Effective / Last Updated: July 20,2026

‍Introduction

Success AI Holdings Inc ("Success.ai," "we," "us," or "our"), a Florida corporation located at 7901 4th St, STE 300, St. Petersburg, FL 33702, USA, is committed to protecting your privacy and being transparent about how we collect, use, store, share, and protect personal information. This Privacy Policy explains our practices for our website (www.success.ai), our web application, and our related services (collectively, the "Services").

Please read Section 1 (Our Two Roles) and Section 3 (Data Broker Laws) carefully — Success.ai operates a compiled business‑to‑business (B2B) contact database and a platform that our customers use to run their own outreach, and our privacy responsibilities differ between the two.
Questions or requests: [email protected].

‍1. Our Two Roles (Controller vs. Processor)

Success.ai plays two distinct roles, and different parts of this Policy apply to each:

1.1 As a controller / "business" (this Policy applies in full).

When we compile, enrich, maintain, license, or sell our B2B Contact Database, and when we handle information about our own account holders, website visitors, and marketing contacts, we act as a data controller under the GDPR and a "business" under US state privacy laws (see Section 3).

1.2 As a processor / "service provider" (this Policy does NOT govern; the DPA does).

When our customers use the Services to run their own campaigns — including lists and prospect data they upload, their message content, and data we access from their connected email accounts (e.g., Gmail/Google Workspace) — we act as a processor / service provider, processing that data only on the customer's documented instructions. For that data, the customer is the controller, and our Data Processing Addendum (DPA) (available on request at [email protected]), not the controller provisions of this Policy, applies. We keep data we process on behalf of customers firewalled from, and do not use it to build or enrich, our sellable B2B Contact Database.

2. Consent and How This Policy Works

By using the Services or providing personal information to us, you acknowledge the practices described here. Where we rely on consent as our legal basis (for example, certain marketing), you may withdraw it at any time. Where individuals are included in our B2B Contact Database, we rely on legitimate interests and you have the right to object and to request removal at any time (Sections 8–10).

3. Data Broker Laws

Because we collect and license business contact information about individuals with whom we may not have a direct relationship, certain US state laws that regulate "data brokers" (including in California, Texas, Oregon, and Vermont) may apply to parts of our business. We comply with those laws as they apply to us, and — most importantly for you — we maintain easy‑to‑use opt‑out and deletion mechanisms, described in Sections 9–10, that we honor regardless of where you live.

4. Personal Data We Collect, and Its Sources

4.1 Sources of data

Source Examples Directly from you Account registration, purchases, support requests, forms, surveys Automatically Device, browser, IP address, usage/log data, cookies (Section 14) Public and publicly available sources Company websites, professional networking/social profiles, public registries and directories Third‑party data providers & partners Licensed data aggregators, enrichment partners, data‑sharing partners Service providers Payment processor (Stripe), analytics, marketing, and support tools Your connected accounts Email/Google account data you authorize us to access (processed as a processor — see Sections 1.2 and 13)

4.2 Categories of personal data

• Identity & contact: first/last name, business email, mailing address, country, phone, IP address, login credentials.
• Professional (B2B): job title, company name, industry, department, seniority, and Intra‑community VAT number (if applicable).
• Financial: payment details, processed securely by Stripe (see https://stripe.com/privacy); we do not store full card numbers.
• Technical: domain, browser, OS, device, and browsing data collected via cookies.
• Interaction: order history, support tickets, complaints, and messages exchanged with us.
• Marketing preferences.

4.3 What we do NOT collect

We do not intentionally collect government identifiers (e.g., SSNs), full payment‑card numbers, consumer credit/financial‑eligibility data, health/medical data, or special‑category / sensitive personal information. Please do not provide such data.

5. How and Why We Use Personal Data (Purposes & Legal Bases)

Purpose Legal basis (GDPR) Create/manage accounts, provide the Services, process transactions Contractual necessity Customer support and service communications Legitimate interests / contract Marketing and promotional communications Consent (where required) or legitimate interests Personalization, analytics, and product improvement Legitimate interests Legal compliance, fraud prevention, security, enforcing our terms Legal obligation / legitimate interests Compiling, maintaining, and licensing/selling our B2B Contact DatabaseLegitimate interests (Art. 6(1)(f)) — see Section 6

6. Our B2B Contact Database — Legitimate Interests and Article 14 Notice

6.1 Legitimate interests.

We compile and provide B2B contact information to enable lawful professional networking and business‑to‑business outreach. We rely on our legitimate interests (GDPR Art. 6(1)(f)) and have conducted a Legitimate Interests Assessment (LIA) balancing our interests against the rights and freedoms of data subjects. A summary of that assessment is available on request at [email protected].

