Privacy Policy

Quick Summary

• Data We Collect: Names, email addresses, phone numbers, device information, IP addresses, and form submissions through our JavaScript pixel.
• How We Use Data: To provide and enhance our services, ensure security, track marketing analytics, and communicate with users.
• Your Rights: Access, rectify, delete, restrict, and object to the processing of your personal data.
• Data Sharing: We share data with trusted service providers and for legal reasons. We do not sell your information for money. We do share identifiers with advertising platforms for cross-context behavioral advertising, which some laws treat as a “sale” or “share”; you can opt out at our Do Not Sell or Share page.
• Visitor Identification on cometly.com: Our website uses RB2B, a business-to-business visitor identification service, to match visitors located in the United States with business contact details (such as name, company, work email, and LinkedIn profile) so our sales team can follow up. See Section 4.2. You can opt out at app.retention.com/optout.
• Security Measures: We use encryption and other security protocols to protect your data.
• Contact Us: Reach out via privacy@cometly.com for any privacy-related inquiries.

1. Who We Are

Cometly provides a marketing analytics and attribution platform that helps businesses track website visitor activities, capture form data, attribute events to their original marketing sources, and send event data back to ad platforms for optimization. We primarily operate in and host data in the United States, using sub-processors (such as Amazon Web Services, Stripe, etc.) for infrastructure and service delivery. We may process and store your data in the U.S., where privacy laws may differ from those in your jurisdiction. Cometly is dedicated to respecting the privacy of individuals and ensuring compliance with global privacy laws. This commitment is reflected in our practices outlined below.

1.1 Controller vs. Processor

• Cometly as Data Controller: When we collect personal data from individuals directly (for example, site visitors signing up for a Cometly account or newsletter), we act as the data controller under applicable data protection laws.
• Cometly as Data Processor (or “Service Provider”): When our customers (as controllers) use our platform to process personal data relating to their own end-users (e.g., website visitors, leads, or customers), Cometly acts as a processor. In such scenarios, customers must ensure they have the appropriate legal bases, consents, or notices in place for such data processing.

2. Definitions

The following terms have specific meanings in this Privacy Policy:

• “Personal Data” or “Personal Information”: Any information that identifies or relates to an identifiable individual, such as name, email address, IP address, or device identifiers.
• “Processing”: Any operation or set of operations performed on personal data, such as collection, storage, use, sharing, or deletion.
• “Data Controller”: The entity that determines the purposes and means of processing personal data. For example, Cometly acts as the data controller for data collected directly from users.
• “Data Processor”: The entity that processes personal data on behalf of the data controller. For example, Cometly acts as the data processor for customers using our platform to process their own users' data.
• “Service Providers”: Third-party vendors contracted to perform specific functions (e.g., hosting, analytics, payment processing) on behalf of Cometly.
• “Cookies”: Small text files stored on a user’s device to collect information about their activity on our Services.
• “Aggregated Data”: Data that is combined with other data and does not directly or indirectly reveal an individual’s identity.
• “Anonymized Data”: Data that has been processed to remove personal identifiers, rendering it no longer identifiable.
• “Standard Contractual Clauses (SCCs)”: Legal mechanisms approved by the European Commission for transferring personal data outside the European Economic Area (EEA).
• “Sensitive Data”: Data that is subject to heightened protections under applicable laws, such as health information, biometric data, or data revealing racial or ethnic origin.
• “DSAR” (Data Subject Access Request): Requests made by individuals to access their personal data held by an organization.

3. Scope of This Privacy Policy

This Privacy Policy explains how Cometly collects, uses, and protects personal data in the following contexts:

Website Visitors (Controller Role):

• Personal data collected when you visit www.cometly.com and subdomains (e.g., help.cometly.com), including cookies, analytics, and contact forms.
• Marketing interactions, such as subscribing to newsletters or downloading resources.

