# Privacy Policy | Victoria AI

> How Victoria AI collects, uses, and discloses personal information across the site, Victoria, Pulse, and managed services.

Source: https://www.versionseven.ai/legal/privacy

# Privacy Policy

**Victoria AI: versionseven.ai, Victoria, Pulse, and Proof First services**

Last updated: October 6, 2026

This Privacy Policy describes how Victoria AI LLC ("**Victoria AI**," "**we**") collects, uses, and discloses personal information. It applies to versionseven.ai and related sites (the "**Site**"), our products Victoria and Pulse, and our managed services (together, the "**Services**").

**If you use our Services on behalf of your employer, our processing of the data your organization submits is governed by our agreement with that organization and our Data Processing Addendum. This Policy governs our own practices.**

## 1. Who This Policy Covers

We process personal information about three groups, and what we do differs by group:

- **Site visitors:** people who browse the Site, submit forms, or interact with our marketing.
- **Customers and users:** people with accounts or who participate in a customer's use of the Services.
- **Prospects and business contacts:** **professionals whose business contact information appears in our Services or in outreach conducted through them, who may have no direct relationship with us.** Because you may be in this group without ever visiting this Site, Section 5 is addressed specifically to you.

## 2. Information We Collect

**From Site visitors:** contact details you submit (name, work email, company, role), form and assessment responses, and, via cookies and similar technologies, device, usage, and interaction data, including through analytics tools such as Google Analytics and PostHog and, when we run ads, advertising pixels (see Section 8).

**From customers and users:** account and profile details, billing information (processed by our payment processor; we do not store full card numbers), communications with us, and usage and log data about how the Services are used. If you sign in with Google, Google shares your name, email address, and profile picture with us; we use them only to create your account and sign you in.

**About prospects and business contacts:** business contact data (such as name, job title, employer, business email, business phone, and professional profile URLs) and company-level and engagement information. We obtain this from: a licensed data provider we engage on our own provider account, which returns contact data when a customer searches the Lead database in Victoria: name, job title, employer, work email, phone number where requested, LinkedIn profile URL, and company firmographics. Search results come from the provider as its own controller of its database, and email and phone enrichment happens on our instruction, with the provider acting as our processor (the current provider is listed at [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors)); enrichment providers whose own accounts our Pulse customers connect in order to resolve contacts at export on their own behalf, so that contact data is retrieved on the customer's credentials and the customer is that provider's direct client; licensed data providers we engage for our managed services; public and professional sources; our own analysis; and our customers, who submit their own lead and contact lists, whether directly, through our API, or through an AI assistant they have connected.

We do not knowingly collect information about minors, and the Services are not directed to them or to consumers acting in a personal or household capacity.

## 3. How We Use Information

- Provide, operate, secure, and support the Services;
- for customers of our Pulse product, compile and license company-level intelligence records;
- facilitate our customers' business-to-business outreach through their own sending accounts;
- retrieve contact data from the provider we engage when a customer searches the Lead database in Victoria, and from the customer's own connected provider account when a customer resolves contacts at export in Pulse, and deliver it into that customer's workspace;
- process payments, manage accounts, and communicate with customers;
- market our own services to business contacts, including through the Site and advertising;
- create de-identified, aggregated data to improve our services and models (we do not attempt to re-identify it);
- honor opt-outs and maintain suppression records (kept in hashed form); and
- comply with law and enforce our agreements.

## 4. How We Disclose Information

- **To our service providers** (subprocessors) that host, process, and deliver the Services on our behalf, including database and hosting providers, communications infrastructure, AI model providers, enrichment providers, and payments. The current list is at [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors).
- **To our customers**, where personal information (such as enriched business contact data) is delivered as part of the Services. Customers are contractually restricted to internal business use and prohibited from reselling or redistributing it.
- **To advertising platforms**, when we run ads: the pixels described in Section 8 send Site visit and action data to the ad platforms listed at [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors). Under California and other state privacy laws this can count as "sharing" or a "sale" of personal information for targeted advertising. You can opt out as described in Sections 6 and 8.
- **Within a corporate transaction** (merger, financing, acquisition), subject to this Policy.
- **For legal reasons**, where required by law or to protect rights, safety, and the integrity of the Services.

