AI Growth Beacon

AI Growth Beacon ("Beacon," "the Service," "we," "us") is a product of AI Growth Xperts LLC ("AI Growth Xperts," "the Company"), which owns and operates Beacon and controls the data described below. Beacon is a B2B search and intelligence indexing platform that aggregates publicly available business information. This policy covers two different kinds of data: (1) your own account data as a Beacon customer, and (2) business information Beacon indexes, which is not personal data about you.

1. Data we collect about you, the account holder

Account information: your email address, name, and company name.
Billing information: handled directly by our payment processor — we do not store your full card number.
Usage data: which searches and enrichment actions you run, your credit/wallet balance and history, and login activity.
Your activity history: each search, pull, enrichment, export, import and credit movement with its result and charge — the record shown on your Activity page.
Lists you upload: the file you import, kept as you sent it so we can return it with Beacon's columns added, and private to your account.
Work you organise in Beacon: your Vault collections, team labels and Mini-CRM statuses.
Messages: your support tickets and your conversations with the Beacon Assistant. Assistant messages are processed by an AI provider to write each reply.
Signup fraud-prevention signals: your IP address at signup, a device fingerprint, and a spam-check on your email address at signup, used only to detect and limit free-tier abuse (for example, one person creating many free accounts). We do not use this for any other purpose.

2. Business information Beacon indexes — not personal data about you

When you search or request enrichment, Beacon returns information about businesses (and, in some cases, the people who run or work at them, such as an owner's business contact details). This is not data about you as a Beacon user:

Listing data (business name, address, phone, rating, review count, website) — licensed from our intelligence partners and indexed by Beacon Discovery. Under the Beacon Demand Data Engine (defined in the Terms of Service, Section 2) a listing is refreshed only where a customer is actively using that business; elsewhere its partner-sourced rating and review figures are retired at 30 days.
Enriched contact data — a business email, an owner's or team member's email, phone numbers and a public LinkedIn profile link. We find these on the business's own published pages, in public records and public web search results, or, for an email address, by testing standard address patterns on the business's own domain and keeping one only when a verification check reports that the mailbox accepts mail; such an address is labelled in Beacon as verified, not published. Where a customer asks, an address is checked for deliverability and a number for its line type. Once found, this data is kept so it need not be looked up again, until the person it concerns removes it (Section 8).
AI-generated research summaries — built from publicly available information about a business.

This business-and-contact data is stored in a shared index used to serve any customer researching the same business. It is never exposed in bulk, and each customer only sees the specific fields they have individually unlocked.

3. How we use your data

To operate the Service — run your searches, process payments, and maintain your account.
To detect and prevent abuse of free-tier signups and rate limits.
To send you account-related email (signup confirmation, billing receipts, service notices).
To monitor for errors and keep the Service running reliably.

We never disclose your personal account data to third parties for their own use.

4. Who we share data with

We share personal data and account information with trusted categories of service providers — our intelligence partners — to operate Beacon. These providers act strictly as data processors under contractual obligations that prohibit them from retaining, using, or disclosing your information for any purpose other than providing services to us.

Payment processing — to handle secure subscription billing, wallet top-ups, and transaction processing.
Cloud infrastructure and hosting — to securely run application servers and background workers, store account data, and host database systems.
Transactional email and communications — to deliver system alerts, account notifications, and authentication emails.
Mapping and business-listing data — to resolve location searches, retrieve public business listings, and draw maps.
Web research and AI processing — to read a business's own published website, search public pages, news and records, synthesize structured business summaries, and answer your messages to the Beacon Assistant.
Contact verification — to check whether an email address accepts mail and whether a phone number is a mobile, landline, or VoIP line. The address or number is the only data sent; no message is delivered and no call is placed.
Monitoring and reliability — error reports, uptime checks, and the job queue and rate-limit store that protect the Service, which see your network address.
Signup protection — a bot check on the signup form.

