Privacy Policy

1.Who we are and what this policy covers

1.1 SDRclose is a business-to-business software service operated by BiopharmaWatch LLC, a United States limited liability company ("SDRclose", "we", "us", "our"). It finds prospects matching a customer's filters, researches them, drafts and sends email from mailboxes the customer connects, detects and classifies replies and, where the customer chooses, answers replies and books meetings.

1.2 This policy covers www.sdrclose.com, the SDRclose web application, the email we send and the contact form, and applies to website visitors, account holders and their Authorized Users ("Customers"), individuals whose details a Customer processes through the platform ("Prospects"), and people who write to us.

1.3 Sections 19 to 21 are regional supplements that form part of this policy and prevail, for residents of the jurisdictions they name, over any conflicting earlier section.

1.4 Organizations that use SDRclose to contact you are governed by their own privacy notices (section 15). This policy is a notice rather than a contract: the Terms of Service and Data Processing Addendum govern our contractual obligations, and the Cookie Policy covers browser storage in detail.

2.Our two roles: controller and processor

2.1 Data protection law distinguishes the controller, which decides why and how personal data is processed, from the processor, which acts on the controller's documented instructions. SDRclose occupies both roles, depending on the data.

2.2 Where we are the controller. Account data (name, work email address, company name, sign-in details, plan, billing status, credit balance, support correspondence and product usage), website visitor data, contact form data, and the outreach we send for our own product.

2.3 Where we are the processor. The Customer controls the Prospect data processed through the platform: business contact details and firmographic attributes, research notes, messages, replies, engagement events and opt-out records. We process it only to provide the service, only on the Customer's instructions, and for no purpose of our own.

2.4 In practice. The Customer is responsible for a lawful basis to contact the people on its lists, for their accuracy, and for answering their requests; section 15 explains what we do when a Prospect cannot reach the sender.

2.5 The Data Processing Addendum records our processor obligations and applies automatically whenever we process Prospect data for a Customer. A countersigned copy is available through the contact form.

3.Information we collect and how we obtain it

3.1 Account information. Name, work email address, company name and a salted hash of the password. Email-and-password signup is verified by a one-time code sent to that address. Passwords are never stored in readable form.

3.2 Sign-in with Google or Microsoft. We receive your name, email address and profile picture from the identity provider, never your password for it, and sign-in grants no access to your files, contacts or mail.

3.3 Website visitor technical and log data. IP address, browser and device details, pages requested, referring page, timestamps, request metadata, diagnostic information and security events such as sign-in attempts, with personal data masked in operational logs. The content delivery providers that serve some page assets also receive your IP address and browser details in order to serve the file, under their own privacy terms (section 9).

3.4 Contact form. The work email address you enter, your name if given, the topic selected, your message and any correspondence that follows.

3.5 Connected mailbox credentials. The username, password or authorization token for each mailbox a Customer connects, encrypted at rest and used only to connect to that mailbox on the Customer's behalf.

3.6 Connected mailbox content. To detect and classify replies, the platform reads incoming messages in each connected mailbox, retaining content only as needed to present the conversation, classify the reply, decide whether a sequence stops or resumes and, where enabled, compose a response.

3.7 Prospect records and research notes. Name, job title, seniority, employer, work email address and its verification status, business location, company size and industry, and research notes compiled from public sources. Imported by the Customer, supplied by our prospect data provider, or generated during research.

3.8 Message and engagement data. Messages drafted and sent, delivery outcomes, replies and their classification, meetings booked and, where tracking is enabled, opens and clicks with timestamps (section 10).

3.9 Opt-out records. The email address of anyone who unsubscribes from a Customer's outreach or is added to its suppression list, with the date and the way the opt-out was received (section 12).

3.10 Billing status. Plan, trial and subscription status, renewal date, credit allowance and balance, top-up purchases and credit-consuming actions. Card details are entered on our payment processor's hosted checkout and never reach us.

3.11 Not collected. Payment card numbers, special categories of personal data, government identifiers, health or financial account information and precise geolocation; Customers must not load them into the platform. A business location or time zone is not precise geolocation.