Service Users (Processor Role):

• Data collected through our SaaS platform, such as event tracking and form submissions configured by customers.
• When customers use Cometly to process their end-user data, they remain the data controllers, and we act as a data processor. Customers are responsible for ensuring their use of our platform complies with applicable privacy laws (e.g., obtaining consent from their end users).

Exclusions:

• This policy does not cover third-party websites or services not owned or controlled by Cometly, even if they link to or integrate with our Services.
• Cometly is not responsible for the data practices of these third parties.

By interacting with our website or using our Services, you acknowledge and agree to the scope of this Privacy Policy.

4. Information We Collect

4.1 Information You Provide Directly

Account & Subscription Data:

When you sign up for a Cometly account or subscribe to our paid plans, we collect:

• First name, last name, full name, email address, phone number, company name, and billing information (e.g., billing address).

Payment Data:

• Payment details (e.g., credit card numbers) are processed securely by Stripe or other payment processors. Cometly does not store full card numbers or bank account details on our hosting providers’ infrastructure.

User Communications & Support:

If you contact us through email, chat, or support tickets, we collect:

• The content of your message and any attachments.
• Contact details you provide for response purposes (e.g., email address).

Community & Testimonials:

• If you voluntarily provide testimonials or engage in discussions in Cometly-managed forums (e.g., Facebook, Skool), your contributions may be publicly visible.
• To request removal, email privacy@cometly.com.

4.2 Information Collected Automatically

Device & Usage Data:

• We (or our service providers) collect data such as IP addresses, browser type, device identifiers, screen resolution, timestamps, referring URLs, and the full URL of pages visited, including query-string parameters (which may contain click identifiers or, where a customer’s website places them there, an email address or phone number).

Cookies & Tracking Technologies:

• Our Services use first-party cookies, pixels, and related technologies to remember user sessions, perform analytics, and personalize experiences. Refer to our Cookies Policy for details.

Fingerprinting and Unique Identifiers:

• We use fingerprinting techniques to collect technical attributes (e.g., browser type, device identifiers, screen resolution, installed fonts, and plugins) to create unique identifiers. We use these identifiers to recognize returning visitors across sessions for attribution reporting, and secondarily for fraud prevention. The fingerprint may be associated with a contact record when an email address or phone number is later captured, and may qualify as personal data under applicable privacy laws.

Website Visitor Identification (cometly.com only):

• Our own website, cometly.com, uses RB2B (operated by Retention.com), a business-to-business website visitor identification service. When you visit cometly.com, the RB2B script collects your IP address, device and browser information, the pages you view, the referring URL, and a session identifier; stores first-party identifiers (cookie and local-storage keys prefixed “_reb2b”) on your device; and reads certain existing cookies where present (for example HubSpot’s hubspotutk and Meta’s _fbp and _fbc). RB2B and its identity-resolution partners (including LiveIntent) use cookies, device identifiers, hashed email addresses, and IP addresses to associate your visit with other information they or others already hold about you, and may return to us business contact information that can include your name, company, job title, business email address, and LinkedIn profile URL.
• Scope: RB2B performs an IP-based geolocation check and only attempts person-level identification for visitors located in the United States. RB2B is not deployed inside the Cometly application or through the Cometly pixel installed on our customers’ websites; this section applies only to visitors of cometly.com.
• Purpose: We use the returned business contact information to understand which companies are evaluating Cometly and to follow up by email or other sales outreach, as described in Section 5. We do not use it to make decisions that produce legal or similarly significant effects about you.
• Opt-out: You may opt out of RB2B’s identification network at app.retention.com/optout, and California residents may also use RB2B’s “Do Not Sell My Info” form at app.retention.com/ccpa_details. You may also ask us to delete any record we received about you through our DSAR page. RB2B’s own practices are described in its privacy policy.

