Privacy Policy

MADBOT is operated by Mallah Software Services Private Limited, a Private Limited Company incorporated in India. In this policy, "we", "us" and "our" mean that company.

Corporate Identity Number: U62011MH2026PTC475385.

Registered office: Plot No. 347, Flat No. 301, Status-2 CHSL, Santacruz (East), Mumbai, Maharashtra, 400055, India.

For anything about this policy, your data, or a request you want to make, reach us at support@getmadbot.com.

No Data Protection Officer, and no EU or UK representative

We have not appointed a Data Protection Officer. We are not required to have one, and naming a person who does not hold that role would be worse than saying nothing. Requests go to the address above and are handled by the people who run the service.

Data protection law distinguishes between the party that decides why personal data is being used (the controller) and the party that only handles it on someone else's instruction (the processor). MADBOT is both, depending on whose data is in question.

The second row has consequences you should be aware of before you use the lead engine. As controller of that data, you are the one who owes those people transparency, who must be able to justify contacting them, and who must honour it when they object. We build the product so that this is possible rather than theoretical: every lead carries a record of where it came from, on what basis, and when it will be deleted. See our Data Processing Addendum, which sets out the processor terms we work under and forms part of your agreement with us.

Here is the complete list for a customer account, with the reason and the lawful basis for each. We do not collect anything that is not on this list, and we do not buy data about you from anyone.

The trial ledger, and why it holds a hash

When you start a free trial we take your email address, normalise it, and compute a SHA-256 hash of the result. That hash goes into a ledger and stays there permanently. The plain address is not written to the ledger, and a SHA-256 hash cannot be turned back into an email address.

The reason for the design is simple. To stop one person taking unlimited free trials we need to recognise an address we have seen before, and that is all we need. Storing a hash lets us answer "have we seen this one?" without the ledger ever being a readable list of everybody who has tried the product. If you later delete your account, the hash remains, because deleting it would reopen the loophole it exists to close. Nothing else about you is attached to it.

MADBOT finds businesses that look like a fit for what you sell, and drafts outreach for you. Some of what it finds is personal data about real people, so the engine sorts everything into three levels and applies different rules to each. This is enforced in code, not in a policy document: the same rules the dashboard shows you are the ones the server applies.

What is never collected

Special category data, meaning health, religion, politics, ethnicity, sex life, sexual orientation, trade union membership, genetic and biometric data, is never collected. There is no setting to turn it on. There is no lawful basis for gathering any of it for cold business outreach, so offering a switch would imply otherwise.

The lawful basis, and the right to object

Where a lead is personal data, the basis relied on is legitimate interests: contacting an organisation about something relevant to its publicly observable circumstances. That is a real basis, not a blank cheque. It requires a balancing test, and the engine records one against every lead: the purpose, why the contact is necessary, and the safeguards applied. It also gives the person an absolute right to object. When someone objects, contact stops immediately and permanently.

How long lead data lives

• An active lead is deleted 90 days after it was collected, unless something happens with it.
• A rejected lead is deleted after 30 days.
• A suppression record, meaning a note that somebody asked not to be contacted, is kept indefinitely. Deleting it would mean contacting that person again, which is the opposite of what they asked for. A suppression record holds only what is needed to avoid the contact.

A job runs once a day and deletes records whose retention date has passed. A retention date that nothing enforces is worse than no policy at all, because it looks like compliance.

If you are a person who has been contacted through MADBOT and you want your data removed, the fastest route is to reply to the sender, because they are the controller and we act on their instructions. You can also write to us at support@getmadbot.com and we will pass it on and suppress the address.

MADBOT uses Anthropic's Claude API to audit sites, analyse what it finds, and write copy. That means the following leaves our systems and is sent to Anthropic:

• Content crawled from the websites you connect, including page text, metadata and structure.
• Information about the leads the engine has found, so that outreach can be drafted and a fit assessed.
• Prompts and instructions we construct, plus anything you type into a field that feeds one.

This is processed under Anthropic's commercial terms. We are not going to make claims on Anthropic's behalf about model training that we cannot verify ourselves. Read the terms and decide for yourself: anthropic.com/legal/commercial-terms.

If you do not want a particular site or a particular lead analysed, do not connect it. There is no way to run the audit or the copywriting without sending the content to the model.

These are the companies that process data on our behalf. Some are always involved; others only if you connect them yourself. The current list is maintained at /legal/subprocessors, which is the version to check, because this page is updated less often.

We do not sell personal data, we do not pass it to data brokers, and we do not share it for cross-context behavioural advertising. This site briefly carried Google AdSense and no longer does; there is no ad network here and nothing is sent to one. The only circumstance in which we would hand data over is a valid legal demand, and we would tell you about it unless we were forbidden from doing so.

We are in India. The sub-processors listed above are mostly in the United States and the European Union. Data collected in one country therefore leaves it, and there is no way to use the service without that happening.

For personal data covered by the GDPR or the UK GDPR, we rely on the Standard Contractual Clauses incorporated in our sub-processors' terms. That is the honest description of the mechanism. We have not completed our own transfer impact assessment, and we will publish one when we have. If you need the assessment before you can use the product, tell us and we will say where we have got to rather than guessing.

