Privacy policy
Last updated: 2 July 2026.
This policy explains how Zarbaruk SASU (“Zarbaruk”, “we”), operating the Dwelverson service, processes personal data. Zarbaruk is established in France and is the data controller for the processing described below, except where we act as a processor on a client’s instructions (see §7).
1. Who this policy covers
We process personal data about four distinct groups:
- Prospects: business contacts we may email about Dwelverson.
- Public posters (“leads”): people who publish buying-intent posts on public platforms (Reddit, Hacker News, Bluesky, community forums, X/Twitter) that our system surfaces to a matching business.
- Clients & dashboard users: people who sign up for and use Dwelverson.
- Website visitors.
2. What we process, why, and on what legal basis
| Group | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Prospects | Name, business email, company, professional role (sourced from Apollo & public sources) | B2B outreach about a product relevant to your role | Legitimate interest, Art. 6(1)(f), with an easy opt-out and a documented balancing test |
| Public posters | Public post content, author handle/profile, inferred buying intent | Detecting and delivering buying-intent leads to matching businesses | Legitimate interest, Art. 6(1)(f), subject to a Data Protection Impact Assessment |
| Clients & users | Account & login email, company identity, buyer-profile description, recipient addresses, billing records | Providing the service, authentication, delivery, invoicing | Contract, Art. 6(1)(b); legal obligation for invoices, Art. 6(1)(c) |
| Visitors | Aggregate, cookieless usage statistics; a first-party analytics identifier in the app | Understanding site/app usage and improving the funnel | Legitimate interest / audience-measurement exemption (see §6) |
We do not seek to infer, and we filter out, special-category data (Art. 9): health, political, religious, sexual, or similar signals are excluded from intent detection.
3. Where the data comes from
Prospect data is sourced from Apollo.io and public professional sources. Lead data is collected from public posts on Reddit, Hacker News, Bluesky, community forums, and X/Twitter. Because we do not collect public-poster data directly from the individual (Art. 14), we provide this notice publicly and rely, where notifying each poster would involve disproportionate effort, on Art. 14(5)(b); you can object at any time (§5).
4. Sub-processors & international transfers
We share personal data with the vendors that operate the service. The current list, with each vendor’s role and location, is maintained on our sub-processor list. Transfers outside the EEA rely on an adequacy decision, the EU’s Standard Contractual Clauses, or the EU–US Data Privacy Framework, as applicable per vendor. Inference vendors that process post text are contractually bound to no-training / zero-retention terms.
5. Your rights
Under the GDPR you may request access, rectification, erasure (“droit à l’oubli”, Art. 17), restriction, portability, and you may object (Art. 21) to outreach or to lead-detection processing about you. An objection stops processing that individual and adds them to our do-not-process list. If you are in California, you may also request that we do not “sell” or “share” your personal information; we honour Global Privacy Control signals.
To exercise any right, contact privacy@dwelverson.com. We respond within one month. Invoices are retained where the law requires; everything else is erased or anonymised. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).
6. Cookies & analytics
Our marketing site uses Plausible, a cookieless, privacy-friendly analytics tool. It sets no cookies and does not track you across sites. The Dwelverson app uses a single strictly necessary cookie to keep you signed in (an authentication session cookie); it is required to use the service and is exempt from consent. We set no advertising or cross-site tracking cookies. If we ever introduce non-essential analytics, we will ask for your consent first.
7. When we act as a processor
For personal data a client provides or manages inside their dashboard, we act as a processor on that client’s instructions under a data-processing agreement. Clients can request our DPA and this sub-processor list for their own compliance.
8. Retention
We keep raw collected posts only as long as needed to run detection, then rotate them; delivered leads for the life of the client relationship; prospect data until you unsubscribe or object; account data for the contract term; in-app usage events (feature usage and page views, no free text, tied to your account) for 7 days; and invoices for the statutory period. Suppression entries are kept minimally and indefinitely, solely to keep honouring your opt-out.
9. Contact
Data controller: Zarbaruk SASU, France. Privacy contact: privacy@dwelverson.com.