AI Growth Beacon ("Beacon," "the Service," "we," "us") is a product of AI Growth Xperts LLC ("AI Growth Xperts," "the Company"), which owns and operates Beacon and controls the data described below. This policy covers two different kinds of data: (1) your own account data as a Beacon customer, and (2) business data Beacon looks up on your behalf, which is not personal data about you.
1. Data we collect about you, the account holder
- Account information: your email address, name, and company name.
- Billing information: handled directly by our payment processor — we do not store your full card number.
- Usage data: which searches and enrichment actions you run, your credit/wallet balance and history, and login activity.
- Signup fraud-prevention signals: your IP address at signup, a device fingerprint, and a spam-check on your email address at signup, used only to detect and limit free-tier abuse (for example, one person creating many free accounts). We do not use this for any other purpose.
2. Data Beacon looks up — not personal data about you
When you search or request enrichment, Beacon produces information about businesses (and, in some cases, individuals who work at those businesses, such as an owner's published contact details). This is not data about you as a Beacon user:
- Places listing data (business name, address, phone, rating, review count, website) — licensed from Google. Under the Beacon Demand Data Engine (defined in the Terms of Service, Section 2) a listing is refreshed from Google only where a customer is actively using that business; elsewhere its Google-sourced rating and review figures are retired at 30 days.
- Enriched contact data (a business email, an owner/personal email found on the business's own public website) — found by crawling pages the business has published publicly. Where a customer asks, a published address is checked for deliverability and a listed number for its line type through a verification provider. This data, once found, is kept permanently in our system (it does not expire on the 30-day cycle above) so that it doesn't need to be re-looked-up, and so that other customers researching the same business benefit from work already done.
- AI-generated research summaries — built from publicly available information about a business.
This business-and-contact data is stored in a shared cache used to serve any customer researching the same business — it is never sold or exposed in bulk, and each customer only sees the specific fields they have individually unlocked and paid for.
3. How we use your data
- To operate the Service — run your searches, process payments, and maintain your account.
- To detect and prevent abuse of free-tier signups and rate limits.
- To send you account-related email (signup confirmation, billing receipts, service notices).
- To monitor for errors and keep the Service running reliably.
We do not sell your personal account data to third parties.
4. Who we share data with
We share personal data and account information with trusted categories of third-party service providers to operate Beacon. These service providers act strictly as data processors under contractual obligations that prohibit them from retaining, using, or disclosing your information for any purpose other than providing services to us.
- Payment processing — to handle secure subscription billing, wallet top-ups, and transaction processing (e.g., Stripe).
- Cloud infrastructure and hosting — to securely maintain application servers, store account metadata, and host database systems (e.g., Vercel, Supabase, AWS).
- Transactional email and communications — to deliver system alerts, account notifications, and authentication emails (e.g., Resend).
- Geographic and business mapping APIs — to resolve location searches, fetch public place details, and generate map coordinates (e.g., Google Maps Platform).
- Public web data and AI processing — to crawl a business's own published website, retrieve publicly available web data, and synthesize structured business summaries (e.g., Gemini, Claude).
- Contact verification — to check whether a published business email address accepts mail and whether a listed phone number is a mobile, landline, or VoIP line (e.g., No2Bounce, Twilio). The address or number is the only data sent; no message is delivered and no call is placed.
5. International data transfers
Beacon is offered worldwide, and the service providers listed above may process data outside your own country, including in the United States. Where personal data is transferred internationally — including from the European Economic Area (EEA), the United Kingdom, or Switzerland — we and our service providers rely on recognized safeguards, such as a provider's own certification under the EU-U.S. Data Privacy Framework (where applicable) or Standard Contractual Clauses.
6. Data retention
We keep your account data for as long as your account is active. Business/contact data you've unlocked is retained permanently in our shared cache (see Section 2) since it is not personal data about you and is reused to serve other customers efficiently. Google-sourced listing details are refreshed on demand or retired at 30 days, as described in Section 2.
7. Account deletion
You can request deletion of your account at any time by contacting us at the email below. On deletion, we remove your login credentials and personal profile information (name, email, company name). Your credit/billing history may be retained as required for our own accounting and legal-compliance obligations.
8. Your privacy rights under U.S. state privacy laws
A growing set of U.S. states have comprehensive consumer privacy laws, including California (CCPA, as amended by the CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, and Rhode Island. Where one of these laws applies to you, we honour the rights it grants. The checklist below is the set of rights common to them; the exact scope and any exceptions follow the law of your state.
How B2B and workforce data are handled under the CCPA. Since January 1, 2023 the CCPA's exemptions for business-to-business contact data and for employee and applicant data have expired, so published business contact details about a California resident (an owner's name, title, or business email found on a company's own website) are treated as personal information under the CCPA, with every right below available to that person, and the removal request form as the fastest route. Beacon does not process human-resources data on behalf of customers: it holds no payroll, benefits, applicant, or personnel records for any customer, and the only workforce data AI Growth Xperts LLC processes is its own, under its own internal notice. A customer must not import HR data into Beacon.
Checklist of consumer rights common across the U.S. state privacy laws:
- Right to access / know: confirm whether we process your personal information and receive the categories and specific pieces we hold, the sources, the purposes, and the categories of third parties we share it with.
- Right to delete: have personal information we hold about you deleted, subject to the exceptions the applicable law allows (for example, records we must keep for billing or legal compliance).
- Right to correct: have inaccurate personal information corrected.
- Right to data portability: receive the personal information you provided to us in a portable and, where feasible, readily usable format.
