Privacy Policy & Data Security

Innovatix Technology Partners · Effective Date: 09/21/2026

Scope and Key Concepts
Roles: Customer vs. Innovatix
Information We Collect
How We Use Information
How We Share Information
Cookies and Similar Technologies
AI Features and Automated Processing
Data Retention
Security
International Transfers
Your Rights and Choices
Children’s Privacy
Changes to This Policy
Contact Us
Appendix A — Data Privacy & AI Usage Disclosure

1. Scope and Key Concepts

This Privacy Policy applies to personal information we process in connection with the 10xReach.ai Service (the “Service”), including when you visit our website, create an account, use the Service, connect third-party accounts, or contact us for support.

“Personal information” (or “personal data”) means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual. Definitions may vary by jurisdiction.

This Policy does not cover third-party websites or services that may be linked from the Service or integrated at your direction (for example, data enrichment providers, email-sending providers, CRMs, mailbox providers, or social platforms such as LinkedIn). Their privacy practices are governed by their own policies.

2. Roles: Customer vs. Innovatix

When a business customer uses the Service, Innovatix typically acts as a service provider/processor for Customer Content. The Customer is responsible for determining what information is uploaded, for providing required notices, and for obtaining any required consents (including consents for contacting prospects).

Innovatix acts as a controller/business for personal information we process for our own purposes, such as account administration, billing, security, product analytics, and marketing (where permitted).

If applicable law requires, Innovatix and the Customer may enter into a Data Processing Addendum (“DPA”) to govern our processor/service provider obligations.

3. Information We Collect

We collect information from (a) you or your organization, (b) your use of the Service, and (c) third parties, as described below.

3.1 Information you provide

Account and contact information (e.g., name, email address, phone number, organization name, job title).
Billing and transactional information (e.g., billing contact details, invoices, payment status; payment card data is typically processed by our payment processor and not stored by us except as necessary for billing records).
Support communications (e.g., messages you send to support, feedback, and related metadata).

3.2 Customer Content processed on behalf of Customers

The Service allows Customers and Authorized Users to upload and process prospect lists, contact and company data, campaign and sequence content, message and email templates, uploaded files, and other content (“Customer Content”). Customer Content may contain personal information about prospects and other individuals. Innovatix processes Customer Content primarily on behalf of and under the instructions of the Customer to provide the Service.

Customer Content may also include data from connected third-party accounts that the Customer directs the Service to access, such as:

Connected mailboxes (e.g., Google Workspace or Microsoft 365), for sending email and tracking replies;
CRM systems (e.g., HubSpot), for importing and syncing account, contact, and deal data;
Social platforms (e.g., LinkedIn), where a Customer enables such features.

3.3 Information collected automatically

Usage and log data (e.g., feature usage, timestamps, pages/screens viewed, clicks, error logs).
Device and network data (e.g., IP address, browser type, device identifiers, operating system, approximate location derived from IP).
Security signals (e.g., authentication events, suspicious activity indicators, and audit logs).

3.4 Information from third parties

Payment processors and billing providers (e.g., payment confirmation, billing address, and transaction metadata).
Identity and authentication providers (if you use single sign-on) (e.g., SSO identifiers).
Data enrichment providers (e.g., ZoomInfo), which provide contact, company, and firmographic data used to enrich prospect records at the Customer’s direction.
Email-sending providers (e.g., Brevo, Amazon SES), which provide delivery, bounce, and engagement events.
Analytics providers (e.g., aggregated usage metrics).

4. How We Use Information

We use personal information for the following purposes:

Provide, operate, and maintain the Service, including authenticating users and enabling features such as prospecting, data enrichment, campaign building, email and LinkedIn outreach, and response management.
Provide customer support, respond to inquiries, and deliver requested configurations and troubleshooting.
Process transactions, manage subscriptions and Credits, send invoices, and administer accounts.
Monitor, protect, and improve the security and integrity of the Service, including detecting and preventing fraud and abuse.
Understand service performance and usage trends, and improve features, reliability, and user experience.
Comply with legal obligations and enforce our agreements and policies.
Send service-related messages (e.g., security notices, administrative updates).
Marketing and promotional communications, where permitted by law and subject to your choices (e.g., opt-out).

5. How We Share Information

We may share personal information in the following circumstances:

Service providers and subprocessors. We use vendors to host infrastructure, provide analytics, support, billing, AI-enabled processing, data enrichment, and email delivery. These vendors process data under contractual obligations consistent with this Policy and applicable law.
At Customer direction. If a Customer enables a third-party integration (e.g., a CRM, mailbox, data enrichment, or email-sending provider, or a social platform), we may share information as directed by the Customer or Authorized Users.
Affiliates. We may share information with our Affiliates for operational, support, and business purposes consistent with this Policy.
Legal and safety. We may disclose information to comply with law, respond to lawful requests, protect rights and safety, investigate fraud, and enforce our agreements.
Business transfers. We may share information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. We will take reasonable steps to ensure continued protection of personal information.