5. International data transfers

Beacon is offered worldwide, and the service providers described above may process data outside your own country, including in the United States. Where personal data is transferred internationally — including from the European Economic Area (EEA), the United Kingdom, or Switzerland — we and our service providers rely on recognized safeguards, such as a provider's own certification under the EU-U.S. Data Privacy Framework (where applicable) or Standard Contractual Clauses.

6. Data retention

We keep your account data for as long as your account is active. Your activity history is kept for as long as your account is active: the Activity page shows the last 90 days, and the full history downloads from it at any time. Business and contact data you've unlocked is kept in our shared index (see Section 2) since it is not personal data about you and is reused to serve other customers efficiently, until the person it concerns removes it. Partner-sourced listing details are refreshed on demand or retired at 30 days, as described in Section 2.

System Performance and Accuracy Operational Cache. Beacon's backend keeps a rolling operational cache: partner listing data, copies of the pages our crawler reads and email-verification results are used for up to 30 days, search results for up to 7 days, and phone line-type results for up to 180 days. The cache exists to avoid running — and billing — the same lookup twice and to keep your session fast; once an entry passes its window it is refreshed before it is used again, or retired. Beacon does not build consumer profiles: it indexes businesses and the business contact details of the people who run them, and holds no household, demographic, spending or consumer-credit data about anyone. Business facts our crawler establishes, and the intelligence customers unlock, are kept as Section 2 describes until the person concerned removes them.

7. Account deletion

You can request deletion of your account at any time by contacting us at the email below. On deletion, we remove your login credentials and personal profile information (name, email, company name). Your credit/billing history may be retained as required for our own accounting and legal-compliance obligations.

8. Your privacy rights under U.S. state privacy laws

A growing set of U.S. states have comprehensive consumer privacy laws, including California (CCPA, as amended by the CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, and Rhode Island. Where one of these laws applies to you, we honour the rights it grants. The checklist below is the set of rights common to them; the exact scope and any exceptions follow the law of your state.

How business contact data is handled. Since January 1, 2023 the CCPA's exemptions for business-to-business contact data and for employee and applicant data have expired, so published business contact details about a California resident (an owner's name, title, or business email found on a company's own website) are treated as personal information under the CCPA, with every right below available to that person. Beacon's customers can unlock the business contact details Beacon indexes. A person whose details appear in Beacon can remove them at any time through Remove My Data — their email address, phone number and / or name at a business. The removal applies once you confirm the link we email you, for every customer, and the details are never added again. Beacon does not process human-resources data on behalf of customers: it holds no payroll, benefits, applicant, or personnel records for any customer, and the only workforce data AI Growth Xperts LLC processes is its own, under its own internal notice. A customer must not import HR data into Beacon.

Checklist of consumer rights common across the U.S. state privacy laws:

Right to access / know: confirm whether we process your personal information and receive the categories and specific pieces we hold, the sources, the purposes, and the categories of third parties we share it with.
Right to delete: have personal information we hold about you deleted, subject to the exceptions the applicable law allows (for example, records we must keep for billing or legal compliance). For business contact details Beacon indexes, Remove My Data does this at once.
Right to correct: have inaccurate personal information corrected.
Right to data portability: receive the personal information you provided to us in a portable and, where feasible, readily usable format.
Right to opt out of sale, sharing, targeted advertising, and profiling: we do not disclose your personal account data to third parties for their own use, do not serve targeted advertising, and do not make decisions about you through automated profiling that produce legal or similarly significant effects. A person whose business contact details appear in Beacon can opt out of them being unlocked by any customer through Remove My Data, and a business can have its whole listing removed the same way.
Right to limit use of sensitive personal information: we do not collect sensitive personal information as the state laws define it (precise geolocation, health, biometric, financial-account, or similar data) about account holders.
Right to non-discrimination: we will not deny you service, charge you a different rate, or provide a different level of service for exercising any of these rights.
Right to appeal: if we decline a request, you may appeal by replying to our decision; we will respond to the appeal in writing, and where your state law provides it you may then contact your state attorney general.

To exercise any of these rights, send a request to legal@aigrowthbeacon.com, or use Remove My Data for your contact details or a business listing. We will verify the request and respond within forty-five (45) days, extendable once by a further forty-five (45) days where reasonably necessary, with notice. You may use an authorised agent where your state law allows it.