- Right to opt out of sale, sharing, targeted advertising, and profiling: we do not sell or share your personal account data, do not serve targeted advertising, and do not make decisions about you through automated profiling that produce legal or similarly significant effects. There is nothing to opt out of, and we will not start any of these without updating this policy. A business that appears in Beacon's business-listing data can have that listing removed or blocked through the removal request form.
- Right to limit use of sensitive personal information: we do not collect sensitive personal information as the state laws define it (precise geolocation, health, biometric, financial-account, or similar data) about account holders.
- Right to non-discrimination: we will not deny you service, charge you a different rate, or provide a different level of service for exercising any of these rights.
- Right to appeal: if we decline a request, you may appeal by replying to our decision; we will respond to the appeal in writing, and where your state law provides it you may then contact your state attorney general.
To exercise any of these rights, send a request to beacon@aigrowthxperts.com, or use the removal request form for a business listing specifically. We will verify the request and respond within forty-five (45) days, extendable once by a further forty-five (45) days where reasonably necessary, with notice. You may use an authorised agent where your state law allows it.
9. Your privacy rights (EEA, UK, and Switzerland residents)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, data protection law (including the GDPR and UK GDPR) gives you the following rights regarding your personal information:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request that we correct inaccurate or incomplete personal data.
- Right to erasure: request that we delete your personal data, subject to certain legal exceptions.
- Right to restrict processing: request that we limit how we use your personal data in certain circumstances.
- Right to data portability: request your personal data in a structured, commonly used, machine-readable format.
- Right to object: object to our processing of your personal data in certain circumstances.
- Right to withdraw consent: where we rely on your consent for a specific processing activity, withdraw it at any time.
- Right to lodge a complaint: file a complaint with your local data protection supervisory authority.
To exercise any of these rights, send a request to beacon@aigrowthxperts.com. We will respond within one (1) month, as required by GDPR (extendable by two further months for complex requests, with notice).
10. Cookies and tracking technologies
- Essential cookies: required to operate authentication, keep you signed in, and protect against automated/bot signups.
- Analytics: we use privacy-respecting, first-party web analytics to understand traffic and how the product is used. It does not track you across other websites.
11. Federal laws — where Beacon stops
Beacon provides B2B business intelligence about businesses and their published contact details. It is not designed for, and does not process, the categories of data the following federal laws govern, and a customer must not import such data into the Service:
- HIPAA: Beacon does not process protected health information and is neither a covered entity nor a business associate. A medical or dental practice appears in Beacon only as a business — its listing, its website, and the contact details it publishes — never its patients or their records.
- GLBA: Beacon does not collect or process non-public personal information about consumers from financial institutions, and is not itself a financial institution. Your own payment card details are handled by our payment processor and never stored by Beacon.
- COPPA: Beacon is for adults eighteen (18) and over and does not knowingly collect personal information from children under thirteen (13); see the next section.
- FTC Act, Section 5: we describe our data practices in this policy and the Terms of Service accurately, and we do not engage in unfair or deceptive practices. What Beacon does with data is what these documents say it does.
The laws that do govern how you use Beacon's output — CAN-SPAM, the TCPA, and state telemarketing and privacy laws — apply to your outreach, not to Beacon's processing, and are your responsibility under the Terms of Service.
12. Children's privacy
Beacon is intended exclusively for business professionals and adults eighteen (18) years of age or older. We do not knowingly collect personal information from anyone under sixteen (16). If we learn we've inadvertently collected data from a minor under 16, we will delete it promptly.
13. SOC 2 alignment and data security
Beacon's controls are organised against the SOC 2 Trust Services Criteria for security, availability, and confidentiality. A third-party SOC 2 attestation has not been issued for Beacon at the date above; when one is, this section will state the report type and period. The safeguards actually in place today are:
- Encryption: all traffic between your browser and Beacon, and between Beacon and its service providers, is encrypted in transit (TLS). Data at rest in our database and backups is encrypted by our hosting provider.
- Access to business data is server-side only: the shared business-and-contact corpus is readable only by Beacon's own server-side service role, never by a browser session, and every record served to you passes through a per-field gate that reveals only the fields your account has unlocked. Customer-owned records (saved leads, lists, imports) are scoped to the owning account by row-level policies in the database itself.
- Least privilege: database roles reachable from a browser hold no write access except to the customer-owned tables above, and every privileged database function is callable only by the server. Secrets are held on the servers and never shipped to the browser.
- Administrative access: internal administrative tools require a separate administrator account, a second factor (TOTP), and re-verification on every request. Every administrative action is written to an audit log.
- Availability and recovery: the database is backed up daily by our hosting provider; errors and failed deployments raise alerts to the team; a service notice is shown in the product whenever an incident affects what you see.
- Abuse and rate controls: every API route is rate-limited per account and per network address; signups are protected against automation; automated vendor use is metered and capped per account (the Beacon Demand Data Engine, Terms of Service Section 2).
- Vendors: the service providers in Section 4 process data only to provide their service to us, under their own security programmes and data-processing terms.
- Retention and deletion: search criteria and similar inputs are retained only as long as needed to fulfil the request; account data is deleted on request as described in Section 7.
No system is perfectly secure. If you believe you have found a vulnerability in Beacon, please report it to beacon@aigrowthxperts.com and give us a reasonable opportunity to address it before disclosing it.
14. Changes to this policy
We may update this policy from time to time. We'll update the "Last updated" date above when we do.
15. Contact
Questions about this policy, or to request account/data deletion: beacon@aigrowthxperts.com.