Delpha for AI Agents - Claude, Agentforce, Snowflake & more. → delpha.ai
Last updated: September 28, 2026. Effective: September 28, 2026.
This Privacy Policy explains how DELPHA (“Delpha”, “we”, “us”) collects, uses, shares and protects personal data. “Personal data” means any information relating to an identified or identifiable individual.
This policy applies to:
Who is responsible. DELPHA is responsible for the processing described in this policy where we act as controller (see section 2). Our privacy team can be reached at privacy@delpha.io.
This policy does not replace our agreements with customers. Where Delpha processes personal data on a customer’s behalf, our Master Subscription Agreement and Data Processing Agreement (“DPA”) govern that processing.
Delpha’s role depends on whose data it is and why we process it. When we process data on a customer’s behalf, the customer decides how it is used and we follow their instructions. When we process data for our own purposes, we are responsible for it.
| Data | Delpha’s role under GDPR / UK GDPR | Delpha’s role under CCPA/CPRA | Who to contact about it |
| Customer Data: records a customer sends from Salesforce or uploads as a batch file | Processor | Service provider | The customer |
| Query Data: inputs sent to the API or MCP Server, and the results returned, including through an AI assistant | Processor | Service provider | The customer |
| Resolution history and job results kept for the customer (section 7) | Processor | Service provider | The customer |
| Account, login, API keys, OAuth tokens, credits and billing for app.delpha.ai, the API and MCP | Controller | Business | Delpha |
| Usage ledger and operational logs we generate to secure, meter and bill the Services | Controller | Business | Delpha |
| Delpha’s reference data, including company data from public registers | Controller | Business | Delpha |
| Website visitors, marketing, business contacts, job applicants | Controller | Business | Delpha |
When Delpha acts for a customer. The customer is the organisation that holds the Delpha account, or the individual where an account is held in a personal capacity. The customer is the controller (GDPR) and the business (CCPA). It decides why the data is processed, must have a lawful basis for sending it to us, and must inform the individuals concerned. We process Customer Data and Query Data only on the customer’s documented instructions under our Master Subscription Agreement and DPA, and only to perform the operations requested.
For this data we do not:
If a Delpha customer sent us your data. Please send your request to that organisation. If you contact us instead and we can identify the customer, we will forward your request and help the customer respond, as our DPA requires.
If you use Delpha in a personal capacity. If you open an account for yourself rather than for an organisation, you are the controller of the data you submit. You are responsible for having a lawful basis to submit other people’s personal data. Using Delpha for business prospecting or CRM work is a professional activity, not a purely personal one.
We collect personal data through the channels below. Where you must provide data, we say so when we collect it. If you don’t, you may not be able to use the relevant Service or submit a job application.
When you visit our websites, we and our analytics providers collect, through cookies and similar technologies, your IP address, browser type, operating system, referring URL and how you interact with the site. When you fill in a contact or demo form, we collect your name, business email, company, job title and your message. Cookies are described in section 13.
When a customer runs a verification, validation or enrichment operation, we process the values they send and the results we return. Depending on the operation, this can include:
Results can include a validated or corrected value, a candidate professional email address, phone line type, carrier and connection status, a LinkedIn profile URL, company identity and parent company, quality scores, and the evidence behind a verdict.
For the Salesforce app, the Salesforce user ID is encrypted (AES-256) with a key held in the customer’s Salesforce org before it leaves Salesforce, and the org ID is hashed (SHA-512). Delpha cannot read the user ID without the customer’s key.
We maintain a company reference repository built from national company registers and other public sources. It is used to identify companies and resolve corporate hierarchies. Where a register lists individuals, such as sole traders whose business name is their own name or company officers and their role, the repository contains that information as the register publishes it. You can object to this processing or ask us to correct it (section 11). It holds no customer records and no contact list of individuals.
From people working for our customers, prospects, partners and suppliers, we collect name, job title, department, organisation, business email, postal address and phone number, and credentials for our systems where needed.
When you apply for a job, we collect your contact details, CV, work history, references and anything else you choose to send.