8a. California disclosures: what we hold, why, and for how long

Beacon holds two different kinds of personal information, and the rights above apply to both.

(A) Account data — about you as a Beacon account holder.

Categories: identifiers (your name, email address, company name, the IP address a request comes from); commercial information (your plan, credit and wallet balances, invoices and the history of what you unlocked and were charged); internet or electronic activity (the searches, lookups, exports and imports you run, and sign-in and security events); and the lists and notes you keep in Beacon.
Sources: you, and your use of the Service; our payment processor tells us whether a payment succeeded (we never receive or store full card numbers).
Purposes: to provide and bill the Service, to keep accounts secure and prevent fraud and abuse (including automated sign-in attempts), to answer support requests, and to meet legal obligations.
Disclosed to: the service providers described in Section 4, under contract, only to run the Service. Account data is never disclosed for value and never used for cross-context behavioural advertising.
Retention: for as long as your account is active; billing records for as long as accounting and tax law requires; records of sign-in, password-reset and confirmation-email attempts (kept only as one-way fingerprints of the email address and network address, never the values themselves) for seven (7) days.

(B) Business contact data — about people at the businesses Beacon indexes.

Categories: professional identifiers and information — a person's name, job title, and business email, business phone or professional profile as published for their business. No sensitive personal information, no home address and no consumer or household data.
Sources: the business's own website, public business listings and registries, other public web pages, and mailbox checks that confirm an address can receive mail (described in Section 2).
Purposes: to let Beacon's business customers find, research and contact businesses.
Disclosed to: Beacon customers who unlock those details for a lead. Under the CCPA, making business contact details available to customers in this way may be treated as a "sale" of personal information; you can stop it at any time, as described next.
Retention: until the person removes them (or the business removes its listing); partner listing details are refreshed on demand or retired at thirty (30) days, as Section 2 describes.

8b. Do Not Sell or Share My Personal Information

If your business contact details appear in Beacon, use Remove My Data to opt out. Once you confirm the request, your details are no longer made available to any customer, and they are not added again. A business can opt its whole listing out the same way.

Global Privacy Control. We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of personal information linked to that browser. Account data is never disclosed for value or for advertising, so for an account holder there is nothing further to switch off. A GPC signal does not tell us which business contact details are yours; to remove those, use Remove My Data.

How requests are handled, and how long it takes. We confirm receipt of a privacy request within ten (10) business days and act on an opt-out within fifteen (15) business days of receiving it. Every Remove My Data request is confirmed by email first: we send a single-use link to the address you entered, it works for twenty-four (24) hours, and nothing is removed until you open it. A business listing is removed at once only when the confirmed email address is at the business's own website domain; a request from a personal or free email address, or from a domain that does not match the business's website, is reviewed by a person before the listing is removed. Requests to know, delete or correct are answered within the forty-five (45) day period set out above.

Authorised agents. An authorised agent may submit a request on your behalf by emailing legal@aigrowthbeacon.com with your written, signed permission (or a valid power of attorney). We may ask you to confirm your identity directly with us, or to confirm that you gave the agent permission, before we act. A removal of business contact details still has to be confirmed from the email address being removed.

8c. Canada

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law give you the right to access the personal information we hold about you, to ask that it be corrected, and to withdraw consent to its use, subject to legal and contractual limits. Business contact information used to communicate with you about your work is handled as PIPEDA provides for it. To make a request or a complaint, email legal@aigrowthbeacon.com or use Remove My Data; we answer within thirty (30) days. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada.

9. Your privacy rights (EEA, UK, and Switzerland residents)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, data protection law (including the GDPR and UK GDPR) gives you the following rights regarding your personal information:

Right of access: request a copy of the personal data we hold about you.
Right to rectification: request that we correct inaccurate or incomplete personal data.
Right to erasure: request that we delete your personal data, subject to certain legal exceptions.
Right to restrict processing: request that we limit how we use your personal data in certain circumstances.
Right to data portability: request your personal data in a structured, commonly used, machine-readable format.
Right to object: object to our processing of your personal data in certain circumstances.
Right to withdraw consent: where we rely on your consent for a specific processing activity, withdraw it at any time.
Right to lodge a complaint: file a complaint with your local data protection supervisory authority.

