1. What we collect
- Account info — your name, email address, and company name when you sign up.
- Usage data — which features you use, when you log in, and how you interact with the dashboard. We use this to improve the product, not to profile you.
- Lead data — the commercial property owner contacts you add or that we surface for you. This data belongs to you. We store it on your behalf and do not use it for any purpose other than running your sequences.
- Payment info — handled entirely by Stripe. We never see or store your card number, CVV, or billing address. Stripe is PCI-DSS compliant.
2. How we use it
- To operate the product — send your outreach sequences, surface leads, track your pipeline, and deliver the features described on the pricing page.
- To improve the product — understanding which features are used helps us prioritize what to build next.
- To communicate with you — account updates, weekly performance digests, and material product changes.
- We never sell your data. Ever. To anyone.
3. Who we share it with
We work with a small number of infrastructure providers:
- Supabase — database and authentication infrastructure. All data is encrypted at rest.
- Resend — email delivery. They process the emails you send through CactisCactis sequences.
- Stripe — payment processing. They handle all billing and subscription management.
- Anthropic — AI template generation. We send the content of your email templates for rewriting assistance. No personally identifiable information about your leads is sent to Anthropic.
- Vercel — hosting and edge infrastructure.
No advertising networks. No data brokers. No third-party analytics beyond basic page-view counts.
4. Your data rights
- Export — email youssef@cactiscactis.com and we'll send you a full export of your data within 48 hours.
- Delete — cancel your account and all your data is permanently deleted within 30 days.
- CCPA / GDPR — contact us at youssef@cactiscactis.com to exercise any rights under applicable privacy law.
5. Data security
- All data is encrypted in transit using TLS and at rest using AES-256 via Supabase.
- Passwords are hashed and salted using industry-standard algorithms — we cannot see them.
- Payment data is tokenized by Stripe and never touches our servers.
- Access to production systems is restricted to the founding team.