Privacy policy

Salvo GTM Ltd of Add your registered address here, London operates Salvo. This policy explains what we do with personal data when you visit the site, open a workspace, or appear in the business contact database we maintain.

We wear two hats, and it changes who is answerable to you. We are the controller for our website, our own customers, and the business contact database we compile. We are a processor for the personal data our customers upload and generate inside their workspaces — there, the customer decides the purpose and we follow instructions. If your data sits in a customer’s workspace, they answer your request; we will help them, and we will point you to them.

From customers and visitors

• Account data: name, work email, password hash, organisation, role, and the workspaces you belong to.
• Billing data: company name, billing address, tax identifier, invoice history. Card details go straight to our payment processor and never reach our servers.
• Product usage: pages viewed, features used, searches run, exports taken, API calls, plus timestamps and the IP address the request came from.
• Support content: the messages you send us, and the context you attach to them.
• Device and log data: browser type, operating system, referring page, and error traces.

Inside customer workspaces (as processor)

• Prospect lists a customer uploads or syncs from their CRM.
• Campaign content: research briefs, drafted emails, sequences, and the replies prospects send back.
• Meeting and calendar details created when a reply turns into a booking.

In the business contact database (as controller)

• Company records: name, website, industry, size band, locations, technologies and public signals.
• Business role records: name, job title, seniority, department, employer, and a work email address or direct business line where we hold one.
• Provenance: the category of source each field came from and the date we last observed it.
• We do not hold special category data, and we do not knowingly hold private addresses, personal email accounts or personal mobile numbers.

Under the UK and EU GDPR we need a lawful basis for each purpose. Here is every one we rely on, with nothing hidden behind “business purposes”.

Where we rely on legitimate interests we have weighed our interest against your rights and recorded the reasoning. Our compliance FAQ sets that test out in full, and you can object to any of it at any time.

We do not run advertising networks, cross-site trackers or third-party marketing pixels, so there is no consent wall on this site. What we do set is short and functional.

Blocking the session cookies means you cannot sign in — they are strictly necessary. Everything else can be cleared from your browser at any time without breaking the product.

We do not sell personal data, and we do not share it for anybody else’s advertising. We use a short list of sub-processors to run the service, each under a written contract with confidentiality and security terms.

Named entities and addresses are listed in the DPA annex, available on request. We give 30 days’ notice before adding or replacing a sub-processor. We also disclose data where the law compels us to, and we will tell you unless we are legally barred from doing so.

Our primary hosting is in the European Union, and enterprise workspaces can be pinned there. Where data reaches a country without an adequacy decision — typically the United States — we rely on the European Commission’s standard contractual clauses together with the UK international data transfer addendum, plus a transfer risk assessment and technical measures including encryption in transit and at rest. Copies of the clauses we use are available on request.

Deletion runs as a scheduled job, not on request-by-request goodwill. A record erased from primary storage is automatically re-suppressed if a backup restore ever reintroduces it.

Depending on where you live, you have some or all of the following rights. We honour them for everyone, wherever they are.

• Access — a copy of what we hold, the sources it came from and who has seen it.
• Rectification — correction of anything wrong. Job titles change; tell us and we will fix it.
• Erasure — deletion of your record, with a hashed suppression entry kept so it cannot come back.
• Objection — an absolute right to stop direct marketing, needing no reason and taking effect immediately.
• Restriction — pausing processing while a dispute about accuracy is resolved.
• Portability — data you gave us, in a machine-readable file.
• Withdraw consent — where consent was the basis, withdrawable at any time without affecting past processing.

Two forms on this site do all of it without an account. Stopping the email needs no confirmation step and applies the moment you submit it; access, correction and erasure send a link to the address first, because we will not disclose or delete a record on the say-so of whoever filled in a form.

Or write to privacy@salvo.example and use the opt-out link in any email we sent. We acknowledge within one working day and answer within 30 days. We ask only for enough information to match the right record — never a passport scan to delete a work email address. Requests are free unless they are manifestly excessive.

If you are unhappy with our answer you can complain to your local supervisory authority. In the UK that is the Information Commissioner’s Office; in the EU it is the authority in your country of residence or workplace.

We did not collect your details from you, so Article 14 applies. The full notice is its own page — how we got your data — and it names every category of source, what each one gave us, and how long we keep it. The short version: we hold business role information — your employer, job title, seniority and a work channel — assembled from public company sources, public registries, professional profiles you published, open map data and licensed partner feeds.

We use it to let our customers reach the right person at a company with a relevant business proposition, on the basis of legitimate interests. You can object, and objection to direct marketing is absolute: we stop, and we keep a hashed entry so no later refresh brings you back. One email to privacy@salvo.example settles it for every customer of the platform, not just the one who wrote to you.

TLS 1.2 or better in transit, AES-256 at rest, encrypted backups with separated keys, least-privilege access with enforced multi-factor authentication for staff, no standing production database access, audit logging of administrative actions, dependency scanning in the build pipeline, and an annual third-party penetration test. We hold no SOC 2 or ISO 27001 certificate today and we do not imply one — the honest detail is in the compliance FAQ. If we confirm a personal data breach affecting you, we notify within 72 hours.

The platform scores how well a company matches a customer’s ideal profile, and language models draft the emails and classify replies. That is profiling in the ordinary sense, but it produces a marketing email rather than a decision with a legal or similarly significant effect on anyone — no credit, employment or eligibility outcome is decided here. Customers can require human review before anything is sent. Content processed by our model provider is covered by zero-retention terms and is not used to train public models.

Salvo is a business tool, sold to organisations and not directed at children. We do not knowingly collect data about anyone under 18, and we do not knowingly hold records for people below working age. If you believe we have such a record, tell us and we will delete it.

We revise this policy as the product and the law change. The version and date at the top always reflect the current text. For a material change — a new purpose, a new category of recipient — we email account owners at least 30 days before it takes effect, and we keep previous versions available on request.