ColdDMs Privacy Policy

1. Our role and whom this policy covers

We decide how to use information for our own website, sales, customer accounts, billing, security, and support. For campaign data that a business customer supplies or directs us to handle, the customer generally decides the audience, purposes, content, and instructions. We process that data to provide the contracted services. In some circumstances, we may have separate responsibilities under applicable privacy law.

If you received an outreach message from one of our customers, that customer's privacy notice may also apply. Contact the business that sent the message for questions about its campaign. You may also contact us using Section 11.

2. Information we collect

Depending on your interaction with ColdDMs, we may handle the following information.

Please do not submit government IDs, financial-account credentials, health records, biometric information, children's information, or other highly sensitive data through an intake form or campaign unless we have expressly agreed on a secure, appropriate process. Do not send passwords through ordinary forms or email. Where access credentials are necessary, use the designated secure access method.

3. How we use information

We use information to respond to inquiries, assess whether our services fit your needs, and provide contracts, checkout, onboarding, provisioning, support, and billing. When included in your order, we use information to source and prepare accounts, configure and operate approved campaigns, and manage replies and opt-outs. We also use information to measure service performance, protect accounts and infrastructure, troubleshoot issues, prevent fraud, abuse and unwanted messages, meet legal obligations, and maintain business records.

We may use aggregated or de-identified statistics to understand and improve our services when the information cannot reasonably identify an individual. We do not use a customer's private campaign data to send unrelated campaigns for another customer. Submitting an onboarding form alone does not authorize us to launch outreach. Payment, the applicable signed agreement, customer approvals, and operational readiness are separate steps.

For direct marketing about ColdDMs, we use contact information and preferences as permitted by applicable law. You can unsubscribe from marketing email using its unsubscribe link or by contacting us. Transactional, security, and service messages may still be necessary for an active account.

If you receive a message from a customer's campaign, you can follow the opt-out instructions in the message or contact the sender. We use suppression information to avoid sending further messages where required.

4. Instagram, account sourcing, and warm-up

Where your order includes account sourcing, profile preparation, or warm-up, we process the information needed to obtain, assess, configure, secure, and monitor those accounts. This may include supplier and transfer records, account identifiers, configuration, access permissions, activity, readiness, warnings, and incident reports. We may share the minimum necessary information with authorized account suppliers and infrastructure providers to deliver those services. You may contact us about the suppliers involved in your ordered service and the extent of their access.

Instagram and Meta set their own rules for accounts, automated access, data collection, and messaging. Their policies and enforcement can change. Account sourcing, warm-up, or a slower sending pace does not guarantee permission to automate, that an account will remain available, or that a message will be delivered.

We may pause, limit, or stop processing when a platform restriction, consent concern, security signal, or legal issue requires review. Customers must provide accurate instructions and avoid unlawful, deceptive, harassing, or unauthorized outreach. The applicable service agreement and platform terms govern acceptable use and the allocation of responsibilities.

5. Who receives information

We disclose information as needed for the purposes described in this policy. Recipients may include:

• Authorized personnel and contractors.
• Hosting, security, analytics, and support providers.
• Customer relationship management and communications providers.
• Payment and electronic-signature providers.
• Account sourcing, proxy, and infrastructure providers when included in the ordered service.
• The relevant customer and its authorized users.
• Regulators or other parties when required by law or necessary to protect rights and safety.

We may transfer information in a business transaction subject to appropriate safeguards. Our providers may handle information in different countries. We require them to use information for authorized purposes and apply appropriate protections. Third-party sites and services have their own privacy policies.

We do not sell customer campaign lists or message contents as a product. You may contact us using Section 11 about the use of your information for advertising or to exercise an applicable opt-out right.

6. Cookies and website analytics

Our website and service may use cookies and similar technologies for essential operation, security, preferences, measurement, and, if enabled, marketing. You can manage your website preferences through Cookie settings in the footer. Browser settings may also limit some cookies.

Where required, we will honor applicable consent and opt-out choices, including recognized preference signals. If a customer connects third-party tools, those tools may collect information under their own policies.

7. Security and incident handling

We use administrative, technical, and organizational measures designed to protect the information we handle. No internet service can promise absolute security.

Customers should restrict access to their accounts, use strong authentication, avoid sending credentials by email or through ordinary forms, and promptly report suspected compromise. If we confirm an incident affecting information under our control, we will investigate and provide notices as required by applicable law and our agreement.

8. How long we keep information

We retain information for the time needed to provide the service and for legitimate security, billing, tax, dispute, and legal purposes. The period depends on the information and why we hold it.

• Account and campaign information may remain during the customer relationship.
• We may keep suppression records longer so we can respect an opt-out.
• We may keep financial records for required accounting periods.
• Backup copies may remain until they expire through the normal backup cycle.

When information is no longer needed, we delete or anonymize it, or securely retain it only as required or permitted. A customer's deletion instruction may be subject to legal and technical exceptions. To request deletion of your personal information, email [email protected].

9. Privacy choices and rights

Depending on your location and our role, you may have rights to request access, correction, deletion, or portability of your personal information. You may also have rights to limit certain uses of sensitive information, object to or opt out of some processing, or withdraw consent where processing relies on it. We will verify a request using information reasonably necessary to protect your data and respond as applicable law requires. We will not discriminate against you for exercising applicable privacy rights.

For California residents, where the California Consumer Privacy Act applies, these rights include the right to know, delete, correct, and opt out of the sale or sharing of personal information, among other applicable rights.

For people in the European Economic Area or the United Kingdom, where the GDPR or UK GDPR applies, we rely on the appropriate legal basis for each purpose. This may include contract performance, legitimate interests, consent, or legal obligations.

If we process campaign data for a customer, we may refer your request to that customer or work with the customer to fulfill it. You can also contact the customer directly. To make a request about ColdDMs's own processing, email [email protected]. Provide enough detail for us to locate your information. Please do not send sensitive identity documents in your initial email.

10. Children and changes to this policy

ColdDMs is intended for businesses and adults. It is not designed for children, and customers must not submit children's data for campaigns. If you believe a child has provided information to us, please contact us.

We may update this policy to reflect changes in services, technology, or law. We will post the revised policy with a new effective date and provide additional notice where required.

11. Contact

JAT Business Group LLC, doing business as ColdDMs
Privacy requests and general inquiries: [email protected]