
• Invoices, payment records and the data required to prove them: 10 years after the end of the year in which they were issued (§ 147 AO, § 257 HGB).
• Consent records: 3 years after the consent ends, as proof of consent.
• Privacy requests and our response: 3 years after the request was closed.

Backups are deleted in line with our provider's backup rotation, normally within 30 days after the live data is deleted.

9. How we protect your data

We apply technical and organisational measures appropriate to the risk:

• All traffic between your browser, our application and our providers is encrypted with TLS. Data is encrypted at rest at our database and storage provider.
• Each workspace's data is isolated by database-level row security. A user can only read data of workspaces they are a member of.
• Access within a workspace is role based. Only owners and admins can manage members, billing and delete lists.
• We use passwordless sign-in with expiring magic links or Google sign-in, so there are no passwords to steal.
• Incoming notifications from our data provider and from Stripe are checked with cryptographic signatures before we act on them.
• Uploaded files are stored in a private bucket and are only reachable through signed, time-limited links.
• Card data is handled by Stripe, a PCI DSS Level 1 certified provider, and never touches our systems.
• Access to production systems is limited to the two founders and protected by two-factor authentication.
• We log security-relevant events and review errors and anomalies.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify you and the competent supervisory authority as required by Art. 33 and 34 GDPR.

10. Your rights under the GDPR

You have the following rights with respect to the personal data we process as controller:

• Access (Art. 15): to know whether we process your data and to receive a copy.
• Rectification (Art. 16): to have inaccurate data corrected. You can change your name yourself in your profile settings.
• Erasure (Art. 17): to have your data deleted where we no longer need it or where you withdraw consent.
• Restriction (Art. 18): to have processing limited while a dispute about the data is resolved.
• Portability (Art. 20): to receive the data you provided to us in a machine-readable format. You can export your lists yourself at any time.
• Objection (Art. 21): to object to processing based on legitimate interest, including product news. We will stop unless we can show compelling legitimate grounds.
• Withdrawal of consent (Art. 7 (3)): where processing is based on consent, you can withdraw it at any time with effect for the future, for example through the cookie preferences.
• Complaint (Art. 77): to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

11. How to exercise your rights and delete your account

Write to hello@preb.co from the email address linked to your account, or send a letter to the postal address in Section 1. Tell us which right you want to exercise. We may ask you to confirm your identity, for example by replying from your account email or by signing in. We answer within one month. If a request is complex we may extend this by up to two months and will tell you why.

Deleting your account or workspace. You can do both yourself in the application. Settings, Profile, "Delete account" removes your profile, your sign-in, your notifications and your memberships, and deletes every workspace you own together with all its lists, contacts, uploaded files and credits. Workspace owners can also delete only the workspace under Settings, Members, "Delete workspace". Both actions ask you to type your email address or the workspace name, take effect immediately and cannot be undone. A running subscription is cancelled at once, and credits already used are not refunded. Remaining team members are informed in the application. Copies in backups are removed within 30 days. Billing records that we must keep under tax law are retained for the statutory period and are not used for anything else. Export your lists before deleting, because deletion is permanent. If you prefer, you can also email hello@preb.co and we delete the account for you within 30 days.

Members and invitations. Workspace owners and admins can remove members at any time, and members can leave a workspace themselves. Removing a member does not delete the lists they created, because those belong to the workspace.

Exercising your rights is free of charge. We will not discriminate against you for doing so.

12. Information for Contacts: people whose data our Customers enrich

If a recruiting team has used Preb to find your contact details, this section is for you.

What happens. A Customer uploads a spreadsheet or enters details of people they want to reach, typically name and employer, a LinkedIn profile URL or an email address. On the Customer's instruction we ask specialist B2B contact data providers to find and verify a work email address, a personal email address or a phone number, and to return public professional profile information such as job title, employer and location. The results are shown to the Customer and can be downloaded by them.

Who is responsible. The Customer who uploaded your details is the controller. It decides why it wants to contact you and must have a lawful basis for doing so. We act as its processor. We do not decide to look you up, we do not use your data for our own purposes, we do not combine your data across Customers, we do not sell it and we do not build a database of Contacts.

Sample lists prepared by Preb. Occasionally one of our founders enriches a small number of profiles, typically 10 to 20, that a prospective customer names, so the prospect can judge the quality of the data before signing up. In that case we decide to look you up, so we are the controller for that sample. We rely on our legitimate interest in demonstrating our service to a business prospect (Art. 6 (1) (f) GDPR). The sample is limited to the people the prospect named, it is shown only to that prospect behind a private link and an access code, it is never combined with other samples or with Customer data, and we delete it at the latest 12 months after the link was last opened. The prospect may download the sample; what they do with it afterwards is their own responsibility as a controller. You can object to this processing or ask us to delete your details at any time through the form linked below, and we will also stop including you in future samples.

Where the data comes from. Your data comes from the Customer's own files and from our data providers, who compile publicly available professional information and verify contact details. The providers' own privacy notices explain their sources.

How long it is kept. We keep your data for the Customer for as long as the Customer keeps the list, and in a workspace-level cache for a maximum of 90 days. Our data providers keep results for 3 months. See Section 8.

Your rights. You can exercise your GDPR rights (Section 10) against the Customer. If you do not know who the Customer is, or you prefer to contact us, write to hello@preb.co. We will:

• tell you, if we can, which Customer processed your data, or forward your request to them;
• help the Customer respond to your request within the legal deadlines;
• on your request, add your email address, phone number or LinkedIn URL to our suppression list so that Preb will not return or display those details to any Customer in the future. We keep this list under our legitimate interest in honouring your objection (Art. 6 (1) (f) GDPR). It contains only the data needed to recognise and suppress your details.