Delpha holds no contact database. We do not build, buy, rent or sell lists of people. Every result is computed at the time of the request from the values in that request, Delpha’s own reference data and, for some operations, one check with a third-party provider.
| Operation | Source of the result | What leaves Delpha, and to whom |
| Email (POST /v1/email) | The Delpha AI model selects the most likely address formats for the domain, and the resulting candidates are delivery checked with the domain’s mail server at the time of the request. No address is stored. No contact database or third-party database is used. | The address supplied, or the one formed from the name and company website supplied, reaches the mail servers of that address’s own domain for verification. No contact-data provider is queried. |
| Phone (POST/GET /v1/phone) | The submitted number is parsed and checked against carrier and network data for validity, line type, carrier and connection status. The number is not linked to a name or any other personal data. | The number, to the carrier. The batch route contacts no provider |
| Name (POST /v1/name) | Delpha’s own reference data, used to detect typos and reversed first and last names. The person is not looked up. | Nothing leaves Delpha. The submitted name is kept in the customer’s resolution history for its configured period (section 7). |
| LinkedIn profile or company page (POST /v1/linkedin-profile, /v1/linkedin-company-page) | Real-time public web search: Google results, retrieved through Google’s Custom Search API. No LinkedIn account, session or credential, and no contact database or third-party database, is used. | The name, company and country supplied are passed to Google. An email address supplied never leaves Delpha: only its domain is used, as the company website. A URL submitted for validation is requested anonymously, and only its response status is kept. |
| Company (GET /v1/company), website, legal identifier, ultimate parent | Delpha’s company reference repository, public registers and web evidence, with AI models for identification | Company names and websites, to our AI providers (section 6) |
Each batch operation follows the same row as its single-record version. Our providers are listed, with their role, on our sub-processor list.
Where Delpha is processor, the customer determines the legal basis; we process under Art. 28 GDPR and our DPA. Where Delpha is controller, we rely on the legal bases below (Art. 6 GDPR). Where we rely on legitimate interests, you can ask us for more information about the balancing test and object at any time (section 11).
| Purpose | Data | Delpha’s role | Legal basis |
| Performing the operations a customer requests and returning results, including keeping job results and resolution history for the customer | Query Data, Customer Data | Processor | Set by the customer as controller |
| Creating and managing accounts, authenticating users, issuing API keys and OAuth tokens | Account data, access credentials | Controller | Performance of a contract (6(1)(b)); legitimate interests (6(1)(f)) where you act for an employer that is our customer |
| Metering, credits, billing and invoicing | Billing data, usage ledger | Controller | Performance of a contract (6(1)(b)); legal obligation for tax and accounting records (6(1)(c)) |
| Securing the Services, rate limiting, preventing fraud and abuse, debugging | Operational logs, usage ledger, access credentials | Controller | Legitimate interests in keeping the Services secure and available (6(1)(f)) |
| Maintaining our company reference repository | Reference data | Controller | Legitimate interests in providing accurate company identification (6(1)(f)); for register data, information about individuals is limited to what the register publishes |
| Customer support | Account data, support messages | Controller | Performance of a contract (6(1)(b)) |
| Improving and developing the Services using usage statistics that do not contain request inputs or results | Usage ledger, anonymised or aggregated statistics | Controller | Legitimate interests (6(1)(f)) |
| Website analytics and non-essential cookies | Cookie and device data | Controller | Consent (6(1)(a)) |
| Marketing to business contacts and managing customer relationships | Business contact data | Controller | Legitimate interests (6(1)(f)); consent where required for electronic marketing |
| Recruitment | Applicant data | Controller | Steps before a contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Enforcing our agreements, establishing or defending legal claims | Any relevant data | Controller | Legitimate interests (6(1)(f)); legal obligation (6(1)(c)) |
| Responding to lawful requests from courts and authorities | Any relevant data | Controller | Legal obligation (6(1)(c)) |
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Verdicts and scores returned by the Services concern the quality of records and company identities; the customer decides how to use them.
Customer Data and Query Data are never used to train, retrain, fine-tune or evaluate machine-learning models, whether Delpha’s or a third party’s.
Some operations use large language models to identify companies and extract information from web evidence. We access these models through enterprise services: Amazon Bedrock (AWS) and Google Vertex AI (Google Cloud), in the same region as your data (EU or US, see section 9). These providers act as our sub-processors. Their terms with us prohibit using the data to train models and provide for zero data retention, so they do not store it.