We do not knowingly disclose Customer Content to other customers. Customer Content is processed to provide the Service to the Customer that supplied it.

6. Cookies and Similar Technologies

We may use cookies and similar technologies (such as pixels and local storage) to operate the website and Service, remember preferences, maintain sessions, understand usage, and enhance security.

Your choices. You can control cookies through your browser settings and, where available, in-product cookie preferences. Disabling cookies may affect functionality.

Do Not Track. Some browsers offer a “Do Not Track” feature. There is no consistent industry standard for responding to such signals; we may not respond to them.

7. AI Features and Automated Processing

The Service includes AI-enabled features that analyze Customer Content and user inputs to generate Outputs (e.g., prospect lists, enriched records, campaign and message drafts, and recommendations). Outputs may be inaccurate, incomplete, non-deterministic, or otherwise unsuitable for your purposes. Customers are responsible for human review and verification before relying on Outputs or contacting prospects.

Training and model improvement. By default, we do not use Customer Content to train or fine-tune generalized AI models made available to other customers, unless the Customer explicitly opts in via a written agreement or Order Form. We may use usage telemetry and may use de-identified and/or aggregated data where reasonably practicable to maintain, secure, and improve the Service.

8. Data Retention

We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, and for legitimate business purposes. Retention periods vary based on the type of data, the Customer’s subscription term, and legal requirements.

Customer Content is generally retained for the duration of the Customer’s subscription and then deleted or de-identified in accordance with our retention practices, subject to export windows and legal requirements. Enrichment Data provided by third parties may be subject to shorter retention and is subject to the applicable data providers’ terms.

9. Security

We implement commercially reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. However, no security measures are infallible, and we cannot guarantee absolute security.

You are responsible for securing your own accounts and devices, using strong passwords, enabling multi-factor authentication where available, limiting access to authorized personnel, and safeguarding credentials for any connected third-party accounts.

10. International Transfers

We may process and store information in the United States and other countries where we or our service providers operate. Where required by law, we use appropriate safeguards for international transfers, such as Standard Contractual Clauses and the UK Addendum, as applicable and typically documented in a DPA.

11. Your Rights and Choices

11.1 Account and communications

Account information. You may update certain account information through the Service or by contacting us.
Marketing communications. You can opt out of marketing emails by using the unsubscribe link in the email or contacting us. Service-related communications are not optional.

11.2 Data subject rights (EEA/UK and other jurisdictions)

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, and to data portability. Where we act as a processor/service provider for Customer Content, requests should be directed to the Customer (the data controller/business). We will assist Customers with such requests as required by law and contractual commitments.

To submit a request regarding information we control, contact us at [Insert Privacy Email]. We may need to verify your identity before fulfilling requests.

11.3 California privacy notice (CCPA/CPRA)

If you are a California resident, California law may provide you with additional rights regarding your personal information, including the right to know, delete, correct, and opt out of “sale” or “sharing” of personal information (as those terms are defined by law), and the right to limit use and disclosure of sensitive personal information (where applicable).

We do not sell personal information for monetary consideration. Depending on how cookies and advertising technologies are configured, certain disclosures for cross-context behavioral advertising may be considered “sharing” under California law. If we engage in such sharing, we will provide an opt-out mechanism (e.g., a “Do Not Sell or Share My Personal Information” link or cookie preference center) as required.

Authorized agent. You may designate an authorized agent to submit requests on your behalf. We may require proof of authorization and identity verification.

Non-discrimination. We will not discriminate against you for exercising your privacy rights.

12. Children’s Privacy

The Service is not directed to children under 13 (or such higher age as may be required by law). We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can take appropriate action.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new effective date and, if changes are material, provide additional notice (e.g., via email or in-product notice).

14. Contact Us

Innovatix Technology Partners

Attn: Privacy

135 Route 202/206, Suite 9 Bedminster, NJ 07921

Email: support@10xreach.ai

Appendix A — Data Privacy & AI Usage Disclosure

This Appendix describes how Innovatix Technology Partners (the “Company”) processes Customer Content and personal data in connection with the Service, including AI-enabled features. By accessing or using the Service, Customer acknowledges and agrees to the practices described herein and in this Privacy Policy. If Customer or its Authorized Users are located outside the United States or applicable law so requires, the parties will enter into (or are deemed to have entered into) the Company’s Data Processing Addendum (“DPA”), which will govern to the extent it conflicts with this Appendix.