Consent-Based Pixel Loading:

• Customer Responsibility: Cometly’s JavaScript pixel is designed to integrate seamlessly with your website. It is the sole responsibility of our customers to implement and manage user consent mechanisms in compliance with applicable laws. This includes obtaining, recording, and managing user consents before enabling tracking and data collection via the pixel. To learn how to gate Cometly behind user consent, please see our user consent help center article.
• Integration Guidance: Customers should ensure that the pixel is configured to activate only after obtaining explicit user consent where required. This aligns with our commitment to supporting compliance, but the execution of consent management lies entirely with the customer.
• Reference to Terms of Service: For detailed responsibilities regarding consent management, please refer to our Terms of Service.

Form Field & Event Data:

• If you integrate our JavaScript pixel on your website, we automatically capture form field changes for fields such as first name, last name, email, phone number, and full name. This information is updated on the Contact within our system.
• We prohibit sending any sensitive data (e.g., health, biometric) and may suspend accounts that violate this rule.

4.3 Third-Party Sources

CRM & Workflow Integrations:

• We may receive lead or customer data from customer-configured CRMs (e.g., HubSpot, Salesforce) or workflow tools (e.g., Zapier) via webhooks.

Ad Platforms:

• We may receive campaign or performance data (like click IDs, hashed identifiers) from Google Ads, Meta (Facebook), TikTok, LinkedIn, etc., to help measure and optimize advertising.

4.4 Sensitive or Special Categories of Data

• We do not intentionally collect or process special categories of personal data (e.g., health, biometric, precise geolocation) and instruct customers not to send such information to us.

5. How We Use Your Information

We use personal data to:

Provide & Improve Services:

• Enable you to access and use our SaaS platform, track marketing analytics, and measure attribution.
• Handle billing and subscription matters (via Stripe).
• Develop new features and enhance user experience.

Personalization:

• Tailor the Services, including relevant insights, suggestions, or advertising based on usage and profiling data.

Security and Fraud Prevention:

• Detect and prevent fraudulent activities by analyzing user behavior and technical data.

Communications:

• Respond to inquiries, send service updates, or provide customer support.
• With consent where required, send newsletters, offers, or product announcements.

Compliance & Protection:

• Detect and prevent fraud, ensure security, and enforce our Terms of Service.
• Comply with legal obligations or respond to lawful requests from authorities.

Business Development & Sales Outreach (cometly.com visitors):

• Identify the businesses, and where available the individual professionals, visiting cometly.com through the RB2B visitor identification service described in Section 4.2, so that our sales team can understand interest in Cometly and reach out with relevant information. You can object to this outreach at any time by replying to any message, emailing privacy@cometly.com, or using the opt-out links in Section 4.2.

Machine Learning & AI:

• Provide AI-assisted analysis of your workspace data (which may include personal data) through our model providers, as described in our AI Policy. We do not use personal data to train our own or third-party models.

Beta or Pre-Release Features:

• If you opt into Beta features, you acknowledge these features may be less mature or stable and usage is at your own risk. Beta Services are provided "as is" and may contain bugs or errors. Cometly is not liable for issues arising from Beta Service usage.

5.1 Data Breach Notification

In the event of a data breach that compromises personal data, we will notify affected users without undue delay and within any timeframe required by applicable law, including GDPR where applicable. Notifications will include the nature of the breach, the data affected, and the measures we are taking to address it.

6. Legal Bases for Processing (EEA/UK/CH)

For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases for processing personal data:

• Consent: For certain marketing communications or non-essential cookies.
• Contractual Necessity: For providing the SaaS features you subscribe to.
• Legitimate Interests: For fraud prevention, analytics, business improvement, and business-to-business lead identification on cometly.com (see Section 4.2; person-level identification is limited to visitors located in the United States), in each case balanced against your rights and freedoms.
• Legal Obligations: For recordkeeping, responding to lawful data access requests.

