Privacy Policy
Last updated: March 12, 2026
At Witfy, we are committed to protecting the privacy of our customers and their data. This Privacy Policy explains how Demand Lab collects, uses, and safeguards information when you use our platform.
Information We Collect
We collect information you provide directly — such as your email address and password when you create an account — as well as data generated through connected third-party services. When you connect Google Analytics, Google Search Console, or Gmail, we access only the scopes you explicitly authorise. When you use our contact discovery feature, Lusha provides professional profile data such as names, job titles, and business email addresses.
How We Use Google User Data
Demand Lab integrates with Google APIs solely to provide the features you request. Specifically: (1) Google Analytics & Search Console data is read to surface intent signals and website performance metrics on your dashboard. (2) Gmail is accessed with the minimum required scopes — compose, send, and read — to send outreach emails on your behalf, detect replies in threads you initiate, and generate AI-drafted follow-ups. We do not use Google user data for advertising, profiling, or any purpose beyond the features described in this policy. We do not share, sell, or transfer Google user data to any third party.
AI Processing
To generate research summaries, outreach angles, and email drafts, we transmit relevant data (company name, domain, publicly available information, and contact professional details) to Google Gemini AI. No personally identifiable information beyond what is necessary for the requested generation is included in these prompts.
Data Storage and Security
Your data is stored in Supabase, a SOC 2 Type II certified infrastructure provider hosted on AWS. All data is encrypted at rest and in transit. We enforce row-level security policies to ensure strict workspace isolation — no user can access another user's data.
Data Retention
We retain your data for as long as your account is active. If you delete your account, all associated data is permanently removed within 30 days. You may request deletion at any time by contacting us.
Your Rights
Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data; restrict or object to processing; and data portability. To exercise these rights, contact us at the address below.
Third-Party Services
We use the following third-party services: Google APIs (authentication, analytics, Gmail), Google Gemini AI (content generation), Lusha (professional contact data), Supabase (database and auth infrastructure), and Vercel (hosting). Each service operates under its own privacy policy.
Cookies
Demand Lab uses strictly necessary session cookies to maintain your authenticated session. We do not use tracking or advertising cookies.
Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes by email or via an in-app notice. Continued use of the platform after changes constitutes acceptance.