To exercise any of these rights, send a request to legal@aigrowthbeacon.com, or use Remove My Data. We will respond within one (1) month, as required by GDPR (extendable by two further months for complex requests, with notice).

10. Cookies and tracking technologies

Essential cookies: required to operate authentication, keep you signed in, and protect against automated/bot signups.
Analytics: we use privacy-respecting, first-party web analytics to understand traffic and how the product is used. It does not track you across other websites.

11. Federal laws — where Beacon stops

Beacon provides B2B business intelligence about businesses and their published contact details. It is not designed for, and does not process, the categories of data the following federal laws govern, and a customer must not import such data into the Service:

HIPAA: Beacon does not process protected health information and is neither a covered entity nor a business associate. A medical or dental practice appears in Beacon only as a business — its listing, its website, and the contact details it publishes — never its patients or their records.
GLBA: Beacon does not collect or process non-public personal information about consumers from financial institutions, and is not itself a financial institution. Your own payment card details are handled by our payment processor and never stored by Beacon.
COPPA: Beacon is for adults eighteen (18) and over and does not knowingly collect personal information from children; see the next section.
FTC Act, Section 5: we describe our data practices in this policy and the Terms of Service accurately, and we do not engage in unfair or deceptive practices. What Beacon does with data is what these documents say it does.

The laws that do govern how you use Beacon's output — CAN-SPAM, the TCPA, and state telemarketing and privacy laws — apply to your outreach, not to Beacon's processing, and are your responsibility under the Terms of Service.

12. Children's privacy

Beacon is for business professionals aged eighteen (18) or older. We do not knowingly collect personal information from anyone under eighteen, and we delete it promptly if we learn we have.

13. SOC 2 alignment and data security

Beacon's controls are organised against the SOC 2 Trust Services Criteria for security, availability, and confidentiality. A third-party SOC 2 attestation has not been issued for Beacon at the date above; when one is, this section will state the report type and period. The safeguards actually in place today are:

Encryption: all traffic between your browser and Beacon, and between Beacon and its service providers, is encrypted in transit (TLS). Data at rest in our database and backups is encrypted by our hosting provider.
Access to business data is server-side only, and default-deny: the shared business-and-contact data is readable only by Beacon's own servers, never by a browser session. Every record sent to you is rebuilt from an allowlist of approved fields, and each paid field is included only when your own account has unlocked it; anything not on the list is left out. Your own records — imports, Vault collections, labels, statuses, support tickets and activity — are read and written only for your account, on our servers.
Least privilege: database roles reachable from a browser hold no write access except to a small set of customer-owned tables protected by row-level policies, and every privileged database function is callable only by the server. Secrets are held on the servers and never shipped to the browser.
Administrative access: internal administrative tools require a separate administrator account, a second factor (TOTP), and re-verification on every request. Every administrative action is written to an audit log.
Availability and recovery: the database is backed up daily by our hosting provider; errors and failed deployments raise alerts to the team; a service notice is shown in the product whenever an incident affects what you see.
Abuse and rate controls: every API route is rate-limited per account and per network address; signups are protected against automation; automated partner use is metered and capped per account (the Beacon Demand Data Engine, Terms of Service Section 2).
Service providers: the providers in Section 4 process data only to provide their service to us, under their own security programmes and data-processing terms.
Retention and deletion: search criteria and similar inputs are retained only as long as needed to fulfil the request; account data is deleted on request as described in Section 7; a person's contact details are removed through Remove My Data as described in Section 8.

No system is perfectly secure. If you believe you have found a vulnerability in Beacon, please report it to legal@aigrowthbeacon.com and give us a reasonable opportunity to address it before disclosing it.

14. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do.

15. Contact

Questions about this policy, or to request account or data deletion: legal@aigrowthbeacon.com, or Remove My Data.

Privacy Policy