6.2 Article 14 (data collected indirectly).

Where we obtain personal data about you from sources other than you directly, we act as controller and provide the following, consistent with GDPR Article 14: our identity and contact details (Section 18); the categories of data and their sources (Section 4); the purposes and legal basis (Sections 5–6); the recipients (Section 7); retention (Section 11); and your rights, including the right to object at any time (Sections 8–10). A standalone Article 14 notice is published on our website.

6.3 Your right to object / opt out.

You can object to inclusion in the B2B Contact Database and request removal at any time through our opt‑out page (linked in our website footer) or by emailing [email protected]. When you do, we suppress your data as described in Section 11.2.

7. How We Share Personal Data

• Service providers & partners — payment processing (Stripe), hosting, analytics, marketing, and support, under contract and only for specified purposes. A current list of our sub‑processors is available on request at [email protected].
• Customers/licensees of the B2B Contact Database — we license/sell B2B professional contact information (name, title, company, business email/phone) to business customers, subject to contractual use restrictions and opt‑out obligations.
• Legal & protection — to comply with law, court orders, or governmental requests, and to enforce our terms and protect rights, safety, and property.
• Business transfers — in a merger, acquisition, financing, restructuring, or sale of assets.
• Aggregated/anonymized data — which cannot reasonably identify you.

We do not sell or rent the personal data of our account holders for third parties' own marketing without consent. Our sale/licensing of B2B Contact Database information is disclosed here and is subject to the opt‑out and deletion rights in Sections 9–10.

8. Your GDPR / UK GDPR Rights (EEA, UK, Switzerland)

You have the rights to: access; rectification; erasure ("right to be forgotten"); restriction; data portability; object (including to direct marketing and to processing based on legitimate interests, such as the B2B Contact Database); and to withdraw consent. You may also lodge a complaint with your supervisory authority (in the EU, your national Data Protection Authority; in the UK, the ICO).

How to exercise: [email protected] or our opt‑out page (linked in our website footer). We aim to respond within one month. We may verify your identity first.

9. Your US State Privacy Rights (California and other states)

Depending on your state of residence (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws), you may have the rights to: know/access, delete, correct, portability, opt out of the sale or sharing of personal information and of targeted advertising and certain profiling, limit use of sensitive personal information, and to appeal a denied request.

9.1 Do Not Sell or Share.

Because we license/sell B2B contact data, this may be a "sale"/"sharing" under these laws. You may opt out via our opt‑out page (linked in our website footer) or by emailing [email protected].

9.2 Opt‑out preference signals.

Where required by applicable law, we treat browser opt‑out preference signals, including Global Privacy Control (GPC), as a valid request to opt out of sale/sharing for that browser or device, to the extent we can associate the signal with your data. You can always opt out directly using the methods in Section 9.1.

9.3 Appeals.

If we deny your request, you may appeal by contacting [email protected] with "Appeal" in the subject line. We will respond within the time required by your state's law (generally 45 days, extendable).

9.4 Authorized agents

may submit requests with proof of authorization.

10. California Deletion via DROP (Delete Act)

California residents may request deletion of their personal information from data brokers through the state's Delete Request and Opt‑out Platform (DROP), operated by the California Privacy Protection Agency. To the extent the Delete Act applies to us, we will process verified deletion requests submitted through DROP in accordance with the statute's timelines and direct our service providers to do the same, subject to statutory exemptions. The fastest way to reach us directly is our opt‑out page (linked in our website footer) or [email protected] — we honor direct deletion and opt‑out requests regardless of DROP.

10A. Not a Consumer Reporting Agency

Success.ai is not a consumer reporting agency, and our Contact Data is not a "consumer report" under the Fair Credit Reporting Act (FCRA) or any state equivalent. Our data is provided for business‑to‑business sales and marketing and may not be used to determine eligibility for credit, insurance, employment, housing, or similar purposes. See the Terms of Service for the corresponding customer obligations.

10B. Artificial Intelligence and Automated Processing

10B.1 AI features. We offer AI features ("AI Operators") that draft and send outreach, handle follow-ups, and generate research/summaries. These are delivered using third-party AI providers (a current list is available on request). Our agreements with those providers do not permit them to use your data to train their models, and we do not use your Customer Data, inputs, or outputs to train foundation models (we may use aggregated, de-identified data to improve the Services). AI outputs may be inaccurate and are subject to the AI Operator Terms.