**We do not sell or share data our customers submit to the Services** (their leads, lists, campaigns, and CRM data); we process it only on their behalf.

**Connected assistants.** A customer may connect a third-party AI assistant (for example Claude, ChatGPT, or Claude Code) to their workspace through our API or MCP server. When they do, workspace data flows to that assistant only in response to the customer's own requests and the tools the assistant invokes, under the customer's control and the customer's agreement with the assistant's provider. The assistant's provider is the customer's vendor, not our service provider, and the customer can revoke the connection at any time in the app.

## 5. Prospects and Business Contacts: What You Should Know

If your business contact information appears in our Services, here is what that means:

- **What we hold:** professional information of the kind described in Section 2: business contact details, employer and role information, company-level facts and signals, and records of outreach interactions conducted by our customers through the Services.
- **Where it came from:** a licensed data provider we engage, returned when a customer of ours searched the Lead database in Victoria (the fields we receive are name, job title, employer, work email, phone number where requested, LinkedIn profile URL, and company firmographics; Search results come from the provider as its own controller, and email and phone enrichment happens on our instruction); a provider whose own account a customer of ours connected to Pulse and used to resolve contacts at export; licensed data providers we engage for our managed services; public and professional sources; and/or a customer of ours who added you to their lead list.
- **Provider roles:** the data provider we engage for self-serve lead search in Victoria acts as an independent data controller of its own database for Search results and as our processor, on our instruction, for email and phone enrichment; the providers we engage for our managed services act as our processors for the requests we send them and as independent data controllers of their own databases; the current providers, and links to their privacy notices, are listed at [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors). For self-serve contact resolution in Pulse, customers connect their own provider account; that customer is the provider's direct client and the provider is the customer's vendor.
- **Why:** to enable business-to-business sales and marketing by our customers, and to compile company-level market intelligence.
- **Retention:** we do not ourselves compile or maintain a database of individual contact information; contact data is retrieved from a provider when a customer requests it. Contact data made available for download through our Pulse product is held for up to **30 days** and then permanently deleted. Contact data delivered into a customer's workspace, including leads a customer adds from the Lead database in Victoria, is held on that customer's behalf, as their processor, until the customer deletes the record or closes the account; we then delete it within 90 days, including from backups and logs. Company-level records are retained as part of our Pulse product. If you opt out, we keep a hashed identifier so we can keep honoring your opt-out across our systems.
- **Your choices:** you may exercise your rights against us, by emailing <privacy@versionseven.ai>, and against the customer who holds your record. You may opt out of processing by us, request access to or deletion of your information, or object to our processing. When you write to us, we suppress you on our side, honor the opt-out across our systems, and forward your request to the customer who holds your record; that customer is an independent controller of the copy in its workspace and is responsible for honoring your request there.

## 6. Your Privacy Rights

Depending on your state or country, you may have rights to: know/access the personal information we hold about you; correct it; delete it; obtain a portable copy; opt out of targeted advertising, sale, or sharing of personal information; and not be discriminated against for exercising rights. To opt out of targeted advertising, sale, or sharing on the Site, use the "Your privacy choices" link at the bottom of any page, or turn on Global Privacy Control in your browser; we honor that signal automatically for the browser that sends it. Residents of California (CCPA/CPRA), Florida (FDBR), and other states with comprehensive privacy laws may exercise these rights via <privacy@versionseven.ai>. We will verify requests using reasonable means and respond within the time required by law. Authorized agents may submit requests with proof of authority. Where your record is held in a customer's workspace, you may exercise these rights against us and against that customer; a request sent to us is suppressed on our side and forwarded to that customer.