What follows is what is actually in place. It is not a list of things we intend to do, and it deliberately does not mention any certification, because we hold none.

• Everything travels over HTTPS. There is no unencrypted route into the service.
• Data is encrypted at rest by Google Cloud Platform, which is where the database lives.
• Database security rules make entitlements, usage counters, billing records and integration credentials server-write-only. A signed-in user cannot grant themselves a plan, cannot edit their own usage, and cannot read anybody else's documents. Integration tokens cannot be read from a browser at all.
• Every licence and entitlement check is verified on the server against a verified sign-in token. A client claiming to be on a higher plan is simply ignored.
• The email events webhook is signed, and an unverified call is rejected. Otherwise anyone could add addresses to the suppression list and quietly stop your mail.
• Secrets are held as environment variables. None are committed to the repository.
• Every outbound fetch passes an SSRF guard that resolves the target and refuses private, loopback and link-local addresses. A URL you connect cannot be pointed at internal infrastructure.

We do not hold ISO 27001, SOC 2 or any other certification, and we have not commissioned a penetration test. When either changes we will say so here. More detail is on the security page. If you have found a vulnerability, tell us at support@getmadbot.com and we will not take legal action against you for reporting it in good faith.

The sections after this one set out which rights apply where. This one is the part that matters: how to use them without writing a letter.

Export everything we hold about you

Sign in and use the export tool in your dashboard, which calls /api/privacy/export. It returns a machine-readable file containing your account record, your sites, your crawled content, your leads, your usage and your billing history. That is a subject access request and a data portability request answered in one click, without you having to ask us for either.

Delete your account and your data

The delete tool in your dashboard calls /api/privacy/delete. It removes your account, your sites, your crawled content and your leads. Two things survive it, and both are explained above: the billing records we are required by law to keep for eight years, and the suppression and trial-ledger entries, which exist precisely so that deleting them would harm somebody.

Everything else

For correction, restriction, objection, withdrawing consent, or any right the tools do not cover, write to us at support@getmadbot.com. Tell us what you want and, if it is not obvious, which account or address you are asking about. We will answer within 30 days. We do not charge for this, and we will not ask you for identification we do not already hold. If we ever cannot do what you asked, we will say why rather than going quiet.

If the GDPR, the UK GDPR or the Swiss FADP applies to you, you have these rights over the data we hold as controller:

• Access. A copy of your data and an explanation of what we do with it. Use the export tool.
• Rectification. Correction of anything inaccurate, and completion of anything incomplete.
• Erasure. Deletion, subject to the two carve-outs described above.
• Restriction. A pause on processing while a dispute about accuracy or lawful basis is resolved.
• Portability. Your data in a structured, commonly used, machine-readable format. That is what the export returns.
• Objection. To anything we do on the basis of legitimate interests. For direct marketing the right is absolute and takes effect at once.
• No automated decisions with legal effect. We make none. See the section on lead scoring.
• Withdrawal of consent where we relied on consent, without affecting what was lawful before you withdrew it.

You can also complain to a regulator. Complain to the supervisory authority in the country where you live or work, or where you think the problem happened. In the United Kingdom that is the Information Commissioner's Office. You do not have to come to us first, although we would rather you did, because we can usually fix it faster than a regulator can.

Where you are a customer using the lead engine, you are the controller of that lead data and we are your processor. Rights over that data are exercised against you, not us. We will help you answer them, which is part of what the Data Processing Addendum commits us to.

If you are in India, the Digital Personal Data Protection Act, 2023 applies. In its language we are the Data Fiduciary and you are the Data Principal. You have the right to:

• Access a summary of the personal data we process and who we have shared it with.
• Correction, completion, updating and erasure of your personal data.
• Grievance redressal. A route to complain to us directly, set out in the last section of this policy.
• Nomination. You may nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself. Write to us at contact@mallahsoftware.com with the nominee's name and contact details and we will record it against your account.
• Withdrawal of consent at any time, as easily as it was given.

The Act also places a duty on you. A Data Principal must not raise a false or frivolous complaint, must not impersonate somebody else when making a request, and must give authentic information when asked to correct a record. The Act provides for a penalty where that duty is breached. We mention it because the Act does, not because we expect it to come up.

If we do not resolve your grievance, you may escalate to the Data Protection Board of India.

If you live in California, or in another state with a comprehensive privacy law such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon or Montana, you have the right to:

• Know what personal information we collect, why, and who we disclose it to. This page is that disclosure, and the export tool gives you the data itself.
• Delete the personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information, and of targeted advertising.
• Limit the use and disclosure of sensitive personal information.
• Not be discriminated against for exercising any of these. We will not degrade the service, change your price, or treat you differently because you made a request.

Global Privacy Control is honoured. If your browser sends a GPC signal, we treat it as a valid opt-out request without you having to do anything else, and we act on it before any consent banner is shown. An authorised agent may make a request on your behalf; we will ask for proof that you authorised them.

