Privacy Policy

01Who we are

This website and the Demand Verity service ("DV", "we", "us", "our") are operated by Demand Verity. For anything about privacy, email us at info@demandverity.com.

In this policy, "personal data" and "personal information" mean any information that identifies, or can reasonably be linked to, an individual.

02What this policy covers

We handle personal data in two different roles:

• As a controller. For the following, we decide how personal data is used, and this policy explains that processing in full:
  • this website
  • our Contact form and newsletter
  • our customers' account and billing contacts
  • people who email us
• As a processor. When a business (our "customer") installs DV on its website, the customer is the controller and decides how its visitors' data is used. We process that data on the customer's behalf, only to provide the service, under a Data Processing Agreement. Section 6 explains what the service processes. If you visit a customer's website, that customer's privacy notice also applies to you.

This policy does not cover third-party websites or services linked from our website, such as our social media pages. They have their own privacy policies.

03Information we collect

Information you give us

• Contact and demo requests. When you use the Contact form, we collect:
  • your name, company, work email and role
  • the monthly form submission range you select
  • whether you want a demo or have a general question
  • anything you write in the message.
• Newsletter. Your work email address and the date you subscribed.
• Account information. When you or your company get a DV account, we collect:
  • your name, work email, company name and role
  • your login details, including multi-factor authentication settings
  • the websites you connect to DV.
• Billing information. Once paid plans start, we collect your billing contact and address, plan, and invoice history. Our payment provider handles payment card details. We do not store them.
• Communications. The content of emails and support requests you send us, and our replies.

Information collected automatically on this website

• Server logs. To deliver and secure the website, our hosting provider receives:
  • your IP address, browser type and device type
  • the pages requested and the referring page
  • the time of each request.
• Cost calculator. The numbers you enter in the cost calculator are calculated in your browser and are not sent to us.

Information from others

• Results of email, phone and IP address checks, received from verification providers when DV's own checks cannot decide. See section 6.
• If a colleague adds you to a customer account, the details they provide about you.
• If you connect an optional Google integration, information from Google Sheets, Google Analytics 4 or Google Search Console. See section 7.

We do not ask for sensitive information by email, and we ask you not to send it. That includes health data, government ID numbers and payment card numbers.

04How we use information

• To answer your Contact form request, arrange demos and respond to questions.
• To send the research newsletter to people who subscribed.
• To create and manage accounts and provide the DV service, including the dashboard, verdicts, notes and syncs that customers ask for.
• To provide support.
• To keep the website and the service secure. This includes detecting abuse, fraud and unauthorized access.
• To understand how the service is used and to improve it, using aggregated or de-identified information wherever possible. Google user data, including aggregated or de-identified information derived from it, is used only for the purposes described under Google integrations and Google user data, subject to the Google API Services User Data Policy and its Limited Use requirements.
• To send service notices, such as security alerts, usage warnings and changes to our terms.
• To bill customers and keep business records once paid plans start.
• To comply with the law, enforce our terms and defend legal claims.

We do not sell personal data. We do not share it for cross-context behavioral advertising. We do not use our customers' visitor data to build advertising profiles or to train models for anyone else's benefit.

05Legal bases (EEA and UK)

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 13).

06The DV service and our customers' visitors

When a customer installs the DV script, DV processes the following about that customer's website visitors. It uses this information to give each form submission a verdict of ACT, DELAY or FILTER.

• Journey events:
  • pages viewed
  • referrer and traffic source, including when a visit comes from an AI assistant, if the browser passes that information
  • timestamps
  • return visits.
• How a form is filled: timing, edits and whether text was pasted. Before a form is submitted, DV records this behavior only, never what is typed.
• Submitted form fields, once the visitor submits the form.
• Technical data: IP address and general network information, such as whether a connection comes from a data center. An IP check may return a country-level location signal. DV does not record city-level or GPS location.
• Verification results for the email address, phone number, IP address and company behind a submission.

What DV never collects or does

• DV never collects passwords, payment card details, government ID numbers, health data or precise geolocation.
• DV does not use device fingerprinting.
• DV honors Global Privacy Control and Do Not Track signals, and never scores anyone worse for limiting tracking.
• DV does not see what someone asked an AI assistant.

