Enrichley LLC Privacy Policy

This policy is effective as of 9 June 2026
Last updated: 9 June 2026

1. Overview and how Enrichley works

Enrichley LLC (“Enrichley,” “we,” “us,” or “our”) operates enrichley.com and provides B2B data services — email verification, contact and company enrichment, and related data offerings. How the service is built matters to this policy:

• Enrichley does not maintain its own database of people. When you request an enrichment, we query third-party data partners and public sources in real time and return the result to you. We are a real-time enrichment layer — a conduit between you and those data sources.
• We store only your results, for your use. Results are stored within your account so you can re-download them, push them to a connected system (e.g., HubSpot), or run further enrichments. We treat this as “Customer Data” and process it only on your behalf.

Roles: Processor of Customer Data; provider/intermediary for live enrichment data (the third-party partners are the source/controller of that data); controller of our own account, billing, and website data. We do not sell, rent, or share Customer Data with other customers or third parties, and we do not use it to build any database.

To access, correct, or delete information, or opt out of its sale or sharing, use enrichley.com/data-removal or email [email protected] (Section 7).

2. Categories of personal data

• Enrichment results (delivered live): business contact identifiers retrieved from third-party partners on your request — name, business email, employer/company and domain, job title, professional profile URLs (e.g., LinkedIn), general location, and industry. (We do not currently process phone numbers.)
• Customer Data: the records you upload or connect, and the results we store in your account on your behalf.
• Account & billing data: name, business email, credentials, and payment information.
• Website & usage data: IP address, device/browser data, pages visited, and similar log/analytics data collected when you use enrichley.com.

We process professional/business-context information; we do not intend to process special categories of data.

3. Where enrichment data comes from

The underlying business data is retrieved on demand, at the time of your request, from sources we describe by category (we do not publicly identify individual data partners):

• Third-party data partners and information providers; and
• Publicly available sources, public records, business registries, and corporate filings.

Enrichley does not compile or retain this data as its own master database. We store only the results delivered to a customer, within that customer’s account. We do not build any database from Customer Data.

4. How we use personal data

• To provide our services by transmitting your requests to data partners and returning results;
• To store your results in your account so you can re-use, export, or further enrich them;
• To operate, secure, and improve enrichley.com and our accounts/billing;
• To comply with legal obligations and enforce our terms;
• To honor opt-out, deletion, and other privacy requests, including maintaining a suppression list (Section 9).

5. Legal bases (EEA/UK GDPR)

• Live enrichment service: to the extent we act as a controller, we rely on legitimate interests (ours and our customers’) in providing B2B business-information services, limited to professional/business-context data, balanced against individuals’ rights (who may object — Section 7). The underlying source data originates with third-party data partners, responsible for their own lawful basis.
• Customer Data (processor): the customer, as controller, determines purposes and legal basis; we process only on documented instructions (see the DPA at /dpa).
• Account/website data (controller): contract performance, consent where required, legal obligations, and legitimate interests in operating and securing the service.

6. Sale and sharing of personal information (CCPA/CPRA and other U.S. state laws)

Enrichley operates as a real-time enrichment layer and does not maintain its own database or sell its own data. To the extent that delivering enrichment results containing personal information to a customer for a fee is treated as a “sale” or “sharing” under the CCPA (as amended by the CPRA) and similar U.S. state laws, we give you an easy way to opt out.

• Categories that may be sold or shared: identifiers (name, business email); professional/employment information (employer, title); and related inferences. Plus internet/network activity on our website (for analytics).
• Categories of recipients: our business customers (who receive enrichment results), and analytics partners (for website data).
• We do not sell or share sensitive personal information for the purpose of inferring characteristics, and we do not knowingly sell or share the personal information of minors. Customer Data is never sold or shared with other customers or third parties (Section 1).

Opt out anytime — Section 7 and enrichley.com/data-removal.

7. Your privacy rights and how to exercise them

Subject to your location and applicable law, you may have the right to access/know, delete, correct, opt out of the sale or sharing of, object to, restrict, and port your personal data, and to not be discriminated against for exercising these rights.

How to exercise: use the self-service form at enrichley.com/data-removal, or email [email protected]. We verify requests (typically by confirming control of the email address) and respond within the timeframes required by law (generally 45 days under CCPA, extendable once; one month under GDPR). There is no charge.

Because much of the underlying data originates with third-party data partners, we will honor your request on our side (including suppression, Section 9) and, where applicable, direct it to the relevant source. Authorized agents may submit requests with proof of authorization.

Requests about Customer Data: if you are a contact within a customer’s data, that customer is the controller; we will refer you to them and assist as processor.

8. Disclosure to service providers and sub-processors

We engage a limited number of service providers (sub-processors) under contractual data-protection obligations to operate our business — cloud hosting, payment processing, transactional email, and analytics. The current list is at enrichley.com/subprocessors. We may also disclose information to comply with law, enforce our terms, or in a business transfer.

9. Suppression list

When you opt out or request deletion, we add the minimum information necessary (a hashed form of your email address and/or other identifier) to a suppression list so we can recognize your request, decline to return your information in future enrichments, and route your opt-out to the relevant data partner. We retain only what is needed to enforce your choice.

10. Data retention

We keep personal data only as long as necessary for the purposes described:

We do not maintain a standalone database of enrichment data outside of customers’ accounts.

11. International data transfers

We are based in the United States, and personal data may be processed in the U.S. and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we use appropriate safeguards, including the European Commission’s Standard Contractual Clauses (and the UK Addendum) where applicable.

12. Security

We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, and monitoring — see our Security page. No method is 100% secure, and we do not claim certifications we do not hold.

13. Children

Our services are for business use and are not directed to children. We do not knowingly process personal data of anyone under 16.

14. Changes to this policy

We may update this policy and will post the updated version with a new “Last updated” date.

15. Contact

Enrichley LLC
2105 Vista Oeste NW Ste E #2053, Albuquerque, NM 87120, United States

Privacy requests: [email protected] · General: [email protected]

EU/UK representative: to be appointed before EU/UK personal data is processed.