Intent Leads
Get started

Compliance

Last updated 13 November 2026

Our goal is to give your legal team everything it needs. Questions: support@intentleads.si.

Privacy FAQs

The privacy landscape and its laws are changing fast. We work hard to keep pace with them, and to give our customers the information and tools to do the same. Here are answers to the questions customers ask most. We're always happy to talk through privacy and compliance with you.

1. Does GDPR apply to Intent Leads?

No. Intent Leads only supplies people located in the United States, and our website visitor ID only resolves US visitors. Visitors in the UK, the EEA and Switzerland are never identified. In legal terms, we don't have a product that is intentionally or deliberately focused on providing marketing intelligence to the European or UK market. More detail is on our GDPR page. If your own company is established in the UK or EU, see that page for what applies to you.

2. What about US state privacy laws, like the California CCPA and CPRA, and similar laws in Colorado, Virginia, Connecticut and other states? Do they apply to me, and what do they require?

They may apply to you if you handle substantial amounts of data, have enough revenue, and have contacts in those states. California's law covers people in their business capacity too, while most other states' laws exclude data about people acting as employees or business contacts. Personal details, such as a personal email address, may be covered in more states, and data about people as consumers (such as consumer interests and household details) is covered by all of these laws.

These laws give people a number of rights and require a number of disclosures. For instance, California law requires:

  • website disclosures saying that you "sell" or "share" personal information, if you do. Using website visitor identification, or buying contact data, can count;
  • a way for people to ask to see or delete the data you hold about them, and to opt out of its sale or sharing (the California Attorney General's site has the "Your Privacy Choices" icon and guidance: https://oag.ca.gov/privacy/ccpa/icons-download);
  • sometimes, specific contract terms with your "third parties" and "service providers". Our Data Protection Addendum covers these (see below).

Your privacy policy should also describe how you use contact data and website technologies to market. Here is the language we recommend; talk to your own privacy counsel too, because our recommendation isn't a substitute for advice tailored to you:

"When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or online profiles. We (or service providers on our behalf) may then send communications and marketing to these emails or profiles. You may opt out of receiving this marketing by visiting https://intentleads.si/your-privacy-choices."

3. How does Intent Leads help its customers comply with California's privacy laws (CCPA/CPRA) and similar state laws?

  • A consumer opt-out page you can link to: https://intentleads.si/your-privacy-choices.
  • A Data Protection Addendum, which sets out each party's rights and obligations under those laws.
  • Sample language for your privacy policy (question 2) and your cookie banner (Cookie Consent).
  • Removals passed straight to you. When someone asks to be removed, we tell you through the dashboard, by email, through the API and through the removals webhook, so you can delete them within 10 business days.
  • Opt-outs and deletions, including those made through California's Delete Request and Opt-out Platform (DROP), are applied before data reaches you.

4. Am I required to comply with the CCPA/CPRA and other state laws?

You might not be. These laws don't apply to every company: each has thresholds that, in many (but not all) cases, exempt smaller businesses. In California, for instance, many companies with under about $26.6 million in annual revenue are not subject to most CCPA requirements, unless they buy, sell or share the personal information of 100,000 or more California consumers or households, or make half their revenue from selling or sharing it. Even where these laws don't apply, many companies publish privacy disclosures and offer opt-outs anyway, for transparency and as a courtesy.

5. Is Intent Leads "permission-based" marketing?

No. Intent Leads is interest-based marketing. Intent leads and website visitors have shown a reason to hear from you: they are researching topics you sell into, or they visited your website. Search results are people who fit the market you sell to. Business contacts are reached about their work, and people who have shown that kind of interest are unlikely to be put off by a relevant, respectful business conversation.

People found through consumer topics (such as roof replacement or life insurance) are reached as consumers. A consumer intent signal is an interest signal, not an opt-in lead: these people haven't asked to be contacted and haven't given anyone consent to call or text them. Before you call or text a consumer, get any consent the TCPA and state telemarketing laws require and check the national and state do-not-call registries ("Marketing to consumers" in section 7 of our Terms).

Two rules apply to everyone: never tell someone you saw what they read or which pages they visited, and stop as soon as anyone asks you to.

6. We try to be legally conservative and "privacy-forward". Anything else I should do?

  • Use a cookie banner with our recommended wording on any site that runs the visitor ID snippet (Cookie Consent).
  • Add the language in question 2 to your privacy policy.
  • Check do-not-call status yourself before calling or texting. Our do-not-call flags help, but they don't replace your own check.
  • Before calling or texting consumers, get the prior express written consent the TCPA requires for autodialed or prerecorded marketing calls and texts to mobiles, follow state telemarketing laws (including their calling hours and any registration), and honor "STOP" replies straight away.
  • Treat personal email addresses with more care than work ones. Marketing to a personal address is regulated more strictly in many places, and in the UK and EU it generally needs prior consent.
  • Put an unsubscribe link in every email, and honor opt-outs straight away.
  • Process our removal notices within 10 business days.

7. Where does the data come from?

From licensed US data providers. Intent signals come from reading of business and consumer content matched to people by deterministic identity resolution; contact data is compiled from data suppliers, identity partners and public sources. Our Data Sources Statement has the detail.

8. Who can answer any other privacy questions we (or our lawyers) have?

Contact us any time at privacy@intentleads.si.

Information Security Addendum

DBEE, Inc. ("Vendor") has established and agrees to maintain a written information security program (the "Information Security Program") designed to comply with this Information Security Addendum and applicable Data Protection Law. Terms not defined here have the meaning given in the Data Protection Addendum.

As part of its program, Vendor has implemented and agrees to maintain administrative, technical and physical safeguards designed to protect the confidentiality, integrity and availability of Customer Data, including the following.

Administrative and organizational safeguards

  • Vendor maintains written information security policies and an incident response plan for investigating, containing and fixing security incidents.
  • Vendor has appointed an individual to oversee its information security and to lead the response to any Personal Data Breach.
  • Vendor limits access to its systems to the personnel who need it to provide the Services, on a least-privilege basis.
  • Personnel with access to Customer Data are bound by confidentiality obligations.

Technical security

  • All connections to Intent Leads use HTTPS. Plain HTTP is redirected to HTTPS.
  • API keys are random, shown once, and stored only as one-way hashes. They can be rotated or revoked at any time, and come in standard and admin roles.
  • Email addresses and LinkedIn profiles in customers' exclusion lists are stored only as one-way (SHA-256) hashes.
  • Customer data is separated by organization and workspace. The database denies all direct client access; only Vendor's server can read it, and every query is scoped to the caller's organization.
  • Webhooks are signed (Standard Webhooks, HMAC-SHA256), sent only to public HTTPS endpoints, and protected against requests to private networks.
  • Vendor logs changes to keys, users, roles and settings. Customers see their own audit trail in the dashboard.
  • Vendor applies security updates to its software in a timely, risk-prioritized way.
  • Payment card details are handled by Vendor's payment processor. Vendor never sees or stores full card numbers.

Physical security

  • Vendor runs on cloud infrastructure and has no data centers of its own. Its hosting providers are responsible for the physical security of their facilities.