Equivalent rights are honoured for residents of the following countries, under the law named. In practice the rights are close enough that we do not operate different processes: use the export and delete tools, or write to us at support@getmadbot.com and say which country you are in.

• United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and the DIFC and ADGM regimes where they apply instead.
• Saudi Arabia: the Personal Data Protection Law.
• Singapore: the Personal Data Protection Act 2012, including withdrawal of deemed consent.
• Australia: the Privacy Act 1988 and the Australian Privacy Principles.
• Canada: PIPEDA, and Quebec Law 25, which additionally gives you the right to data portability and to be told when a decision is made about you by automated means.
• Brazil: the LGPD, including confirmation of processing, anonymisation and information about data sharing.
• South Africa: POPIA, including the right to complain to the Information Regulator.
• Japan: the APPI, including disclosure, correction and cessation of use.
• South Korea: PIPA, including access, correction, suspension of processing and deletion.

If you are somewhere not listed and your law gives you a right, ask for it. We would rather honour a right we were not certain applied than argue about jurisdiction.

MADBOT scores leads automatically. It looks at technical and commercial signals about a company and produces a number and a reason. It is worth being precise about what that is and is not.

It is a suggestion to a human. The score orders a list. A person decides whether to approve a lead, whether to send anything, and what to send. Where the data concerns a named individual, or a role inbox in a jurisdiction we treat strictly, the engine will not proceed at all until a person approves it.

It is not a decision that produces a legal effect on anybody, or anything similarly significant. Nobody is refused credit, employment, insurance, a service or a price by this system. If we ever build something that does make such a decision, this section will change first and we will tell you before it runs.

We do not build behavioural profiles of individuals, and the engine does not use special category data because it never collects any.

MADBOT is a business tool and is not for anybody under 18. You may not create an account if you are under 18, and the Terms of Service say the same.

Under India's DPDP Act 2023, a child is anybody under 18, and processing a child's data requires verifiable parental consent. The Act also prohibits tracking, behavioural monitoring and targeted advertising directed at children. We do not knowingly process any child's personal data, we do not do behavioural tracking or targeted advertising at all, and we do not offer the service to children.

If you believe a child has created an account, tell us at support@getmadbot.com and we will delete it and the data attached to it.

MADBOT runs no analytics and no advertising cookies. What the site stores in your browser is a short list: what keeps you signed in, what remembers your answer to the cookie banner, and what remembers your theme and currency.

The full inventory, the reason for each entry, how long it lasts, and how to change your mind are in the Cookie and Local Storage Policy. That page is generated from the same code that does the storing, so it cannot describe something we are not doing, or omit something we are.

If personal data we hold is exposed, lost or accessed by somebody who should not have it, here is what happens.

• We contain it, work out what was affected, and write down what we find as we find it.
• Under the GDPR and the UK GDPR we notify the relevant supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to anybody. Where the risk to you is high, we tell you directly, without undue delay.
• In India, the CERT-In directions require certain cyber incidents to be reported within 6 hours of noticing them. The DPDP Act separately requires us to notify the Data Protection Board of India and every affected Data Principal. We do both.
• Where you are the controller and we are your processor, we tell you without undue delay so that you can meet your own notification deadlines. Your deadline is the one that governs, not ours.
• Other regimes have their own timelines, and we meet whichever is shortest rather than picking the most convenient.

A notification from us will say what happened, what data was involved, what we have done, and what you should do. It will not be written to minimise the incident.

The date at the top of this page is the last time it changed. Minor corrections, clearer wording and new sub-processors get published here with the date updated.

If we change something that materially affects you, meaning a new purpose for your data, a new category of data, or a change in the legal basis we rely on, we will email account holders before the change takes effect, and we will not apply it retroactively. If the change requires consent, we will ask for consent rather than assuming it from your continued use.

If our cookie inventory changes, the stored consent record carries a version number that invalidates old answers, so you are asked again about the new thing rather than being treated as having agreed to it.

Start with us. Write at support@getmadbot.com and describe the problem.

India: the Grievance Officer route

India's Consumer Protection (E-Commerce) Rules 2020 and the IT Rules 2021 require us to publish a named Grievance Officer, and the DPDP Act requires a published contact for grievances.

Grievance Officer: Siddhant Mallah, contact@mallahsoftware.com, +91 88281 41371, Plot No. 347, Flat No. 301, Status-2 CHSL, Santacruz (East), Mumbai, Maharashtra, 400055, India.

We acknowledge a grievance within 48 hours and resolve it within 30 days. If you are in India and we have not resolved it, you may escalate to the Data Protection Board of India.

Elsewhere

In the EU or the EEA, complain to the supervisory authority where you live or work. In the United Kingdom, the Information Commissioner's Office. In South Africa, the Information Regulator. In Brazil, the ANPD. In Singapore, the PDPC. In Australia, the OAIC. In Canada, the Office of the Privacy Commissioner, or the Commission d'accès à l'information in Quebec. In California, the California Privacy Protection Agency or the Attorney General. You never have to come to us first.