AI output is never used on its own. Results are checked against source evidence and constrained to fixed formats before they are returned. Duplicate detection uses no AI model; it relies on deterministic matching. Candidate email addresses are generated by a probabilistic model that requires no training data. Delpha’s other purpose-built models are never trained on Customer Data or Query Data.
When you connect Delpha to a third-party AI assistant or agent, that provider handles your conversation under its own privacy policy. Delpha receives only the data the assistant sends to our MCP Server or API.
We keep personal data only as long as needed for the purpose it was collected for. The periods below are those the Services apply today. When a period ends, data is deleted or anonymised.
| What is kept | Where | How long |
| Single-record API and MCP requests processed in memory | Not stored | Discarded when the response is returned |
| Records sent from Salesforce for cross-record operations (e.g. duplicate detection, ultimate parent) | A single-tenant, encrypted storage bucket for that customer | Deleted automatically when the batch job ends |
| Full job result, so it can be retrieved | Job record behind GET /v1/{usecase}/{job_id} | 10 days |
| Request input (limited to the fields needed for each operation) and the result served | The customer’s resolution history in app.delpha.ai | The window the customer sets: up to 30 days on the free plan, up to 180 days on paid plans. Set to 0, nothing is stored |
| Batch item lists and result files | Batch file store | Item lists 7 days, result files 30 days |
| Usage ledger (operation, user, key, time; no input or result) | Customer’s usage log | Life of the account, then 30 days |
| Operational logs | Service log groups | 3 days |
| Account and access data | Application database | Life of the account, then 30 days |
| Billing and invoices | Billing systems | Managed by Stripe |
| Business contact data | CRM | 3 years after the last contact |
| Job applications | Recruitment files | 2 years after the application, unless you agree to longer |
| Website analytics cookies | Your browser and our analytics provider | 13 months maximum |
Customers can delete individual entries from their resolution history at any time in app.delpha.ai. We may keep data longer where the law requires it or to establish or defend legal claims.
Company reference data, including information about individuals published in company registers, is kept while it remains in the source register and is updated or deleted when the register changes.
Delpha does not sell personal data or share it for cross-context behavioural advertising. We share personal data only with the recipients below.
Sub-processors and service providers. They process data on our instructions, under written contracts that require confidentiality, appropriate security and deletion or return at the end of the service. Where “EU or USA” is listed below, the exact processing location depends on the customer’s selection during setup (as detailed in the “9 – Where data is processed and international transfers” section below).
Our main sub-processors are:
| Provider | Location | Role |
| Amazon Web Services, Inc., Seattle, WA, USA | EU or USA* | Cloud hosting and infrastructure; generative AI services (Amazon Bedrock) |
| Google LLC, Mountain View, CA, USA | EU or USA* | Cloud infrastructure; generative AI services (Vertex AI); web search for LinkedIn lookups; website analytics |
| MongoDB, Inc., New York, NY, USA | EU or USA* | Database services (company reference repository) |
| Salesforce, Inc., San Francisco, CA, USA | USA | Customer relationship management |
| Slack Technologies, LLC, San Francisco, CA, USA | USA | Collaboration and messaging |
| Stripe Payments Europe, Limited (SPEL), Dublin, Ireland | EU or USA* | Payment processing, billing automation, subscription management and fraud prevention |
| Cloudflare, Inc., San Francisco, CA, USA | Global edge network, closest to the user; United States | Content delivery, DDoS mitigation, web application firewall, and secure proxying and TLS termination for Delpha’s websites, API and MCP Server |
*Location chosen by the customer during setup.
The complete, current list is on our sub-processor list. Customers are informed of new sub-processors [30 days] before they start processing Customer Data and may object, as set out in our DPA.
Payment provider. Card payments for app.delpha.ai are handled by Stripe, which processes payment data under its own privacy policy for fraud prevention and legal compliance.
Third-party AI assistants. When you connect Delpha to an AI assistant or agent, you choose to send data between that provider and Delpha. The provider is not our sub-processor; its own terms apply.
Legal and safety. We may disclose data if required by law, court order or a government authority, or where we believe it is necessary to prevent physical harm, financial loss or fraud, or in an investigation of suspected illegal activity.
Business transfers. If we sell or transfer all or part of our business, personal data may be transferred to the buyer. We will ask the buyer to use it consistently with this policy and will tell you where the law requires.
Customer Data and Query Data are processed in the region selected by the customer during setup:
AI models are executed within the same selected processing region.
