Privacy Policy

Two kinds of data

We handle two kinds of personal data, and our role is different for each.

Customer data. When a business uses Stage 1, the accounts, contacts, research and messages in its workspace belong to that business. We process that data on its behalf and on its instructions, as a processor or service provider. The business decides who to contact and why. If you've been contacted by someone using Stage 1, please contact that sender. We'll help them respond to you, and you can write to us at hello@getstage1.com.

Our own data. Information about our customers' users, visitors to getstage1.com and people who email us is ours to handle as a controller. Most of this policy is about that data.

What we collect

Account information. Your name, work email, password (stored only as a salted hash), company name, website and role, and the settings you choose.

What you put in. Your website and documents for the Brain, the accounts and contacts you add or import, notes, drafts, approvals and messages.

Connected accounts. When you connect LinkedIn or email, Stage 1 reads the posts, jobs, profiles, connections and messages it needs to find signals, map warm paths and manage replies, and sends what you approve. The tokens that connect these accounts are encrypted at rest. If you connect HubSpot or Slack, we exchange the data you've chosen to sync.

Billing. Stripe handles payments. We receive your plan and billing status. We never see or store your full card number.

Usage and device data. Server logs with IP address, browser type, pages requested and errors, which we use to run, secure and fix the service.

Cookies. The app uses one essential cookie to keep you signed in. The marketing site sets no cookies and runs no analytics or advertising trackers. It loads fonts from Google Fonts, which receives your IP address to deliver them.

Data about prospects

To find buying signals, Stage 1 collects professional information from public sources about the companies our customers watch and the people who work there. That includes names, job titles, employers, public LinkedIn activity, company filings with the SEC, news headlines, company press releases and official social posts, public tenders, federal rules and podcast episode listings. We collect business information only, and we don't collect sensitive data such as health, religion or political views. This information is used to rank accounts and help a customer write a relevant first message. It's held in that customer's workspace and isn't shared with other customers.

How we use data

We use data to provide and support Stage 1, to keep it secure and prevent abuse, to send account emails such as password resets, trial notices and billing receipts, to understand how the service is used so we can improve it, and to meet legal obligations. Where the GDPR applies, our legal bases are performing our contract with you, our legitimate interests in running, securing and improving a business service, your consent where we ask for it, and legal obligation.

We don't sell personal data. We don't share it for cross-context behavioral advertising. We don't use customer data to train AI models.

Who processes it for us

We use a small set of service providers, each bound by a contract to protect the data and use it only to serve us. Render hosts the app and database in the United States. Anthropic provides the Claude models that read sources and draft messages, under terms that don't allow training on the data we send. Unipile connects LinkedIn and email accounts. Resend delivers our account emails. Stripe processes payments. The current list, with what each one does, is in our Data Processing Addendum. We may disclose data if the law requires it, to protect rights and safety, or as part of a merger or sale of our business, with notice to you.

International transfers

We're based in the United States and store data there. Some providers process data in other countries. Where data from the UK or EU is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep account and workspace data while your account is active. When you close your account, we delete workspace data within 60 days, except what we must keep for legal, tax or accounting reasons. Backups expire on a rolling schedule. Opt-out records are kept as long as needed to honor them. Server logs are kept for up to 30 days.

Security

Connection tokens are encrypted with AES-256-GCM. Passwords are hashed with scrypt. Sessions are stored as hashes and cookies are HTTP-only. All traffic is encrypted in transit. Each customer's data is kept in its own workspace. The security page has more. No system is perfectly secure, and we'll notify affected customers without undue delay if a breach affects their data.

Your choices and rights

You can view and update your account information in the app. Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know, delete and correct, and to not be discriminated against for using those rights. To make a request, email hello@getstage1.com from the address on your account. We'll verify the request and answer within the time the law requires, usually 30 days. If your data is in a customer's workspace, we'll pass your request to that customer and help them respond. You can complain to your local data protection authority.

Children

Stage 1 is a business service for adults. We don't knowingly collect data from anyone under 18.

Changes

We'll post any change here with a new effective date. For a material change, we'll tell customers by email or in the app before it takes effect.

Contact

Inversion Systems, LLC, New Jersey, United States. Email hello@getstage1.com.