4.How we use information

4.1 Providing the service: authenticating users, maintaining workspaces, connecting to the Customer's mailboxes, finding and researching prospects, drafting, scheduling and sending messages, detecting and classifying replies, presenting conversations, routing drafts through the review queue and, where switched on, answering replies and booking meetings.

4.2 Billing: operating trials and subscriptions, metering credits, processing renewals and cancellations, and issuing billing notices and receipts through our payment processor.

4.3 Support and communication: answering contact form messages and in-app feedback, and sending service messages such as verification codes, security and billing notices, mailbox health alerts, the daily digest and notices of material changes.

4.4 Security: detecting and investigating unauthorized access, fraud and misuse, and enforcing the Terms of Service and Acceptable Use Policy.

4.5 Reliability: diagnosing faults, monitoring mailbox and service health, and improving the service using aggregated, de-identified operational measures, never the content of Prospect data, mailboxes or messages.

4.6 Legal: record-keeping, tax and accounting obligations, lawful requests, and legal claims.

4.7 What we do not do. We do not sell personal information, share it for cross-context behavioral advertising, use Prospect data for our own marketing, or use a Customer's mailbox content, prospect lists, messages or replies to train or fine-tune any model.

4.8 Marketing our own service. We may send account holders occasional messages about SDRclose features, changes and offers, relying on legitimate interests or on consent where the law requires it. You may opt out at any time using the unsubscribe link in any such message or through the contact form; opting out does not affect service messages needed to operate the account. Our outreach to businesses that are not customers is described in section 15.

5.Legal bases for processing under the GDPR and UK GDPR

5.1 Where the GDPR or the UK GDPR applies, we rely on these legal bases for the personal data we control.

5.2 Contract, Article 6(1)(b): creating and administering an account, providing the service, metering credits, operating trials and subscriptions, and support.

5.3 Legitimate interests, Article 6(1)(f): securing the platform, preventing fraud and abuse, monitoring reliability, communicating with existing customers, our own business-to-business outreach, and legal claims (balancing in section 21; objection under section 14).

5.4 Legal obligation, Article 6(1)(c): billing and accounting records, lawful requests, and suppression records so that an opt-out continues to be respected.

5.5 Consent, Article 6(1)(a): any processing for which we ask consent, withdrawable at any time without affecting earlier processing.

5.6 Prospect data. The Customer determines and documents the legal basis for contacting the individuals on its lists. Business-to-business outreach often relies on legitimate interests, but electronic marketing rules are national and some markets require prior consent even for business-to-business email; confirming each market is the Customer's responsibility under the Acceptable Use Policy. We process Prospect data on the Customer's documented instructions under Article 28 and the Data Processing Addendum.

5.7 Opt-out records. Retaining an opt-out record after an erasure request is supported by Article 17(3)(b), because deleting it would defeat the request the individual made (section 12).

6.Artificial intelligence and automated processing

6.1 What the service does. Parts of the service use language-model and research technology from third-party providers to research a prospect from public sources, draft a message, classify an incoming reply and, where a Customer has switched on automatic replies, compose a response in the Customer's voice.

6.2 What is sent. For each task the provider receives only the context it needs: the prospect's business details, existing research notes, the relevant message or reply, and the Customer's writing controls, templates and instructions. Sending and reply detection do not use these providers.

6.3 No training on customer or prospect data. We use these providers only on terms under which submitted data is not used to train their models, and we train no models on customer or prospect data; Prospect data, mailbox content, messages and replies are never used to train or fine-tune any model.

6.4 Human oversight. The review queue is the default: nothing is sent until a person approves it, unless the Customer switches on autopilot for a sequence. Autopilot has three separate controls, for automatic sending, replies and booking, each independently switchable. A hand-written, locked template is never rewritten. Generated research and copy can contain errors, and the Customer remains responsible for every message sent under its name.

6.5 Reply classification. Replies are sorted automatically into categories such as interested, not interested, out of office, bounce, unsubscribe, referral and already booked, so that outreach continues, pauses or stops. That is the only automated decision the service makes, and it has no legal or similarly significant effect within the meaning of Article 22 of the GDPR.

6.6 Objecting. A Prospect who objects should contact the sender (section 15); a Customer can import prospects by CSV instead of mining and use locked templates instead of generated copy.

