Updated 16 October 2026
How we handle your data
Your portal, its database and the agents run on our server in London. Each client sees only its own records, and logins use a one-time link sent to your work email.
What we store
- Your accountName, work email and company, and a record of each login.
- Your onboarding answers and filesThe intake form, your product facts, exclusion lists and any files you upload to the portal.
- Your campaignsCopy you approve, the lead lists we build for you (name, title, company and work email of business contacts), replies to your campaigns and booked meetings.
- BillingInvoices and what each line covers.
- Site visitsPages viewed and buttons clicked on this website, with the country, city and network of the visit. No cookies are set, the IP address is dropped after the lookup, and visitors who send Global Privacy Control or Do Not Track are not counted.
Who processes it
| Provider | What it does for us |
|---|---|
| DigitalOcean | Hosts the client portal, its database and the agents, on a server in London (region LON1). |
| Vercel | Serves this website. |
| OpenRouter | Routes agent tasks to model providers, including Anthropic and Perplexity. |
| Smartlead | Sends campaign emails and holds the reply inbox. |
| MillionVerifier | Checks that an email address accepts mail before we send. |
| Apollo | Business contact data for lead lists. |
| CheapInboxes | Hosts the sending mailboxes on the domains you own. |
| Calendly | Booked meetings, only when you connect your account. |
| Google Workspace | Our own email. |
| Telegram | Alerts to our team about replies and approvals in your campaigns. |
| DB-IP | Country, city and network lookup for site visits, from a database file on our own server. IP geolocation by DB-IP (db-ip.com). |
Access
- Login links expire after one use. Sessions sit in a secure, HTTP-only cookie.
- The portal checks the client on every request, so one client cannot read another client's records.
- Our delivery team can see your records to run your campaigns and answer your questions.
Your requests
To get a copy of your data, correct it, or have it deleted, email hello@exponentialadvisory.io from the address on your account.
Limits
- We hold no ISO 27001 or SOC 2 certificate.
- Agents call hosted model APIs. They do not run on your own servers.