Roles; Scope. Customer is responsible for determining the purposes and means of processing Customer Content and any personal data contained therein. To the extent the Company processes personal data on behalf of Customer, the Company acts as a “processor” or “service provider” (as applicable) and processes such personal data only to provide, maintain, secure, and support the Service, and as otherwise permitted under this Privacy Policy, the Agreement, and the DPA (if applicable).
Processing Purposes. Customer Content (including prospect lists, contact and company data, campaign content, message templates, connected-mailbox data, prompts/inputs, and associated metadata) may be processed to: (a) provide and operate the Service and its features (including prospecting, enrichment, campaign building, email and LinkedIn outreach, and response management); (b) perform customer-requested configurations, workflows, and support; (c) prevent fraud, abuse, and security incidents; (d) perform debugging, reliability, and performance monitoring; and (e) comply with applicable law and enforce applicable terms.
AI Processing Acknowledgment. Customer expressly acknowledges the Service uses artificial intelligence and machine-learning technologies (including automated systems and probabilistic models) to process Customer Content and generate outputs, recommendations, and other results (“Outputs”). Outputs may be inaccurate, incomplete, non-deterministic, or otherwise unsuitable for Customer’s purposes. Customer is solely responsible for human review and independent verification of Outputs prior to use, particularly for regulated, high-stakes, or external purposes.
Third-Party AI Providers; Subprocessors. To provide AI-enabled features and the Service, the Company may transmit limited portions of Customer Content and/or prompts/inputs to third-party service providers (including AI model providers, data enrichment providers, email-sending providers, hosting providers, and analytics providers) acting as subprocessors. Customer authorizes such disclosures and processing to the extent necessary to provide the Service. The Company will maintain commercially reasonable contractual protections with subprocessors consistent with the DPA (where applicable), and may update subprocessors from time to time. Where required by law or the DPA, the Company will provide notice of material subprocessor changes and an opportunity to object.
Training; Model Improvement (Default: No Cross-Customer Training). By default, the Company does not use Customer Content to train or fine-tune generalized AI models made available to other customers. Any use of Customer Content for such training will occur only if expressly agreed in a written amendment or Order Form that clearly describes scope and opt-in terms. The Company may, however, use usage data and service telemetry, and may use Customer Content in a de-identified, aggregated, or otherwise non-customer-specific form where reasonably practicable, for purposes of maintaining, securing, and improving the Service (e.g., reliability, latency, abuse prevention, and feature performance), provided that such use does not intentionally disclose Customer identity or Customer Content to other customers.
No Human Review Obligation. The Company does not guarantee human review of Customer Content or Outputs and has no obligation to monitor, validate, correct, or curate Customer Content or Outputs. Customer is responsible for establishing appropriate internal review, approval, and governance controls for any use of the Service and Outputs.
Data Security. The Company implements commercially reasonable administrative, technical, and organizational safeguards designed to protect Customer Content and personal data against unauthorized access, disclosure, alteration, or destruction. Customer acknowledges that no security measures are infallible and the Company does not guarantee absolute security. Customer is responsible for securely managing credentials, user access, connected accounts, and endpoint security within Customer’s environment.
Security Incidents. In the event the Company confirms a security incident involving unauthorized access to Customer Content or personal data, the Company will notify Customer without undue delay and provide information reasonably necessary for Customer to meet applicable legal obligations.
Data Retention; Deletion. Customer Content is retained for the duration of Customer’s subscription and as otherwise reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, or enforce applicable terms. Following termination or expiration, the Company will make Customer Content available for export for a limited period and will thereafter delete or de-identify Customer Content in accordance with the Company’s retention practices, unless a longer retention period is required or permitted by law.
Restricted and Regulated Data. Unless expressly permitted in an applicable Order Form or written amendment, Customer will not upload to the Service: (a) payment card data subject to PCI DSS; (b) protected health information regulated by HIPAA; (c) classified, controlled unclassified, or export-controlled government information; or (d) other highly sensitive data requiring special safeguards beyond those generally provided by the Service (“Restricted Data”).
Customer Responsibilities. Customer is solely responsible for providing required notices and obtaining necessary consents and authorizations; ensuring Customer Content is lawfully collected, used, and disclosed; ensuring messages sent through the Service comply with applicable marketing, anti-spam, and privacy laws; and complying with applicable privacy, data protection, and sector-specific laws.
International Transfers. Customer acknowledges that the Service may be provided from, and Customer Content may be processed in, the United States and other countries. Where required by applicable law, international transfers will be addressed through the DPA and applicable transfer mechanisms.
Regulatory Transparency. This disclosure is intended to support transparency obligations under applicable U.S. consumer protection and privacy laws. To the extent the Company processes personal information subject to state privacy laws on behalf of Customer, the Company will process such data as a service provider/processor for the business purposes described in this Appendix and the DPA (if applicable).
No Waiver; Limitation of Liability. Nothing in this Appendix modifies or limits the AI disclaimers, restricted use provisions, limitation of liability, or indemnification obligations set forth elsewhere in the parties’ agreement.