7.How we share information and our sub-processors

7.1 We do not sell personal information or disclose it for advertising.

7.2 Sub-processors by category. We describe the providers that process personal data for us by category: infrastructure and hosting provider; payment processor; language-model and research providers; prospect data provider; scheduling and calendar provider; transactional email provider; professional advisers. Each is bound by a written contract limiting its use of the data to performing the service for us, with confidentiality, security and transfer safeguards.

7.3 What each receives. Hosting stores and runs the application and its data; the payment processor handles checkout and card data, which never reaches us; language-model and research providers receive the task context in section 6; the prospect data provider receives search filters and returns matching records; the scheduling and calendar provider receives accepted meeting details; the transactional email provider delivers our own service email; professional advisers receive information only where their work requires it, under confidentiality. The Sub-processors page is the canonical list.

7.4 The named list, with each sub-processor's processing and transfer mechanism, is available through the contact form and as a schedule to the Data Processing Addendum.

7.5 Changes. We give at least 30 days' notice by email to the account address before a new sub-processor processes Customer Data. A Customer may object on reasonable data-protection grounds within that period; if unresolved, the Customer may terminate the affected part of the service before the change takes effect and receive a pro rata refund of prepaid fees for that part (section 7 of the Data Processing Addendum).

7.6 At the Customer's direction: with the recipients of its messages, the provider of each connected mailbox, the identity provider it signs in with, and any scheduling integration it links, each under its own terms.

7.7 Business transfers. In a merger, acquisition, financing, reorganization or sale of assets involving BiopharmaWatch LLC, information may be transferred as part of the transaction; the recipient remains bound by this policy, and affected Customers are notified first.

7.8 Legal disclosures. Where the law requires, to comply with valid legal process, to enforce our terms, to investigate fraud or abuse, or to protect the rights, property or safety of our Customers, the public or ourselves. Where lawfully able, we notify the affected Customer first.

8.International transfers

8.1 Where data goes. BiopharmaWatch LLC is a United States company, and some providers in section 7 operate in other countries. Using the service therefore transfers personal data to us in the United States and to the countries where those providers operate.

8.2 Safeguards. Where personal data protected by the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection is transferred to a country without an adequacy decision, we rely on a mechanism recognized by the applicable law: the European Commission's Standard Contractual Clauses, with the United Kingdom International Data Transfer Addendum and the Swiss adaptations where those regimes apply, or another recognized mechanism. Section 13 of the Data Processing Addendum incorporates those clauses for Prospect data.

8.3 Limiting recipients. A Customer that does not want Prospect data to reach the providers involved in prospect discovery, research or drafting can decline those features; sending and reply detection continue without them. That limits which provider categories receive the data. It is not data residency, and we do not offer a choice of processing location.

9.Cookies, browser storage and third-party content delivery

9.1 What we store. Two items in your browser: a session token, which keeps you signed in and protects the session, is strictly necessary, and is removed at sign-out or expires seven days after sign-in; and interface preferences, such as the view or filters last selected, which are functional and remain until you clear them.

9.2 What we do not use. No advertising cookies, no third-party analytics trackers, no cross-site or cross-device tracking, no advertising profiles. Because we set no non-essential cookies, the website shows no consent banner, and no additional action is needed in response to a Do Not Track signal.

9.3 Third-party content delivery. Some web fonts and front-end libraries are served by third-party content delivery providers, which receive your IP address, the file requested and browser details under their own privacy terms. We attach no identifier of ours to those requests.

9.4 Payment pages. Our payment processor's hosted checkout and billing portal set their own cookies on their own domain. The Cookie Policy lists every item with its purpose, duration and the browser controls available.

10.Open and click tracking in email sent through SDRclose

10.1 What it is. Separately from browser storage, the platform can record when a message a Customer sends is opened and when a link in it is clicked.

10.2 Who controls it. The account-level default is off, and a Customer can enable tracking per sequence. When it is off, messages carry no tracking pixel and no rewritten links. Where it is on, the Customer, as controller, is responsible for describing the tracking in its own privacy notice and confirming that the recipient's law permits it.

10.3 What is recorded. An open is recorded when the recipient's mail client loads remote images, a click when a tracked link is followed, each with a timestamp against the prospect record for that campaign. Engagement data is not combined across Customers, sold, used for advertising or used to profile a recipient for any other purpose.

