Privacy Policy

1. Our role: controller and processor

For information about our own visitors, account holders, and website (“Account Data”), Saava acts as a controller. For the lead, engagement, and contact data you configure the Service to collect and process on your behalf (“Customer Data”), Saava acts as a processor and you are the controller — you are responsible for the lawful basis and instructions for that processing, as described in our Terms and any data processing addendum.

2. Information we collect

• Account information. Your name, email address, company, and authentication details when you create a workspace.
• Billing information. Payment is processed by our payment provider (Stripe). We do not store full card numbers on our servers; we retain a customer reference, plan, and billing status.
• Configuration you provide. Your ICP criteria, the public LinkedIn profiles, posts, and keywords you choose to monitor, and your integration settings (e.g. Slack, webhooks, outreach tools).
• Lead and engagement data. Publicly available engagement signals (likes, comments, reposts) on the sources you monitor, and associated business contact data we enrich for matching leads (such as name, role, company, work email, and phone).
• Usage and device data. Log data, IP address, browser type, and product usage events used to operate and secure the Service.

3. How we collect engagement and contact data

Saava works only with information that is publicly visible or available through standard business-data providers. We do not require your LinkedIn password, we do not automate or operate your personal LinkedIn account, and we do not install browser extensions. Contact enrichment is performed through third-party data providers for leads that match your criteria.

4. Cookies, analytics & visitor identification

On our public website we use cookies and similar technologies, and we work with third-party analytics and visitor-identification providers, to understand traffic, measure marketing, and recognize business visitors. These may include:

• Product & marketing analytics (e.g. Vercel Analytics) to measure page views and conversions.
• Advertising pixels (e.g. the Meta Pixel and Conversions API) to measure and optimize our ad campaigns, including sharing hashed identifiers with the ad platform.
• Business visitor identification (e.g. RB2B) which may associate a website visit with a company or professional profile using IP and related signals.

These run on our marketing pages, not inside the authenticated product. You can control cookies through your browser, opt out of interest-based advertising via your ad-platform settings, and contact us to request that we not identify your visit. Where required by law, we obtain consent before using non-essential tracking technologies.

5. How we use information

• To provide, maintain, secure, and improve the Service.
• To qualify and deliver leads according to the criteria you set.
• To process payments, manage subscriptions, and prevent abuse.
• To send transactional messages and, where permitted, product and marketing emails (you can opt out at any time).
• To comply with legal obligations and enforce our terms.

6. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies to our processing of Account Data, we rely on: contract (to provide the Service you request); legitimate interests (to secure, operate, and market the Service, balanced against your rights); consent (for non-essential cookies and certain marketing, which you may withdraw); and legal obligation (to meet our compliance requirements). For Customer Data, the lawful basis is determined and provided by you as the controller.

7. How we share information

We do not sell your personal information. We share information only with:

• Service providers / sub-processors who process data on our behalf (e.g. hosting, database, email delivery, payment processing, and data-enrichment vendors), bound by confidentiality and data-protection obligations.
• Integrations you enable, such as sending leads to your Slack workspace, outreach tool, or an outbound webhook you configure.
• Legal and safety recipients when required by law or to protect our rights, users, or the public.
• A successor entity in connection with a merger, acquisition, or sale of assets.

A current list of sub-processors is available on request at privacy@saava.io.

8. US state privacy rights

We do not “sell” personal information or “share” it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA, beyond the advertising and analytics cookies described above, which you can opt out of. If you are a California resident (or in a state with similar laws), you may request access to, correction of, or deletion of your personal information, and you will not be discriminated against for exercising these rights. To make a request, contact us at the address below.

9. Data retention

We retain information for as long as your account is active or as needed to provide the Service, then delete or anonymize it within a reasonable period, subject to longer retention where required to comply with legal obligations, resolve disputes, prevent abuse, and enforce agreements (for example, billing records kept to meet tax and accounting requirements). You may request deletion of your workspace data as described below.

10. Security

We use industry-standard safeguards to protect information, including encryption in transit, access controls, and tenant isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data breach notification

If we become aware of a security incident affecting your personal information, we will notify affected users and, where Saava acts as a processor, the relevant controller, without undue delay and in accordance with applicable law.

12. Your rights and choices

• Access, correct, or delete your account information.
• Wipe your workspace data from within the Service settings.
• Opt out of marketing emails via the unsubscribe link or settings.
• Request that we remove a specific monitored profile or lead record.
• Withdraw consent for non-essential cookies at any time.

Depending on your location, you may have additional rights under laws such as the GDPR, UK GDPR, or CCPA/CPRA, including the right to object to or restrict processing, to data portability, and to lodge a complaint with your supervisory authority. To exercise any right, contact us at the address below; we will respond within the timeframe required by applicable law and may need to verify your identity first.

13. International transfers

We may process and store information in countries other than where you live, including the United States. Where required for transfers out of the EEA, UK, or Switzerland, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

14. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their personal information. If you believe a minor has provided us information, contact us and we will delete it.

15. Do Not Track

Some browsers offer a “Do Not Track” signal. Because there is no common industry standard for how to respond, we do not currently respond to these signals, but you can manage tracking through the cookie and ad-platform controls described above.

16. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice.

17. Contact us

Questions about this policy, a data request, or our data processing addendum? Email us at privacy@saava.io.