7. When We Share Personal Information

We do not sell your information for money. We do share identifiers with advertising platforms for cross-context behavioral advertising, which some laws treat as a “sale” or “share”; you can opt out at our Do Not Sell or Share page. We may share data as follows:

Service Providers/Sub-Processors:

• We use third-party vendors (e.g., AWS, Stripe, Intercom, HubSpot) to support our operations. They only process personal data under written agreements that require data protection. Our Sub-Processor List details current providers. We will notify customers of any new sub-processors at least 30 days prior to their engagement, allowing time for objections.
• Vetting Process: We review the data protection terms of our service providers before engaging them.

Advertising & Analytics Partners:

• We may share hashed or matched data with platforms like Meta, Google, TikTok, or LinkedIn to measure or improve ad campaigns, subject to compliance with privacy laws and your consent where required.

Visitor Identification Partners:

• When you visit cometly.com, the technical and usage data described in Section 4.2 (IP address, device information, pages viewed, and existing cookie identifiers) is shared with RB2B and, through RB2B’s script, with its identity-resolution partners (including LiveIntent) so that they can match your visit to business contact information they already hold and return it to us. Some U.S. state laws may treat this as a “sale” or “share” of personal information; see Section 13 and the opt-out links in Section 4.2.

Business Transfers:

• If Cometly undergoes a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction.

Legal & Regulatory:

• We may disclose personal data to comply with applicable laws, respond to lawful requests, or protect Cometly’s rights or the safety of others.

Affiliates & Referral Partners:

• If you join our affiliate program, affiliates see limited summary data (e.g., number of referrals, commissions) but do not access individual users’ personal data.

Consent:

• If you give explicit consent or direct us to share your data with a third party.

8. International Data Transfers

8.1 Data Hosting in the U.S.

We may process and store your data in the United States, where privacy laws may differ from those in your jurisdiction. By using our Services, you consent to such transfers, storage, and processing of your data in the U.S. and other jurisdictions.

8.2 Transfers from EEA/UK/Switzerland

We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers from the European Economic Area (EEA) to ensure compliance with the GDPR. In addition to SCCs, we implement supplementary measures such as encryption, pseudonymization, and data minimization to enhance data security and privacy. For more details, see our Data Processing Addendum (DPA) or contact privacy@cometly.com.

8.3 GDPR/UK Representative via Prighter

We have appointed Prighter Group with local partners as our privacy representative for the EU and UK. You can submit GDPR/UK GDPR-related requests via Prighter Portal.

9. Cookies & Similar Technologies

We use first-party cookies, pixels, and other tracking technologies for authentication, analytics, marketing, and personalization. Some cookies are strictly necessary (for service functionality), while others are optional (e.g., for analytics or advertising) and may require consent in certain jurisdictions.

cometly.com does not currently display a cookie consent banner. You can control cookies through your browser settings and the opt-out tools described in our Cookie Policy. Customers who deploy the Cometly pixel on their own websites are responsible for obtaining any consent required in their jurisdiction.

For more information, including a full list of cookies and how to manage them, please review our Cookies Policy.

In addition to cookies and pixels, we may use device fingerprinting to enhance tracking accuracy and improve attribution reporting. Unlike cookies, fingerprinting is not stored on your device but instead relies on analyzing your device’s unique configuration. Refer to Section 4.2 Information Collected Automatically for more information.

cometly.com also loads the RB2B visitor identification script described in Section 4.2. RB2B stores first-party identifiers (cookie and local-storage keys prefixed “_reb2b”) on your device, and its identity partners (for example LiveIntent at liadm.com, usbrowserspeed.com, and alocdn.com) may set third-party cookies in your browser for cookie synchronization. You can opt out of RB2B at app.retention.com/optout and block or delete these cookies as described in our Cookie Policy.

Do Not Track / Global Privacy Control: Our Services currently do not respond to Do Not Track (DNT) or Global Privacy Control (GPC) signals due to the lack of a consensus standard. If that changes, we will update this Privacy Policy accordingly.