What the customer receives: Each submission reaches the customer's CRM, autoresponder or spreadsheet, with the verdict and an operational note added to the contact record.

If you visited a website that uses DV: to exercise your rights, contact that website's owner. We will help them respond. If you contact us directly, we will pass your request to them.

07Google integrations and Google user data

Connecting Google services

Google integrations are optional. Where available, you can authorize Demand Verity to connect Google Sheets, Google Analytics 4 (GA4), or Google Search Console. We access these services through Google’s authorization process, not by asking for your Google password. Connecting these services is not required for DV’s core form-submission and demand-validation processing.

Google Sheets

When you connect a spreadsheet, we store its identifier, selected tab, configured field and outcome mappings, connection status, and the authorization tokens needed to maintain the connection.

DV reads headers and configured outcome cells for DV-tracked rows. It can add dedicated DV headers and append eligible commercial leads, including available approved contact and business fields, together with DV verdicts and operational notes. Updates to existing tracked rows change only DV verdict and note fields, preserving existing contact and business details.

Outcomes read from the configured cells are matched to the corresponding DV records and used for outcome tracking, reporting and, where eligible, DV’s outcome-based calibration.

Google’s Sheets permission covers spreadsheets beyond the one you configure. DV limits its integration operations to the configured spreadsheet and tab. This integration does not delete your spreadsheets or request access to Gmail or the general Google Drive API.

Google Analytics 4 and Search Console

Where Google Site Context is available and connected, DV uses read-only access to identify eligible properties and streams and retrieve aggregate reports for the selected website.

These reports include configured GA4 event counts and Search Console page-performance information, such as page URLs, clicks, impressions, click-through rate and average position. We store the selected property and stream identifiers, relevant configuration, and minimized report snapshots.

This information provides website-level context in DV. It is not used to identify individual visitors, joined to individual leads, used to calculate lead verdicts, or included in lead exports. These integrations do not modify your Analytics or Search Console properties.

Use, protection and sharing

We use Google user data to operate and maintain the connected features described above. OAuth access and refresh tokens are encrypted at rest. Access to integration data is restricted through DV’s account and role-based access controls.

Authorized users of your DV account can view the relevant integration information. Necessary service providers may process it on our behalf to operate these features, subject to contractual restrictions and applicable Google requirements.

We do not sell Google user data or use it for advertising, retargeting, creditworthiness or lending decisions. Human access is limited to circumstances permitted by Google’s requirements, such as your affirmative permission, necessary security investigations, legal obligations, or permitted use of aggregated data for internal operations.

Google-data transfers are limited to providing or improving the connected user-facing features with your consent, necessary security purposes, legal obligations, or a business transfer with your explicit prior consent. These limits take precedence over broader sharing language elsewhere in this policy.

Our handling and transfer of Google API data follow the Google API Services User Data Policy, including its Limited Use requirements.

Retention, disconnecting and deletion

Disconnecting Google Sheets removes its stored OAuth tokens from DV and stops further synchronization. It does not delete your spreadsheet or erase previously recorded DV validations, tracked-row links, outcomes or audit history. Those records remain subject to the applicable retention and deletion provisions elsewhere in this policy.

For Google Site Context, report snapshots expire after 35 days from retrieval and are removed by scheduled cleanup. Expired reports are not displayed. Stored authorization tokens expire after 30 days without a successful authorized report retrieval; the cleanup process removes those tokens and associated snapshots. Disconnecting Site Context removes its stored connection tokens and report snapshots from DV.

You can also revoke the relevant Demand Verity app’s access through your Google Account connections page.

Revoking access at Google stops future authorized access but does not itself erase records already retained by DV or data in your own spreadsheet. Sheets and Site Context use separate Google connections; revoke each relevant connection if you want to stop both.

To request deletion of retained Google-derived data, contact info@demandverity.com. We handle requests under the rights, identity-verification, retention and legal requirements described in this policy.

For Google user data, the specific access, use, protection, sharing and retention rules in this section take precedence over any broader wording elsewhere in this policy.

08Automated decisions

DV produces its verdicts automatically by weighing several independent signals.

