Xcout Intel — Privacy Policy

Version 2026-10-23 · Download PDF

The two populations this policy covers

A. Customers and users of the Service

People who create accounts. Data held: email, name, organization membership, authentication events, billing metadata (via Dodo Payments, our merchant of record — we never hold card numbers), support correspondence, product usage. Basis: contract performance; legitimate interest in security and product improvement.

B. Individuals described in the dataset

People who appear in the product because they hold or held roles at companies we index — executives, founders, investors, board members. Data held: name, professional role and company, public profile links, and for public figures published biographical facts and the published compensation of public-company officers. We do not hold net-worth estimates.

Source: exclusively public sources — official registries and filings, company websites, news, Wikipedia/Wikidata, public profiles. Basis: legitimate interest in providing business intelligence about companies and their officers in their professional capacity.

Not held at all: gender, and net-worth estimates. Not exposed to subscribers: non-officer pay is excluded from API and export payloads.

Accuracy

We hold professional information about a large number of people, and automated attribution makes mistakes — a person attached to the wrong employer, or a record duplicated. We run automated identity, duplication and attribution checks against the sources, quarantine records that fail them rather than publishing them, and correct what is found to be wrong. If you find something inaccurate about yourself, the route below is the fastest way to have it fixed, and you do not need an account.

Your rights (population B)

• Removal: request at /privacy/remove — no account needed. Removal deletes the record and durably blocks automated re-creation; a suppression list is checked by our collection systems.
• Access, correction, objection: same route, or email hello@intel.xcout.app.
• We aim to respond within 30 days.

Sub-processors

Supabase (database, auth), Vercel (hosting), Dodo Payments (payments, merchant of record), Resend (email), Google (Gemini — LLM processing of public text), Twilio (WhatsApp), Cloudflare (backup storage). /legal/subprocessors gives, for each one, what it processes, where, and the transfer mechanism it relies on.

Transfers, retention, security

• Transfers. Xcout is established in Israel, which holds a European Commission adequacy decision (2011/61/EU, maintained after the Commission’s January 2024 review), with an equivalent UK finding. Transfers of personal data from the EEA or UK to us therefore rely on adequacy and need no separate mechanism. Onward transfers to our sub-processors — most of which are in the United States — rely on the European Commission’s 2021 Standard Contractual Clauses incorporated by each provider’s data processing agreement, with the UK addendum where applicable. The mechanism for each is listed at /legal/subprocessors.
• Retention (population A). Account data is kept while the account exists and for 12 months after it is closed, then deleted. Invoices and the accounting records attached to them are kept for seven years, because tax law requires it and we cannot shorten that. Retention for population B is described below and follows a different rule.

How long we keep records about people in the dataset (population B)

We keep the core record — the person’s name, the role and title they held, the company, the dates, and the source it came from — for as long as the public source it came from continues to publish it. For the majority of our records that source is a statutory register or filing: SEC filings are permanent public record, and Companies House publishes officer records for many years after a company is dissolved. Where the source stops publishing a record, or we can no longer point to a source for it, we delete it.

A role that has ended is not deleted — it is marked as historical and shown with the dates it applied. Knowing who previously led a company is part of what this service is for, and describing a past role as a current one would be inaccurate.

The fields beyond that core are kept to a shorter standard, because they are less necessary to the purpose and more intrusive: compensation is retained only while the person holds the office it relates to and only for officers; year of birth is retained only where it is needed to distinguish two people with the same name; and we do not collect gender at all.

Independently of all of the above, a removal request through /privacy/remove deletes the record and suppresses its re-creation, and we review annually whether we still have a reason to hold what we hold.

• Access to production data is limited to named administrators with a specific operational need; service credentials are held as secrets and never in client code; API keys are hashed at rest; card data never touches our systems (Dodo-hosted checkout, PCI SAQ-A).

Website analytics, campaign links and cookies

Essential. Signing in uses cookies to keep you signed in, and we remember your cookie choice in your browser. These are needed for the Service to work and are always on.

Every page view is recorded to count traffic: the page, the address you came from, the campaign tag in the link if it has one (for example utm_source=linkedin), your approximate country (worked out from your IP address, which is not stored), device type and browser (the user-agent string), and — if you are signed in — your account. Basis: legitimate interest in knowing how the site is used and keeping it secure; for account holders it is part of the product usage described above.

Only if you choose “Accept all” do we also store two things in your browser: a random identifier that groups the pages of one visit (cleared when you close the tab), a second random identifier that lets us tell a returning reader from a new one (kept until you clear this site’s data or choose “Necessary only”), and the first campaign link you arrived from, so that if you later create an account we can tell which post or email brought you. Neither identifier contains anything about you. Basis: your consent. Choosing “Necessary only” stores none of these and clears them if they were stored before; a page view is then counted on its own and linked to nothing else.

Page-view records are deleted after 13 months. We use no third-party analytics or advertising cookies. To change your choice, clear this site’s data in your browser and the banner will ask again.

Contact

The controller is Xcout Technologies Ltd., an Israeli company, Kiryat Ono, Israel. For anything in this policy — access, correction, objection, erasure, or a question about how a record was compiled — write to hello@intel.xcout.app. The removal form at /privacy/remove needs no account and is the fastest route for a record about you.