10.4 Avoiding it. A mail client that does not load remote images generally registers no open. A recipient can decline remote images or unsubscribe (section 15), which ends the sequence.

11.Data retention

11.1 We keep information only as long as the purposes in this policy require. The table gives the period for each category.

11.2 Optional retention setting. Settings > Privacy & Data includes a data retention setting, off by default. Switched on with a period of 7 to 730 days, it runs daily and purges the bodies and subjects of replies, sent mail and finished drafts older than that period, plus old notifications and activity logs, keeping leads, meetings, statistics and the suppression list.

11.3 Deletion and backups. Customer Data is deleted from the live service when the Customer deletes the account. Residual copies persist in routine backups, which are overwritten on a rolling basis and fall out of retention within 30 days. Suppression records are retained (section 12).

11.4 Non-paid accounts. After cancellation or a lapsed trial the Customer can still sign in, export its data and resume a subscription. We may delete the data of an account that remains in a non-paid state for twelve months, after 30 days' notice by email to the account address (Terms of Service).

11.5 Legal holds. Information subject to a legal retention obligation, a dispute or an investigation is retained for as long as required. Return and deletion of Prospect data are governed by section 11 of the Data Processing Addendum.

12.Opt-out and suppression records

12.1 How an opt-out is received. Every message sent through the platform carries a one-click unsubscribe option and an opt-out link. A reply asking not to be contacted is normally recognized as an unsubscribe, and a Customer can add addresses to its suppression list directly.

12.2 Permanent retention. We keep the email address permanently in a suppression record that applies across every sequence and mailbox of that Customer and survives deletion of the account that created it; otherwise the same individual could be imported and contacted again.

12.3 Scope. The record holds only the email address, the date and the way the opt-out was received. It is not used to contact the individual, not enriched, and not disclosed except to operate the suppression.

12.4 Legal basis. Article 17(3)(b) of the GDPR permits retention where processing is necessary to comply with a legal obligation, and electronic marketing rules require an opt-out to be respected on a continuing basis. An erasure request therefore does not remove a suppression record, and we say so when we respond.

13.Security

13.1 We maintain technical and organizational measures appropriate to the information we hold and the risk to the individuals concerned, including those listed below.

• Encryption in transit for all traffic.
• Mailbox credentials and access tokens encrypted at rest; passwords stored only as salted hashes.
• Email verification at signup; rate limiting and lockout protections on authentication.
• Production data stores not exposed to the public internet.
• Input validation on every endpoint; modern browser security headers.
• Routine encrypted backups with rolling retention.
• Personal data masked in operational logs.
• Payment card data never touches our systems.
• Production access restricted to authorized personnel who need it to operate the service.
• Account deletion requires re-authentication.

14.Your rights and how to exercise them

14.1 Rights. Depending on the law that applies to you, you may access the personal information we hold about you, receive a portable copy, have it corrected or deleted, restrict or object to processing, withdraw consent, appeal a decision, and not be treated differently for exercising these rights.

14.2 Self-service. Settings > Privacy & Data provides Download my data, a one-click JSON export of your profile, leads, drafts, sent mail, sequences and activity (excluding the password hash, with mailbox credentials and access tokens redacted), and Delete my account, which requires the account password because it cannot be reversed. Both act immediately without separate verification.

14.3 Everything else. For correction, restriction, objection or any request the product does not handle, use the contact form, stating the right and the email address concerned. The Privacy Center walks through each route.

14.4 Verification. We confirm that the request comes from the person entitled to make it by a confirmation code sent to the email address the request concerns, or a signed-in session. We ask for identity documents only where no other method works.

14.5 Timelines. We respond in writing to every request. EEA, United Kingdom and Switzerland: within one month, extendable by two further months for complex or numerous requests, with notice in the first month. California: acknowledgment within 10 business days, response within 45 calendar days, extendable once by 45 days with notice. Other US states: within 45 days, extendable once by 45 days with notice; appeals decided within 45 days or the period state law allows. Elsewhere: without undue delay and within 45 days.

14.6 Prospect data. Requests about data a Customer controls are referred to that Customer, which we assist (sections 2 and 15).

