Prospecting touches personal data, so this page is written to be checked rather than admired. It sets out the legal basis we rely on, who is responsible for what, where your data physically sits, how it is deleted, and the certifications we do not hold.
B2B prospecting in the EU does not run on consent. It runs on legitimate interest under article 6.1.f of the GDPR: contacting a professional, at their professional address, about something plausibly relevant to their job, in a way they can stop at any time.
That basis is not a blank cheque. It holds only while the three conditions hold — the interest is real, the processing is proportionate to it, and the recipient's rights are not overridden. XP One is built so those conditions stay true: professional data only, signal-based targeting rather than indiscriminate volume, and an opt-out on every message.
| Role | Who | What it means in practice |
|---|---|---|
| Data controller | You, the user | You decide who to contact, why, and with what message. The purpose of the processing is yours, so the responsibility for it is yours. |
| Data processor | LEADSMIND AI LTD | We process that data on your documented instructions, to provide the platform, and for nothing else. We do not sell it, share it between accounts, or use it to build a database of our own. |
| Contract | DPA | A Data Processing Agreement is annexed to the Terms of Service and applies automatically from the day you subscribe — no form to request, no negotiation cycle. Read it: the DPA. |
Because you are the controller, some duties are yours and cannot be delegated to a supplier. We would rather write them down here than let you discover them in a complaint.
Each communication you send must give the recipient a clear, simple way to refuse further contact — on every channel, in every template, including the first message. Writing that line into your templates is your responsibility.
If someone asks not to be contacted again, that request must be honoured immediately and permanently, across all your campaigns and channels — not just the one they replied to.
Use the platform for B2B outreach that is genuinely relevant to the recipient's role. Consumer marketing, and messages with no plausible link to the person's work, fall outside the legal basis and outside our Terms.
Access, rectification, erasure and objection requests from people in your lists come to you as controller. We support you on the technical side and act on your instructions, within the terms of the DPA.
This page is a plain-language summary. The binding text is the Privacy Policy and the DPA.
This is the list annexed to the DPA. Locations are stated as a matter of fact about where each supplier runs, not as a marketing promise about data residency — we run no formal residency programme, and we are not going to imply one.
| Sub-processor | Role | Where it runs |
|---|---|---|
| Amazon Web Services | Database hosting | Frankfurt, Germany |
| DigitalOcean | Application hosting | London, United Kingdom |
| Stripe | Payments and billing | As set out in the DPA |
| Sentry | Error monitoring | As set out in the DPA |
| Mailjet | Transactional email delivery | As set out in the DPA |
| Unipile | Messaging connectivity | As set out in the DPA |
| FullEnrich | Contact data enrichment | As set out in the DPA |
| Checknumber | Phone number verification | As set out in the DPA |
Sub-processor list as annexed to the DPA. Transfers, safeguards and notice of changes are governed by that document.
Traffic between your browser, the Chrome extension and our servers runs over HTTPS. Storage, backups and network isolation rely on the managed infrastructure of the two hosting sub-processors above. Access to production data inside the company is limited to the people who need it to operate and support the service.
WhatsApp outreach in XP One works by driving a browser session on your own account. It is not an official integration, we are not a WhatsApp partner, and there is no certification behind it. Anyone telling you otherwise about a tool in this category is selling you a word that has no meaning here.
What follows from that, plainly: your WhatsApp account remains subject to WhatsApp's own terms and enforcement, sending behaviour is your responsibility as much as ours, and we will never describe this channel as certified or approved. What we do instead is pace it, restrict it to numbers verified as active, and keep the volumes low enough to look like the human conversation it is meant to be.
If that trade-off is not acceptable for your business, use LinkedIn and email only — they are complete channels in the platform on their own.
Security is not only about our servers. For a prospecting platform, the most likely damage is a restricted or lost LinkedIn account — so the anti-ban engine is a security control, not a marketing feature, and it cannot be turned off to go faster.
Hard ceilings on invitations per campaign, per day and per rolling week. Randomised delays between actions. A cooldown between campaigns. Quiet hours in both time zones. A watchdog on stuck tasks, a heartbeat that pauses everything if the extension goes silent, and a circuit breaker that stops after five consecutive failures.
The honest test of a data policy is what happens when someone leaves. Ours is deliberately boring:
Cancellation happens in the app. No retention call, no "are you sure", no support ticket to open, no form to email.
Your prospects, lists and campaign history are exported as CSV and JSON, in formats you can open with anything.
Server-side deletion happens within 7 days of the request — not "eventually", not "on the next cleanup cycle".
A signed deletion receipt is issued so the erasure is documented, which is exactly what you will need if a prospect asks you to prove it.
Retention periods for the records we must keep — invoices and accounting documents, for instance — are set out in the Privacy Policy.
Security pages usually inflate. This one deflates, because a claim you cannot evidence in a due-diligence call is worse than no claim at all.
Anything we are working on appears on the roadmap, labelled with its real status.
Send the details to contact@xp-one.io. Give us a reasonable window to fix it before publishing, do not access or alter anyone else's data while testing, and we will credit you publicly if you want the credit.
XP One