• No single signal decides the verdict.
• How a form was written, including with AI, is never counted against anyone on its own.
• A verdict is a recommendation to the customer about where to spend sales time. It does not decide anyone's legal rights, access to credit, employment or similar matters.
• Customers decide what their systems do with each verdict.
• DV's original verdict is never overwritten.
• FILTERed submissions are kept, not deleted.

09Sharing and disclosure

We share personal data only in these situations:

• Service providers. Companies that help us run DV and this website, under contracts that require them to protect the data. They may use it only to provide their service to us. They include:

  • verification providers for IP address, email and phone checks
  • hosting providers
  • email hosting and delivery providers.

  The providers that process data for the DV service are named on our Sub-processors page.

• Our customers. Visitor data processed through DV is made available to the customer whose website it came from.

• Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, personal data may transfer to the new owner. The new owner must keep protecting it as this policy describes.
• Legal reasons. When the law requires it, or when needed to protect the rights, property or safety of our users, the public or us.
• With your permission. In any other case, only if you agree.

Google user data from optional Google integrations is shared and transferred only as section 7 describes. Those limits take precedence over this section.

10International transfers

Demand Verity and some of our providers operate in the United States or in other countries outside the UK and the European Economic Area. When personal data is transferred out of these areas, we use a lawful transfer mechanism. Examples:

• the European Commission's Standard Contractual Clauses
• the UK International Data Transfer Addendum
• a provider's certification under the EU-U.S. Data Privacy Framework, where available.

You can ask us for more information about these safeguards.

11Retention

We may keep information longer if the law requires it or to resolve a dispute. We may also keep aggregated information that no longer identifies anyone.

12Security

We use technical and organizational measures appropriate to the risk:

• each customer's data is kept separate from other customers' data
• role-based access, limited to people who need it
• multi-factor authentication required on every account
• protected credentials
• logging and audit trails
• regular review of our providers.

DV records are retained and deleted according to the Retention section of this policy. Certain connection credentials and report snapshots also expire or are removed automatically as described under Google integrations and Google user data. Every important action is logged, and DV's original verdict is never overwritten.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the authorities as the law requires.

13Your rights (EEA and UK)

If you are in the European Economic Area or the United Kingdom, you have the right to:

• access the personal data we hold about you and get a copy
• correct data that is inaccurate or incomplete
• have your data deleted
• restrict how we use your data
• receive your data in a portable format
• object to processing based on legitimate interests, and to direct marketing at any time
• withdraw consent at any time, without affecting processing that already happened
• complain to your local data protection authority.

How to use these rights

• Email info@demandverity.com.
• We will reply within one month, and may ask you to confirm your identity first.
• We will not charge you, unless a request is clearly unfounded or excessive.
• If your data came to us through a customer's website, we will forward your request to that customer.

14Your rights (United States)

Depending on your state of residence, you may have the right to:

• know what personal information we collect and how we use it
• access it
• correct it
• delete it
• get a copy.

These states include California, Virginia, Colorado, Connecticut and others with comprehensive privacy laws. You also have the right not to be discriminated against for using these rights.

• Categories we collect:
  • identifiers, such as name, email and IP address
  • commercial information, such as plan and billing history once paid plans start
  • internet activity, such as pages viewed and form-filling behavior
  • professional information, such as company and role.
• Sale and sharing: we do not sell personal information and do not share it for cross-context behavioral advertising. We do not knowingly process the personal information of anyone under 16.
• Sensitive information: we do not collect sensitive personal information for the purpose of inferring characteristics about you.
• Opt-out signals: we honor Global Privacy Control signals.

How to make a request

• You or an authorized agent can email info@demandverity.com.
• We will verify the request before acting on it, and respond within the time the law allows.
• If we decline a request, you may appeal by replying to our decision.

15Marketing emails

We send the research newsletter only to people who subscribed. Every email includes a way to unsubscribe, and you can also email us to stop.

Service notices about your account, such as security or billing messages, are not marketing. They will still be sent while you have an account.

16Children

DV is a business service and is not directed at anyone under 16. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

17Changes to this policy

We may update this policy as DV develops or the law changes. When we do, we will update the date at the top. Before any significant change takes effect, we will email customers and newsletter subscribers about it.

18Contact

Demand Verity · info@demandverity.com