14.7 Cost and limits. Requests are free unless manifestly unfounded or excessive, when we may charge a reasonable fee or decline, saying so first. We may decline a request where the law permits or requires it, including where a retention obligation applies, where deletion would defeat a suppression record (section 12), or where we cannot verify the requester, and we explain why.

14.8 Appeals and complaints. You may appeal through the contact form; a person not involved in the original decision reviews it. Sections 19 to 21 give the complaint routes for each region.

15.Information for recipients of email sent through SDRclose

15.1 Who sent the message. A message sent through SDRclose comes from the sender's own mailbox and domain, not ours. The organization named in it selected you and approved the message. It is the controller; SDRclose acts only as its processor.

15.2 How to stop the messages. Use the unsubscribe option your mail client shows, or the opt-out link in the message. Either records a permanent opt-out across every sequence and mailbox of that sender (section 12). A reply asking not to be contacted normally stops the sequence too, but the link is the reliable route.

15.3 Access, correction and deletion. Requests go to the sending organization first, because it holds the record. The From address, the domain after the @ sign and the signature block identify it.

15.4 Where you cannot reach the sender. Use the contact form and attach a copy of the message. We will identify the sending account, require that Customer to act, and suppress your address so that no further message reaches you from that sender through the platform.

15.5 Objecting. You may object at any time to direct marketing; under Article 21(2) of the GDPR that objection is absolute, and the sender must act on it. If you send it to us, we pass it to the sender and suppress your address. Section 10 explains open and click tracking and how to avoid it.

15.6 Source of your details. Contact details are either uploaded by the sender or obtained from our prospect data provider; the sender can tell you which applies, and we assist it in establishing that.

15.7 Our own outreach. Where the sender of a message is SDRclose itself, we are the controller of that outreach; the same unsubscribe and request routes apply, and we rely on legitimate interests in reaching businesses that may benefit from our service.

16.Children

16.1 SDRclose is a business tool for organizations and individuals acting in a professional capacity. It is not directed to children and is not offered to anyone under 18. Every user represents that they are at least 18 and using the service for business purposes.

16.2 We do not knowingly collect personal information from anyone under 18 and delete it if we learn that we have; a parent or guardian may contact us through the contact form. Customers must not use the platform to contact anyone they know, or ought to know, is under 18.

17.Changes to this policy

17.1 We may update this policy to reflect changes to the service, our practices or the law. The effective date at the top of this page shows when the current version took effect.

17.2 Where a change materially affects Customers' rights or how their information is handled, we notify the email address on the account before it takes effect. Clarifications that do not change the substance are made without separate notice. Previous versions are available through the contact form.

18.How to contact us

18.1 BiopharmaWatch LLC is responsible for the processing described in this policy where we act as controller. Privacy questions, rights requests, sub-processor list requests, countersigned Data Processing Addendum requests and complaints go through the contact form, with enough information to identify the account or message concerned.

18.2 Data protection matters are handled by the SDRclose team, which responds by written message during business hours, in English. Section 21 states our position on a data protection officer and on EU and UK representatives.

19.California privacy rights (CCPA and CPRA)

19.1 Scope. This section applies to California residents and supplements sections 1 to 18. Terms have the meanings given in the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA") and its regulations.

19.2 Our role. For account data, website visitor data and our own outreach, BiopharmaWatch LLC is a business. For Prospect data, our Customer is the business and we are its service provider under a written contract, processing that data only to perform the service.

19.3 Categories. The table lists each statutory category and whether we collected it in the twelve months before the effective date of this policy.

20.Other United States state privacy rights

20.1 This section applies to residents of United States states other than California with comprehensive consumer privacy laws, and supplements sections 1 to 18.

21.European Economic Area, United Kingdom and Switzerland

21.1 Scope. This section applies where the GDPR, the UK GDPR with the Data Protection Act 2018, or the Swiss Federal Act on Data Protection applies, and supplements sections 1 to 18.

21.2 Your rights. For personal data we control, and subject to the applicable law: access, rectification, erasure, restriction, portability, objection and withdrawal of consent (Articles 15 to 21 and 7(3)); not to be subject to a solely automated decision with legal or similarly significant effects (Article 22), of which we make none (section 6); and to complain to a supervisory authority (Article 77).