**EU/UK data subjects.** We accept customers from the EU and UK, although we do not direct marketing there. Where the EU or UK GDPR applies to our processing: our legal bases are performance of a contract (providing the Services), consent (for analytics and advertising cookies on the Site, which you can withdraw at any time with the "Your privacy choices" link), legitimate interests (operating, securing, and improving the Services, and business-to-business marketing of our own services), and compliance with legal obligations. Where we obtain personal data indirectly, the sources are those described in Sections 2 and 5. Transfers to the United States are made under the EU Standard Contractual Clauses and the UK Addendum, as described in our DPA. You may exercise your rights of access, rectification, erasure, restriction, objection, and portability via <privacy@versionseven.ai>, and you may lodge a complaint with your supervisory authority.

## 7. Retention

We keep personal information for as long as needed for the purposes above: account data for the life of the account plus a limited period; billing records as required by tax law; enriched contact data as described in Section 5 (up to 30 days for Pulse download copies; customer-workspace data, including Lead database leads, until the customer deletes the record or closes the account, and then deleted within 90 days including backups and logs); suppression identifiers for as long as needed to honor opt-outs; and Site and product analytics per the retention settings of the tools described in Section 8.

## 8. Cookies, Analytics, and Advertising

We use cookies and similar technologies on the Site in three groups:

- **Necessary:** these remember your theme, your assessment answers, your cookie choices, and which privacy rules apply where you are. They are always on.
- **Analytics:** Google Analytics and PostHog measure page views, traffic sources, and conversion events. Their cookies are set on the versionseven.ai domain and are shared with our app subdomains so that a visit and a later signup can be connected. We also set a first-party `v7_attr` cookie (90 days) recording how you first arrived (campaign tags, referring site, and landing page) so a signup can be attributed to its source.
- **Advertising:** when we run ads, we may use pixels from Google Ads, Meta, LinkedIn, and other ad platforms listed at [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors). They measure which ads lead to visits, sign-up clicks, and booked calls, and let us show our ads to people who visited the Site. These tags record the pages you visit and the actions you take; we configure them not to read form fields or page text.

**Your choices.** If you visit from the European Economic Area, the United Kingdom, or Switzerland, analytics and advertising stay off until you allow them in the cookie banner. Elsewhere they are on by default. Anyone can turn either group on or off at any time with the "Your privacy choices" link at the bottom of every page. We honor the Global Privacy Control signal as an opt-out of advertising for the browser that sends it. Your choice is stored in a first-party `v7_consent` cookie for 180 days in Europe and 365 days elsewhere. The booking calendar on our contact page is provided by Calendly, which sets its own cookies; in Europe it loads only when you choose to show it.

**In our apps.** The choices above apply to the Site. Our apps handle analytics as follows:

- **Victoria app:** PostHog records product usage (pages viewed, features used, clicks) to help us improve the product; Amplitude did this until our move to PostHog and is being retired. Text on screen is masked in what we collect, and we do not record sessions. You can turn behavioral analytics off in the app under Settings → Analytics. A small set of account events (such as sign-up completion, trial and subscription changes, setup milestones, and purchases) is always recorded because we need it to operate your account.
- **Pulse app:** no third-party analytics or tracking scripts run in Pulse. The app stores only your preferences (such as theme and column layout) in your browser.

**In our emails.** The setup and check-in emails we send to Victoria account owners (not account, billing, or security emails) contain a small image that tells us, through our email provider, when an email is opened. We use this only to see whether those emails are useful. We do not track which links you click. Each of these emails has an unsubscribe link that stops them.

You can also block or delete cookies through your browser settings; doing so may affect Site functionality. The privacy notices of these providers are linked from [versionseven.ai/legal/subprocessors](https://www.versionseven.ai/legal/subprocessors).

## 9. Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit and at rest, access controls, and audit logging. No system is perfectly secure; we cannot guarantee absolute security.

## 10. International Visitors

The Services are operated from the United States and directed to business users. If you access them from elsewhere, your information will be processed in the United States.

## 11. Changes

We will post updates here and revise the "Last updated" date; material changes will be notified as required by law.

## 12. Contact

Victoria AI LLC 7901 4th St N, STE 300, St. Petersburg, FL 33702, USA <privacy@versionseven.ai>