Some of our service providers and subprocessors are established in or operate from the United States, meaning personal data may be accessed from or transferred to the US. For personal data originating from the European Economic Area (EEA), the UK, or Switzerland, we ensure valid data transfer mechanisms are in place. We rely on adequacy decisions where applicable—including provider certifications under the EU-U.S. Data Privacy Framework (and its UK Extension and Swiss-U.S. DPF)—or on the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and relevant Swiss transfer mechanisms, backed by additional technical and organizational safeguards where necessary.
You can request a copy of the safeguards we use or ask questions about data residency by writing to privacy@delpha.io.
Delpha is audited against SOC 2 Type II. Details are available at trust.delpha.io.
Our measures include:
No system is completely secure. If a personal data breach affects your data, we will notify the customer, the competent authority or you as the law requires.
If the GDPR or UK GDPR applies to you, you can ask us to:
Where we rely on your consent, you can withdraw it at any time, free of charge. This does not affect processing that took place before.
How to make a request. Write to privacy@delpha.io or use help.delpha.io. We may ask you to confirm your identity. We answer within one month, which can be extended by two months for complex requests; we will tell you if so. To stop marketing emails, you can also click the unsubscribe link in any of them.
Data we process for a customer. For Customer Data and Query Data, the customer is the controller, so please contact them. If you contact us, we will forward your request as described in section 2.
Complaints. If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to a data protection authority, in particular where you live, work or where the issue occurred.
Delpha does not currently meet the thresholds that make a company a “business” under the CCPA. We describe our practices below for transparency, and meet the CCPA’s service-provider obligations through our contracts with customers. The consumer rights below apply where the CCPA applies to Delpha; where section 2 calls Delpha a “business”, the same condition applies.
Service provider role. When Delpha processes Customer Data and Query Data, it acts as a service provider to the customer (section 2). We process that data only to provide the Services under a written contract, and do not sell or share it, retain or use it for any other purpose, or combine it with other data except as the CCPA permits. Requests about that data should go to the customer.
Personal information we handle for our own purposes. In the past 12 months we collected the following categories, from the sources and for the purposes described in sections 3 and 5:
| CCPA category | Examples | Disclosed for a business purpose to |
| Identifiers | Name, email, IP address, account and API key identifiers | Hosting, AI and infrastructure providers; payment provider |
| Customer records | Company, job title, billing details | Hosting providers; payment provider |
| Commercial information | Plan, credit purchases, usage | Hosting providers; payment provider |
| Internet activity | Website interactions, usage ledger, logs | Hosting and analytics providers |
| Professional or employment information | Job title, employer; CV for applicants | Hosting providers |
| Sensitive personal information | Account login and password | None; used only to provide and secure the Services |
Retention periods are in section 7. We do not use sensitive personal information to infer characteristics about you.
No sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. We honour Global Privacy Control signals.
Your rights. You can ask to know what personal information we collected, used and disclosed, to access it, to correct it and to delete it. We will not discriminate against you for exercising these rights. Send requests to privacy@delpha.io. We verify requests by matching the information you provide with what we hold, for example by confirming access to the email address on your account. An authorised agent can make a request for you with your signed permission, and we may ask you to confirm your identity directly.
A cookie is a small file a website stores on your device to remember your actions or preferences. Our websites use strictly necessary cookies, which need no consent, and, only with your consent, analytics cookies that help us understand how visitors use the site. We do not use advertising or retargeting cookies.
You can accept, refuse or change your choice at any time through the “Cookie preferences” link at the bottom of each page. You can also block or delete cookies in your browser settings; some site features may then not work.
We may send marketing emails to business contacts about Delpha products and events. You can unsubscribe at any time through the link in each email or by writing to privacy@delpha.io.
Children. Delpha’s websites and Services are designed for professional use and are not directed to children. We do not knowingly collect personal data from children under 16. If you believe we have, contact us and we will delete it.
Third-party features and links. Our websites may include features or links operated by third parties, such as social networks. Those third parties handle your data under their own privacy policies, which we encourage you to read.
Changes to this policy. We review this policy at least once a year and update it when our practices or the law change. The date at the top shows the last update. We will tell customers and account holders about significant changes before they take effect, and ask for consent where the law requires.
Contact. For questions, requests or complaints about this policy or our privacy practices:
