Privacy Policy

This Privacy Policy explains how Kifas Labs Ltd. ("Active Manager", "we", "us") handles personal data when you visit https://www.activemanager.ai, use the Active Manager app at https://app.activemanager.ai, or are contacted by one of our customers through Active Manager.

We have tried to keep it short and plain. If something is unclear, write to support@activemanager.ai.

The short version

• Active Manager is a cloud service that runs LinkedIn and email outreach for our customers, using the LinkedIn account and mailbox each customer connects.
• For our website visitors and our customers, we decide how their data is used. We are the controller.
• For the leads and prospects our customers import and contact, the customer is the controller and we process that data on the customer's instructions. We are a processor.
• We store LinkedIn passwords, session data and mailbox credentials encrypted with AWS Key Management Service (KMS), and use them only to run the actions you schedule.
• We do not sell personal data. We do not use Gmail data for advertising, and we do not use it to train general AI models.
• Analytics on our website and in the app (Google Analytics and Microsoft Clarity) load only after you accept them in the cookie banner.
• Our systems run in the United States (AWS and Supabase, region us-east-1).

Who we are

Kifas Labs Ltd. is a company incorporated in Israel, with its registered address at Shikma 2, Dvira, Israel.

• Privacy questions and requests: support@activemanager.ai
• Product support: support@activemanager.ai
• Legal notices and Data Processing Agreement (DPA) requests: support@activemanager.ai
• Our representative in the EU and the UK (Article 27 GDPR and UK GDPR): We have not appointed a representative in the EU or the UK

Whose data this policy covers

• Website visitors: people who browse https://www.activemanager.ai or send us a demo request or contact form.
• Customers and users: people who create an Active Manager account, including members of a customer's team.
• Prospects: people a customer adds to Active Manager and contacts through it, for example by a LinkedIn invitation, LinkedIn message or email. Most prospects have never signed up to Active Manager. The section for prospects explains how this works.

Controller and processor

We are the controller for data about website visitors and about our customers' accounts: sign-up details, billing, support, security and how the service is used.

Our customer is the controller for the prospect data they bring into Active Manager or collect through it: lead lists, LinkedIn profile details, email addresses, messages, notes, tags and campaign results. We process that data only to provide the service to that customer, as set out in our Terms and Conditions and our Data Processing Agreement. We do not use one customer's prospect data for another customer, and we do not build a shared database of prospects.

What we collect

When you visit our website

• Contact and demo requests. Your name, work email, company, team size and message. The form sends these to our team by email (through Resend). To stop spam, the form has a hidden field that only bots fill in, and it limits how many requests one IP address can send. We hold your IP address in memory only for that check and do not store it.
• Analytics, only if you accept. If you accept analytics cookies, Google Analytics 4 and Microsoft Clarity collect how you use the site: pages viewed, clicks, scrolling, approximate location from your IP address, device and browser type, and referring site. Clarity also records session replays and heatmaps of mouse movement, clicks and scrolling, on the website and in the app, where all on-screen text is masked. If you are signed in, we link these to your internal account ID so we can understand the path from the website to sign-up. We do not run these tools until you accept, and you can change your choice at any time with the "Cookie settings" link in the footer. See our Cookie Policy.
• Technical data. Our host (AWS Lightsail, US) receives your IP address, browser details and the pages requested, as any web server does, to deliver the site and keep it secure. Our fonts are served from our own server, so loading the site does not contact a font provider.

When you create and use an account

• Account details. First and last name, email address, password (stored by our authentication provider as a one-way hash; we never see it), time zone, country, whether you accepted the Terms, and whether you agreed to receive marketing emails. If you sign up with Google, we receive your name, email address and profile picture from Google.
• Security data. Two-factor authentication settings, sign-in times, IP addresses and audit records of sensitive actions. On sign-up, sign-in and password reset, Cloudflare Turnstile checks that you are not a bot.
• Your LinkedIn connection. To run LinkedIn actions for you, we collect:
  • your LinkedIn login email and password, and, if you give it, your authenticator (two-factor) key, or, if you connect through our browser extension, your LinkedIn session cookies and browser user-agent;
  • verification codes you type in while connecting;
  • the browser session we keep for your account (cookies and site storage for linkedin.com);
  • your LinkedIn profile details: member ID, name, photo, headline, LinkedIn plan (such as Premium or Sales Navigator), connection count and account creation year;
  • the health of your account as we see it, for example security checks or limit notices shown by LinkedIn.
• Your mailbox connection. For a mailbox connected by SMTP/IMAP: the server addresses, username and password (often an app password). For a Gmail or Google Workspace mailbox connected with Google sign-in: an OAuth access token and refresh token, and your mailbox address. See Google user data.
• Your outreach content and settings. Campaigns, sequences, message and email templates, attachments, working hours, limits, tags, custom fields, blacklist and data-scrubber rules, webhooks, API keys and integration settings (for example HubSpot).
• Billing data. Your plan, subscription status, and transaction history. Paddle, our reseller, collects your payment details directly; we never see or store your full card number. Paddle shares with us your name, email, country, the plan purchased, a card summary (such as brand and last four digits) and invoices.
• Usage data. How you use the app (features used, errors, performance), and records of the actions the service performs for you (for example "invite sent" or "email delivered").
• Support conversations. Messages you send us by email or through the in-app chat (Crisp).

Data about prospects (on behalf of our customers)

When a customer uses Active Manager, the service processes data about their prospects, such as:

• profile details visible to the customer's LinkedIn account: name, headline, job title, company, location, profile URL and photo, connection status, and whether the profile is open or Premium;
• details the customer uploads (for example a CSV file) or types in: email addresses, phone numbers, notes, tags and custom fields;
• work email addresses found through our email finder (Prospeo and Findymail) when the customer uses that step;
• LinkedIn messages and emails exchanged between the customer and the prospect, and events such as "invitation accepted", "replied", "email bounced" or "unsubscribed";
• if the customer turns on optional email open tracking, where available, whether an email was opened.

The LinkedIn inbox in Active Manager shows only conversations with the customer's leads. For email, we store a reply only when it answers an email sent through Active Manager (see Google user data).

How we use data, and our legal bases

Where the GDPR or UK GDPR applies, we rely on the legal bases below. This table covers data for which we are the controller.

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see Your rights).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The automatic safety limits described above only slow down or pause activity on your accounts.

AI features

Active Manager uses Anthropic's Claude models for some features:

• Message improver: when you ask it to, the text of your draft message is sent to Claude to suggest a rewrite. Your variables and placeholders stay in place.
• Reply classification: the text of replies your leads send (on LinkedIn or by email) is sent to Claude to label them, for example "interested", "not now", "out of office" or "unsubscribe". This powers inbox filters and decides whether a reply stops the sequence.
• Lead scoring (ideal customer profiles): if you use this feature, lead profile details are sent to Claude to score leads against the profile you describe.

We send only what the feature needs. Anthropic processes this data as our sub-processor under its commercial terms, which do not allow it to use our data to train its models. We do not use your data or your prospects' data to train AI models.

AI suggestions can be wrong. You decide what to send.

Google user data

This section applies when you sign in with Google or connect a Gmail or Google Workspace mailbox to Active Manager.

What we access. With Sign in with Google, we receive your name, email address and profile picture, and use them only to create and sign in to your account. When you connect a Gmail mailbox, Google asks you to allow Active Manager to send email on your behalf and to read your mailbox. Google's consent screen shows the exact permissions.

How we use Gmail data. Only to provide the features you use:

• to send the emails your campaigns schedule and the replies you write in Active Manager, from your own address;
• to read new incoming messages and find those that answer an email sent through Active Manager, so we can show the reply in your Active Manager inbox, stop the sequence for that lead, detect bounces and out-of-office replies, and honour unsubscribe requests;
• to classify those replies with AI, as described in AI features.

What we store. We store your OAuth refresh token encrypted with AWS KMS. We read only messages received from the time you connect (at most two days earlier), never your mailbox history. For each email we send, and for each incoming message that answers one of those emails, we store message headers (such as Message-ID, sender, recipient, subject and date) and, for replies, the reply text without the quoted history. Incoming messages that do not answer an email sent through Active Manager are checked and discarded, not stored.

What we never do with Gmail data.

• We do not use it for advertising, including personalised, retargeted or interest-based ads.
• We do not sell it.
• We do not use it to train, develop or improve generalised or non-personalised AI or machine-learning models, ours or anyone else's.
• We do not use it to determine creditworthiness or for lending.
• We do not transfer it to anyone except as needed to provide or improve the features described above (for example to our hosting and AI sub-processors), for security, to comply with the law, or as part of a merger or acquisition with your notice.

Human access. Our staff do not read your Gmail data unless you give us explicit permission for specific messages (for example to help with a support request), it is necessary for security purposes such as investigating abuse, it is required to comply with the law, or the data has been aggregated and anonymised for internal operations.

Removing access. Remove the mailbox in Active Manager (Account settings → Email account) and we delete the stored token. You can also revoke access at any time from your Google Account at myaccount.google.com/permissions.

Limited Use. Active Manager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we share data

We share personal data only in these cases:

• Sub-processors and service providers that host, run or support Active Manager for us, under contracts that require them to protect the data and use it only for our instructions. They are listed below.
• Paddle, our online reseller and Merchant of Record. Paddle sells the subscription to you, handles payment, tax and invoices, and processes your payment data as an independent controller under its own privacy notice.
• LinkedIn and your email provider. Running the service means sending your actions and messages to LinkedIn through your LinkedIn account, and your emails through your own mailbox provider. They process that data under their own terms and policies.
• Integrations you turn on, such as HubSpot, webhooks or our API. We send data where you tell us to. The receiving service's own terms and privacy policy apply.
• Your team. If you join a team, the team's owner and managers can see and act on your campaigns, leads and statistics, as the team roles allow.
• Legal reasons. When the law requires it, or to protect the rights, safety or property of our customers, the public or us.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, data may transfer to the new owner, who must honour this policy. We will tell you before that happens.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Sub-processors

We will update this list before we add or replace a sub-processor that handles customer data. Customers receive at least 30 days' notice, as our Data Processing Agreement describes.

International transfers

We store and process data in the United States. If you are in the European Economic Area, the United Kingdom, Switzerland, Israel or another country with transfer rules, your data is transferred to the United States and to the other countries listed above.

We protect these transfers with the European Commission's Standard Contractual Clauses (and the UK Addendum or the Swiss amendments where they apply), or by relying on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, or on another lawful transfer mechanism. For transfers from Israel, we rely on the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, including the recipient's contractual commitment to protect the data. You can ask for a copy of the relevant safeguards at support@activemanager.ai.

How long we keep data

We may keep data longer when the law requires it, or to resolve a dispute or enforce our agreements. Prospect data is deleted when the customer deletes it, or when the customer's account is deleted.

Security

• LinkedIn credentials, authenticator keys, browser sessions, mailbox credentials and Google tokens are encrypted with AWS KMS envelope encryption, with a separate data key per account. Only the services that need them can decrypt them.
• All data is encrypted in transit (TLS) and at rest.
• Each customer's data is separated by access rules enforced in the database.
• Two-factor authentication is available for every account and required for our administrators.
• Staff access is limited to what is needed, and every time an administrator views an account as its user, it is recorded in an audit log.
• We use bot protection, rate limits and leaked-password checks on sign-in.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict or object to how we use it, including any processing based on legitimate interests and all direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting what we did before;
• complain to a data protection authority.

How to use them. You can update your profile, export your leads and campaign results as CSV, and delete your account from Account settings in the app. (If you have a paid subscription, cancel it first.) For anything else, email support@activemanager.ai. We may ask you to confirm your identity. We answer within one month (GDPR and UK GDPR), within 45 days (US state laws), or within the time the law where you live sets. You will not be treated differently for using your rights.

Data protection authorities. In the EEA you can complain to the authority in your country of residence or work. In the UK, it is the Information Commissioner's Office (ico.org.uk). In Israel, it is the Privacy Protection Authority. We would appreciate the chance to help first.

Israel. If the Protection of Privacy Law, 5741-1981, applies to you, you have the right to review personal data about you held in our databases and to ask us to correct or delete data that is inaccurate, incomplete, unclear or out of date. Write to support@activemanager.ai.

California and other US states

If the California Consumer Privacy Act (as amended by the CPRA) or a similar US state privacy law applies to you, this section adds to the rest of this policy.

Categories we collected in the past 12 months, from the sources and for the purposes described above:

• Identifiers (name, email, IP address, account ID)
• Customer records and commercial information (plan, transactions, billing details)
• Internet or network activity (app usage, website usage with consent, logs)
• Approximate geolocation (country, from IP address or your settings)
• Professional information (job title, company, LinkedIn profile details)
• Sensitive personal information: account login credentials (your Active Manager login, and the LinkedIn and mailbox credentials you give us to run the service)
• Inferences (reply classification and lead scores, used only inside your account)

We disclose these categories for business purposes to the service providers and parties listed in How we share data.

We do not sell or share personal information, as "sell" and "share" are defined by California law, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only to provide the service you asked for and to keep it secure, so the right to limit its use does not apply.

Your rights. You can ask to know what we collect, use and disclose; to access, correct or delete it; and not to be discriminated against for using these rights. You may use an authorised agent, who must show us your signed permission. Email support@activemanager.ai. If we decline a request, you can appeal by replying to our answer.

Where Active Manager processes prospect data for a customer, we act as that customer's service provider. Please send requests about that data to the customer, or to us and we will pass them on.

If you were contacted through Active Manager

If you received a LinkedIn invitation, a LinkedIn message or an email sent through Active Manager, it came from one of our customers, using their own LinkedIn account or mailbox.

• The customer is responsible for deciding to contact you and for having a lawful reason to do so. They are the controller of your data. We process it only on their behalf, to run their outreach.
• Where your data comes from. Usually from your LinkedIn profile as it appears to the customer's LinkedIn account, from lists the customer uploads, or, for a work email address, from our email finder provider (Prospeo and Findymail).
• What we hold. The data described in Data about prospects.
• To stop emails, use the unsubscribe link at the bottom of the email, or reply with "unsubscribe". Active Manager then stops emailing your address from that customer's account. A reply on LinkedIn or by email also stops that customer's automated sequence for you.
• To exercise your rights (access, deletion, objection and so on), the best route is to contact the person or company who wrote to you. You can also email support@activemanager.ai with the name of the sender if you know it and the email address or LinkedIn profile we should look for. We will pass your request to the customer, or customers, concerned and help them respond.

We do not use your data for our own marketing, we do not sell it, and we do not share it between customers.

Cookies

We use a few strictly necessary cookies and similar technologies, plus optional analytics only with your consent. Our Cookie Policy lists them and explains how to change your choice.

Marketing emails

We send product news and offers only if you agreed to them. Every marketing email has an unsubscribe link. Service emails, such as password resets and billing notices, are part of the service and continue while you have an account.

Children

Active Manager is a business tool for adults. It is not meant for anyone under 18, and we do not knowingly collect their data. If you think a child gave us personal data, write to support@activemanager.ai and we will delete it.

Changes to this policy

We will post any change on this page and update the date at the top. If a change is significant, we will tell customers by email or in the app before it takes effect.

Contact

Kifas Labs Ltd. Shikma 2, Dvira, Israel Privacy: support@activemanager.ai EU and UK representative: We have not appointed a representative in the EU or the UK