Effective September 4th 2026

Random Walk Labs Inc. ("Letterdrop", "we") operates letterdrop.com and provides a business-to-business market intelligence service that helps companies identify organizations evaluating products in their market, and the business contacts at those organizations.

This notice explains what personal data we handle, why, and what you can do about it. It covers three groups of people: our customers and website visitors, individuals whose data our customers send us from their own systems, and business contacts who appear in our market data. If you are reading this because you found your own professional information in our data, Section 3 is written for you.

1. Information we collect

From customers and website visitors

• Account data. Name, work email address and company, provided when you create an account or contact us.
• Billing data. Handled by our payment provider. We do not store card details.
• Usage data. IP address, browser type and version, pages visited, and the time and date of the visit.
• Support communications. Messages and records of correspondence with us.

From systems our customers connect

When a customer authorizes an integration with Salesforce, HubSpot or a similar platform, we receive the data that customer chooses to send. For that data we act as a processor and the customer decides what is shared and why. See Section 8 if you want that data accessed or deleted.

Market data about businesses and business contacts

Our product records include information about organizations and about the people who represent them in a professional capacity:

• Organization records: company name, website domain, and public company page URLs
• Professional name
• Employer, job title, and professional history
• Business location
• Work contact information, where our sources provide it
• Professional profile identifiers and URLs
• Other professional information relevant to understanding activity in a market
• Indicators we derive about how relevant an organization or contact is to a given market, and the date each record was collected or last checked

We do not collect home addresses, personal contact details, financial information, government identifiers, or information about anyone's private life. We do not collect special categories of data such as health, religion, political opinions or trade union membership, and we do not infer them. If information of that kind reaches us by accident, we remove it.

2. Where our market data comes from

We obtain professional and market information from commercial data providers and licensed data services we engage under written contract, and from professional and market information that is accessible without restriction. Our providers are contractually required to warrant that their collection methods comply with applicable law.

We do not use one customer's CRM data to build product records, and we do not send customer data to our data sources.

3. Information about business contacts in our market data

This section applies if your professional information appears in our market data. We are required to give you this information because we did not collect it from you directly.

Who is responsible. Letterdrop is the controller of this data. We decide what we collect, why, how long we keep it, and when it is deleted. Our customers do not make those decisions, and you do not need to contact them. Deal with us.

Why we hold it. We help businesses understand which organizations are evaluating products in their market so their sales teams can focus their outreach rather than contacting everyone. Your record may be included in results we provide to a customer whose criteria your organization matches.

Our lawful basis. We rely on legitimate interests under Article 6(1)(f) GDPR: our interest in operating this service, and our customers' interest in understanding their market. We have carried out and documented an assessment of whether those interests are outweighed by your rights, and we make that assessment available to customers and to data protection authorities on request. You can ask us for a summary.

Who sees it. Customers of our service whose criteria your organization matches, and the technology providers listed in Section 6. We do not sell our market data as a contact list, and we do not use it for advertising.

What we do not do. We do not market to you. We do not score, rate or profile you as an individual, and we do not assess your performance or your character. Nothing our service produces is an automated decision that has a legal or similarly significant effect on you. Anything you receive from one of our customers is that company's own outreach, sent under its own responsibility.

How long we keep it. For as long as the information remains current and useful for the purpose above. We check records periodically and delete those we can no longer verify.

Your rights, and the one that matters most. You can ask us for a copy of what we hold, correct it, delete it, restrict how we use it, or object to our use of it.

If you object or ask us to delete your record, we will do it. We will not ask you for a reason and we will not argue. We remove you from our data and from every customer's results, and we tell customers who already received your record. Email privacy@letterdrop.com and we will action it.

You can also complain to the data protection authority in your country. Contacting us first is usually faster, but you do not have to.

4. How we use information

To provide and operate the service, connect authorized systems, authenticate users, provide support, bill customers, monitor usage and security, send service notices, send marketing to business contacts who have a relationship with us, and comply with legal obligations.

We do not use customer data to train models that serve other customers, and we do not allow our AI providers to use data we send them to train their models.

5. Legal bases (EEA, UK and Switzerland)

• Performance of a contract — providing the service to our customers
• Legitimate interests — operating our market intelligence service as described in Section 3; security and fraud prevention; improving our product; marketing to business contacts
• Legal obligation — where the law requires us to keep or disclose information

You can object to any processing we base on legitimate interests. See Section 3 for market data and Section 8 for everything else.

6. Who we share information with

• Service providers who operate under contract for us
• Systems our customers connect and instruct us to exchange data with
• Authorities, where the law requires it
• A party to a merger, acquisition or similar transaction

We do not sell or share personal data as those terms are defined under the California Consumer Privacy Act. For personal data covered by United States state privacy laws we act as a service provider and do not use that data for our own purposes.

Our providers:

ProviderPurposeGoogle Cloud PlatformHosting, storage, logging and backupsMongoDB AtlasManaged application databaseOpenAIAI classification and summarization of resultsAnthropicAI classification and summarization of resultsGoogle (Gemini)AI classification and summarization of resultsStripePaymentsPostmarkTransactional emailCloudflareContent delivery and securityGoogle AnalyticsWebsite analytics

Our AI providers process data under business or API terms that prohibit using it to train their models. A current list of sub-processors is available at privacy@letterdrop.com.

7. How long we keep information

• Account data: for the life of the account, plus 30 days
• Billing records: 7 years
• Usage and log data: 6 months
• Data from connected systems: as the customer configures, and 30 days after disconnection
• Support correspondence: 12 months
• Market data: as described in Section 3

8. Your rights

Depending on where you are, you may have the right to access, correct, delete, restrict or port your personal data, to withdraw consent, and to object to processing. Email privacy@letterdrop.com. We respond within 30 days.

Which route applies depends on whose data it is:

• Your professional information in our market data — we are the controller and we handle your request ourselves. See Section 3.
• Your data in a customer's CRM or other system, which that customer sent to us — that customer is the controller and decides. Contact them directly, or tell us and we will pass your request to them.
• Your account, billing or website data — we handle it.

9. Cookies and tracking

We use cookies and similar technologies for authentication, session management, security and analytics. Essential cookies are required for the site to work. You can refuse others through your browser settings. We do not respond to Do Not Track signals, but we honour Global Privacy Control where the law requires it.

10. International transfers

We are based in the United States and process data there. For transfers from the EEA, the UK or Switzerland we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum or Swiss variations where those apply, and we apply appropriate safeguards.

11. Security

We use commercially reasonable technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and regular review. An independent third party tests our systems at least annually. Further detail is at letterdrop.trust.site.

12. Children

Our service is for business users. It is not directed at anyone under 16 and we do not knowingly collect their data. If you believe we have, email privacy@letterdrop.com and we will delete it.

13. Changes to this notice

We post updates here with a revised effective date. If a change is material we give notice by email or in the product before it takes effect.

14. Contact

Random Walk Labs Inc.
2261 Market St
San Francisco, CA 94114, USA

Privacy: privacy@letterdrop.com
Support: support@letterdrop.com

‍