You can also put your email address on the suppression list yourself, without contacting anyone, through our form at app.preb.co/opt-out. We send a confirmation link to the address; once you confirm, the address is suppressed and the results we hold about it are deleted. We keep a record of such requests (date, masked identifiers, outcome) for three years as proof that we handled them.

A short summary of these options, written for Contacts, is on our page Your data and Preb.

If you live in the United States, Section 13 also applies to you.

13. Notice for United States residents

This section supplements the rest of this policy for residents of California and of other US states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia). Preb is a small company and may fall below the revenue and volume thresholds of some of these laws. We nevertheless extend the rights described here to all US residents.

13.1 Categories of personal information

In the past 12 months we have collected the following categories of personal information, as defined by the California Consumer Privacy Act (CCPA):

• Identifiers: name, email address, phone number (optional), account ID, IP address, Google account ID. Collected: yes.
• Customer records: billing address, payment information (held by Stripe), tax ID. Collected: yes.
• Commercial information: plan purchased, credits bought and used, invoices. Collected: yes.
• Internet or network activity: pages visited, actions in the app, device and browser information, log data. Collected: yes.
• Geolocation data: approximate location derived from IP address in logs. Collected: yes (coarse only).
• Professional or employment information: workspace name, role; for Contacts: job title, employer, LinkedIn profile. Collected: yes.
• Inferences: none. Collected: no.
• Sensitive personal information: account sign-in credentials (magic link tokens). Collected: yes, only as needed to sign you in.
• Protected classifications, biometric, health, precise geolocation, audio or visual data: none. Collected: no.

Sources: directly from you, automatically from your device and browser, from Google if you use Google sign-in, from Stripe for payment status, and, for Contacts, from our Customers and our data providers.

13.2 How we use and disclose personal information

We use personal information for the business purposes listed in Section 4: providing the service, billing, security and fraud prevention, debugging, support, product communications and legal compliance. We disclose it to the service providers listed in Section 6, each of which is contractually restricted to using the information only to perform services for us.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA regulations (providing the service you requested and preventing security incidents).

Service provider role for Contact data. When we process Contact data on behalf of a Customer, we act as a "service provider" or "processor" under US state privacy laws. We process that information only for the Customer's business purposes, we do not retain, use or disclose it outside the direct business relationship, and we do not combine it with information from other sources, except as permitted by law.

13.3 Your rights

Depending on your state, you have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes and the categories of third parties we disclose it to.
• Delete personal information we collected from you, subject to legal exceptions such as completing a transaction or complying with a legal obligation.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information and of targeted advertising. We do not sell or share, so there is nothing to opt out of, but we honour Global Privacy Control signals as an opt-out of non-essential cookies.
• Limit the use of sensitive personal information. We use it only as permitted, so no further limit is needed.
• Portability: receive your information in a portable format.
• Non-discrimination: we will not deny you service, charge you a different price or provide a different quality of service because you exercised your rights.
• Appeal a decision we made on your request, where your state law provides this right.

13.4 How to submit a request

Email hello@preb.co with the subject "Privacy request", or write to the address in Section 1. We will verify your identity by matching the information you provide with the information in our records, usually by asking you to reply from your account email address. An authorised agent may submit a request on your behalf if they provide written permission signed by you and we can verify your identity.

We respond within 45 days. If we need more time, we will tell you and may take up to 45 additional days. To appeal a decision, reply to our response and tell us that you wish to appeal. We will answer within 45 days and, if we deny the appeal, tell you how to contact your state attorney general.

13.5 Retention

See Section 8 for the retention period of each category of personal information.

14. Children

Preb is a business service for adults. We do not knowingly collect personal data from anyone under 18, and our terms do not allow minors to create an account. If you believe a minor has provided us with personal data, contact hello@preb.co and we will delete it.

15. Emails we send, calls we make, and how to opt out

Transactional emails are part of the service and cannot be switched off while you have an account: sign-in links, invitations, your welcome message, notices that an enrichment run has finished, paused or been stopped, low credit warnings, trial expiry notices, billing information and notices that a friend you invited earned you credits.

Product news are occasional emails to existing Customers about new features, changes to the service and tips for getting better results. We send them under our legitimate interest and under the German rule for existing customers (§ 7 (3) UWG). Every such email contains an unsubscribe link. You can also write to hello@preb.co to opt out. Opting out does not affect transactional emails.

Onboarding call. If you gave us a phone number, one of our founders may call you once, personally, to help you get started with your trial and to answer questions about Preb. We dial by hand, we do not use automated dialling systems, prerecorded messages or text messages, and we do not call for any other marketing purpose. You can switch calls off at any time in your profile settings (Profile, Calls, "Onboarding call"), remove your number there, or write to hello@preb.co. We stop calling immediately once the switch is off.

We do not send cold marketing emails to people who are not our Customers, and we do not use Contact data for marketing.

16. Automated decisions

We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects (Art. 22 GDPR).

A few automated checks protect the service: we block sign-ups from free webmail and disposable email domains, we grant only one free trial per person, we limit the number of trials per email domain within a period, and we keep a hashed record of deleted accounts for 12 months so that deleting and re-creating an account does not grant a new trial. If one of these checks blocks you incorrectly, email hello@preb.co and a founder will review it.

17. Changes to this policy

We update this policy when our service, our providers or the law change. The version date at the top tells you when it was last updated. If a change materially affects how we use your personal data, we will inform you by email or by a notice in the application before it takes effect. Earlier versions are available on request.

18. Contact

Kranz & Gupta, Indiepal GbR
Brunnenstr. 11
53123 Bonn
Germany

hello@preb.co for privacy requests and everything else

Related documents: Terms of Service, Data Processing Agreement, Sub-processor List, Cookie Policy, Imprint.