10. Data Retention & Deletion Policy

10.1 Retention Periods

We retain personal information only as long as necessary to fulfill the purposes for which it was collected or to comply with legal, contractual, or regulatory obligations. For example:

• Account Information: Retained while your subscription/account is active, plus a reasonable period (e.g., up to 90 days) after cancellation for auditing, billing disputes, or compliance.
• Billing Records: May be retained for 7 years (or as required by tax, accounting, or other laws).
• Anonymized/Aggregated Data: We may keep usage statistics or aggregated metrics indefinitely to improve our Services.
• Visitor Identification Records: Business contact details returned by RB2B for cometly.com visitors (Section 4.2) are kept in our CRM and sales tools for as long as they remain relevant to our sales and marketing activities, and are deleted or suppressed on request (see Section 10.2).
• Customer Data Upon Termination: Upon termination of your account, we will handle your Customer Data in accordance with this Data Retention & Deletion Policy to comply with legal obligations or for legitimate business purposes.

Retention Exceptions:

• Legal Obligations: We may retain certain information to comply with legal requirements such as tax laws, anti-money laundering regulations, or other governmental requests.
• Dispute Resolution: Data may be retained to resolve disputes or enforce our agreements.

10.2 Requesting Deletion

• Deletion Requests: If you want to delete your account or personal data, contact us at privacy@cometly.com or use our DSAR page.
• Response Time: We will respond to verified data deletion requests within 30 days, unless a longer period is permitted by law. Some data may be retained to satisfy legal, security, or contractual requirements.
• Inactive Accounts: We may delete or anonymize data for accounts that have been inactive for an extended period (subject to legal or contractual obligations).
• Exceptions: We may retain certain information to comply with legal requirements, resolve disputes, or enforce our agreements. Once retention is no longer necessary, we securely delete or anonymize the data.

Detailed Instructions for Data Portability:

• How to Request: Submit a data portability request via our DSAR page or email privacy@cometly.com.
• Format of Data: We will provide your personal data in a structured, machine-readable format such as JSON or CSV.
• Verification: We will verify your identity before processing your request to ensure data security.

11. Security Measures

We use industry-standard technical and organizational measures to safeguard personal data from unauthorized access, alteration, or disclosure. This includes:

Encryption:

• In Transit: TLS 1.2+ encryption for data transmitted between your device and our hosting providers’ infrastructure.
• At Rest: AES-256 encryption for data stored on our hosting providers’ infrastructure.

Access Controls:

• Role-based permissions to restrict access to personal data based on job responsibilities.
• Multi-factor authentication for Cometly staff accounts and administrative access.

Regular Security Audits:

• Conduct periodic security assessments and automated vulnerability scanning to identify and mitigate potential threats.

Staff Training & Policies:

• Regular training programs for employees on data protection, security best practices, and incident response procedures.

No method of transmission or storage is completely secure. If you suspect unauthorized access to your account, contact us immediately at support@cometly.com.

12. Public Community Forums

We operate or participate in communities hosted on third-party platforms (e.g., Facebook, Skool). Any content posted there (questions, testimonials) may be visible to other members. To request removal, please email privacy@cometly.com. We will remove posts consistent with our legal and contractual obligations.

13. US State Privacy Rights

Various U.S. states (e.g., California, Colorado, Connecticut, Utah, Virginia, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and others) have enacted privacy laws that grant specific rights to residents regarding their personal data. Cometly strives to comply with these laws and offers the rights described below. If you reside in a state with privacy legislation not explicitly listed here, we will apply substantially similar principles to the extent required by applicable law.

13.1 California Privacy Notice

If you are a California resident, you may have certain rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”):

• Right to Know: You can request what personal information we collect, use, disclose, or “sell/share.”
• Right to Access: Request a copy of your personal information in a portable format.
• Right to Delete: Ask us to delete personal data we have about you, subject to exceptions.
• Right to Correct: Request correction of inaccurate personal data.
• Right to Opt Out of “Sale” or “Sharing”: If we “sell” or “share” personal information for cross-context behavioral advertising, you can opt out at /dsar-opt-out.
• Right to Non-Discrimination: We will not discriminate if you exercise these rights.