10B.2 Automated decision-making. We do not use solely automated processing to make decisions about individuals that produce legal or similarly significant effects. Any lead scoring or prioritization is for sales and marketing support and is not used to determine eligibility for any product, service, or opportunity. Where applicable law (e.g., GDPR Article 22) grants rights regarding automated decisions, you may contact us to exercise them.

11. Data Retention and Suppression

11.1 Retention periods. We retain personal data only as long as necessary: service data for the life of the account and up to 3 years after closure (longer if required by law); marketing data for 3 years from collection or last active contact; and evidentiary/compliance data for the applicable statutory limitation period (generally 5 years). Identity data used to verify a rights request is deleted once the request is handled. Anonymized/aggregated data may be retained indefinitely.

11.2 Suppression after deletion/opt-out. When you request deletion or opt out of the B2B Contact Database, we retain the minimum identifiers necessary in a suppression file so that we do not re-add you if we encounter your data again, and to evidence our compliance. This narrow retention is required to honor your request. We dispose of data using industry-standard methods (e.g., NIST SP 800-88).

12. International Data Transfers

12.1 Our servers and providers are located in the European Union and the United States, so personal data may be transferred across borders.

12.2 Safeguards. For transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards recognized under applicable law, principally the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (IDTA).

12.3 Your rights. You may request information about these safeguards or object to a transfer at [email protected].

13. Connected Email Accounts & Google API Limited Use

When you connect an email account (e.g., Gmail/Google Workspace), we access certain data to provide the Services (composing, sending, and tracking email on your behalf). For this data, we act as your processor (Section 1.2).

Google API Limited Use. Success.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we access Gmail message content, metadata, headers, and settings solely to provide and improve the email features you request; we do not transfer this data except as necessary to provide those features, comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising or to train generalized or third-party AI/ML models; and no humans read it except with your consent, for security or abuse investigations, or as required by law. Data accessed from your connected email account is kept firewalled from, and is never used to build or enrich, our sellable B2B Contact Database. You can revoke our access at any time via your Google Account settings.

14. Cookies and Tracking Technologies; Your Consent

14.1 We use essential, analytics/performance, functionality, and advertising cookies, and similar technologies such as pixels and tags. Where required by law, we present a consent tool allowing you to accept or decline non-essential technologies, and you can manage cookies at any time through our cookie settings (where available) or your browser. We honor opt-out preference signals as described in Section 9.2. For details, see our Cookie Policy (published on our website).

14.2 Consent to tracking. By continuing to use the website with these technologies enabled (and by accepting them where a consent tool is presented), you consent to our and our disclosed third-party providers' use of these technologies, including any collection of usage, device, and interaction data. This consent is intended to satisfy the party-consent and related requirements of the California Invasion of Privacy Act (CIPA), state wiretap and pen-register/"trap-and-trace" laws, and the ePrivacy rules. You may withdraw consent for non-essential technologies at any time through our cookie settings.

14.3 Email tracking by our customers. Our customers may enable open- and click-tracking in the emails they send using the Services. Our customers are responsible for any notice or consent required for that tracking; this Policy governs only our own website and Services, not our customers' outreach.

15. Security

We use industry-standard technical and organizational measures, including encryption in transit and at rest (SSL/TLS), access controls on a need-to-know basis, and firewalls, monitoring, and periodic security assessments. You are responsible for safeguarding your account credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification. In the event of a personal-data breach, we will notify affected individuals and competent supervisory authorities without undue delay and, where required, within 72 hours, consistent with GDPR Articles 33–34 and applicable US state breach-notification laws.

16. Children's Privacy

The Services are intended for business professionals and are not directed to individuals under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

17. Changes to This Policy

We may update this Policy. For material changes, we will provide notice via the website or email at least 30 days before they take effect. The "Last Updated" date above reflects the latest revision; your continued use after the effective date constitutes acceptance.

18. Contact Us

• Privacy requests / questions: [email protected]
• Opt out / "Do Not Sell or Share": our opt-out page (linked in our website footer) or [email protected]
• Postal: Success AI Holdings Inc, 7901 4th St, STE 300, St. Petersburg, FL 33702, USA
• Supervisory authority: you may lodge a complaint with your local DPA (EU) or the ICO (UK).

‍