We may use browser or device fingerprinting for cross-context behavioral advertising. If you wish to opt out, visit our 'Do Not Sell/Share' link at /dsar-opt-out.

cometly.com also uses the RB2B visitor identification service described in Section 4.2, which matches visitors located in the United States to business contact information held by RB2B and its partners. To the extent this constitutes a “sale” or “sharing” of personal information under the CCPA/CPRA, you may opt out through our Do Not Sell or Share page, RB2B’s “Do Not Sell My Info” form at app.retention.com/ccpa_details, or RB2B’s network opt-out at app.retention.com/optout.

How to Exercise Your California Rights:

• Submit a Request: Visit /dsar-opt-out or email privacy@cometly.com.
• Verification Process: We will verify your identity to a reasonable degree before acting on your request.

13.2 Other State Privacy Laws

Residents of Colorado, Connecticut, Utah, Virginia, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and other states with privacy statutes in effect may have rights similar to those set forth in Section 13.1 (e.g., rights to know, access, delete, or correct personal data, and opt out of certain targeted advertising).

How We Comply:

• We maintain a DSAR (Data Subject Access Request) process allowing residents of these states to exercise similar rights.
• You can submit requests via our DSAR page or by emailing privacy@cometly.com.
• We will verify your identity to a reasonable degree before acting on your request.
• We will respond within applicable legal timeframes (generally 45 days, with the option to extend by 45 more days if reasonably necessary).

Right to Opt Out of Targeted Advertising:

• If the law in your state requires us to allow you to opt out of targeted ads, you can do so by emailing us at privacy@cometly.com or visiting our DSAR opt-out page.
• Where relevant, we will also honor Do Not Sell/Share signals or comparable technology if recognized by law or if feasible within our platform’s capabilities.

14. Your Choices & Rights

14.1 Global Rights (EEA/UK/CH)

If you are located in the EEA, UK, or Switzerland, you may have rights to:

• Access: Receive a copy of personal data we hold about you.
• Rectify: Correct inaccurate personal data.
• Erase: Request deletion of personal data in certain circumstances (“right to be forgotten”).
• Restrict or Object: Limit or oppose certain data processing activities.
• Portability: Obtain data in a structured, machine-readable format.
• Withdraw Consent: If processing is based on consent.

How to Exercise These Rights:

• Submit a Request: Email privacy@cometly.com or contact our EU/UK representative via Prighter Portal.
• Verification: We will verify your identity before processing your request.
• Data Portability Details: We provide your data in formats such as JSON or CSV upon request.

14.2 Marketing Communications

• Email: Unsubscribe via the link in marketing emails or contact us at support@cometly.com.
• SMS: Text “STOP” (or follow the instructions provided) to opt out of SMS campaigns. You may still receive transactional or administrative messages.

14.3 Do Not Track

We do not currently respond to Do Not Track (DNT) or Global Privacy Control (GPC) signals. See Section 9 Cookies & Similar Technologies for details.

15. Data Processing Addendum (DPA)

For business customers subject to GDPR, UK GDPR, or similar laws, we offer a Data Processing Addendum (DPA) that outlines our obligations as a processor (e.g., sub-processor disclosures, data breach notifications, etc.). If you need a DPA, please contact us at privacy@cometly.com. Where conflicts exist between this Privacy Policy and the DPA regarding data processed on your behalf, the DPA will prevail.

We maintain an up-to-date list of sub-processors used to process personal data, available at: Cometly Third-Party Sub-Processors. We will notify customers of material changes to our sub-processors list at least 30 days prior to the effective date of the change, either via email or through your account dashboard. Customers who object to the use of a new sub-processor may terminate their subscription as per Section 19.2 (Termination by You) of our Terms of Service.

16. Children’s Privacy

Our Services are not directed to individuals under 18. We do not knowingly collect data from children under 18. If you believe we have inadvertently collected data about a minor, please email privacy@cometly.com, and we will take appropriate steps to delete it.

17. Third-Party Links & Affiliate Programs

• Third-Party Links: The Services may link to third-party websites (e.g., social media, partner offers). We are not responsible for their practices. Before sharing personal data, review the third party’s privacy policy.
• Affiliate/Referral Programs: We have an affiliate/referral program. Affiliates see limited summary data (e.g., number of referrals, commissions) but do not access individual users’ personal data.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. If we make material changes, we will notify you (e.g., via email or by posting a prominent notice). The “Last Updated” date at the top indicates when this Privacy Policy was last revised. Your continued use of our Services after any changes means you agree to the updated policy.

19. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

EU/UK Representative: Handled by Prighter Group. Submit GDPR/UK GDPR-related requests at: Prighter Portal.

20. Privacy Contact

Our privacy lead is Matthew Pattoli, Co-founder, reachable at privacy@cometly.com. If you have any questions or concerns about our data practices, please contact:

21. Automated Decision Making and Profiling

21.1 Overview

At Cometly, we utilize automated data processing and profiling techniques to enhance our Services, improve security, and optimize user experience. These practices include fingerprinting, the collection of device information and IP addresses, and, on cometly.com, business-to-business visitor identification through RB2B (Section 4.2). Unlike some services, our profiling is not used to predict behaviors or make significant decisions that directly affect you.

21.2 Profiling Activities

• Fingerprinting: We collect various technical attributes (e.g., browser type, device identifiers, screen resolution, installed fonts, and plugins) to create unique identifiers for users. We use these identifiers to recognize returning visitors across sessions for attribution reporting, and secondarily for fraud prevention.
• Device and IP Logging: We record device information and IP addresses to monitor service usage, detect suspicious activities, and maintain the integrity of our Services.
• Visitor Identification: On cometly.com, the RB2B service matches technical data about your visit (IP address, device information, and cookie identifiers) against business contact databases to identify the company and, for visitors located in the United States, the individual professional visiting our site. The result is used only for sales and marketing follow-up and does not produce decisions with legal or similarly significant effects. See Section 4.2 for details and opt-out options.

21.3 Purpose and Logic

• Security and Fraud Prevention: To identify and prevent unauthorized access, fraudulent activities, and ensure the security of our platform.
• Service Optimization: To analyze how users interact with our Services, allowing us to improve functionality, performance, and user experience.
• Compliance: To comply with legal obligations and enforce our Terms of Service.

21.4 User Rights

• Right to Object: You have the right to object to profiling activities that significantly affect you. To exercise this right, please contact us at privacy@cometly.com.
• Right to Access: You can request access to the personal data we hold about you and obtain information about the profiling logic and purposes.
• Right to Human Intervention: While our profiling activities are not used to make significant decisions that affect you directly, you may request human intervention if you believe your data is being processed in a way that impacts you.

21.5 Data Protection Measures

• Technical and Organizational Measures: We implement appropriate measures (e.g., encryption, access controls) to ensure that profiling is conducted in a manner that protects your privacy and complies with data protection laws.
• Regular Reviews: All profiling activities are subject to regular reviews to ensure compliance and effectiveness.

21.6 AI Features

Cometly’s AI features (Agent, AI Ads Manager, AI Slack Reports, and the MCP server) are powered by Anthropic, xAI, and Voyage AI as sub-processors. When you use them, your prompt and the workspace data retrieved to answer it, which may include personal data such as contact names and email addresses, are sent to the provider solely to generate the response and are not used to train their models. Agent includes a limited set of update tools that edit contact, company, and event records only when you explicitly request it. See our AI Policy.

Disclaimer

This Privacy Policy is provided for informational purposes and does not constitute legal advice. If you have questions about your specific rights or obligations under state or federal privacy laws, please consult a qualified attorney.

Effective Date: September 30, 2026

By continuing to use our Services, you acknowledge that you have read and understood this updated Privacy Policy. If you have any questions or concerns, please contact us at privacy@cometly.com.