🔒 Privacy Notice

Last updated: October 8, 2026

This Privacy Notice describes how Golddigger ("we", "us", "our") collects, uses, and protects your personal data when you use our B2B lead-mining API and dashboard at golddigger.gold.

    Short version: We collect only what we need to run the service. We never sell your data. You can export or delete your account at any time.
  

1. Data Controller

Golddigger is the data controller for the personal data described in this notice. Contact: gdana@agentmail.to.

2. Data We Collect

2.1 Account Data

Email address — used for login, verification codes, and service notifications. One email is bound to one tenant (account).
Company / tenant name — your display name on the dashboard.
API key (last 4 chars only) — used to verify login. The full key is hashed and never stored in plain text.

2.2 Usage Data

API call timestamps and quota usage (to enforce daily limits)
Distillation job status, keywords generated, and download package URLs

2.3 Knowledge Data (Optional)

If you upload product information for distillation, we send it to a third-party LLM (DeepSeek, Zhipu, or similar) to generate buyer-intent keywords. We do not train any model on your data. Inputs are processed for the single request and discarded.

2.4 Outbound Reply Content (Optional)

If you use our outbound reply helper, you may paste inbound message content. We send this content to a third-party LLM to generate a suggested reply. Content is processed for the single request and discarded.

3. How We Use Your Data

To provide the lead-mining and distillation service
To send you essential service notifications (welcome, verification codes, distillation complete)
To enforce daily API quotas
To prevent abuse and protect account security

4. Third Parties We Share With

Tencent Cloud SES — transactional email delivery (verification codes, credentials, distillation complete)
Brevo — fallback transactional email delivery
DeepSeek / Zhipu — LLM inference for keyword distillation (data is not retained by these providers for our use)
Cloudflare — DNS, CDN, and DDoS protection
Tencent Cloud CVM — hosting of the application and database (server located in Hong Kong / Singapore region)

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

5. Data Retention

Account data — kept while your account is active, deleted within 30 days of account closure
Distillation results — kept while your account is active
API call logs — kept for 90 days, then aggregated and anonymized
Email verification codes — auto-deleted after 10 minutes

6. Your Rights

You can at any time:

Access — request a copy of your personal data
Correct — fix inaccurate data
Delete — close your account and delete your data
Export — download your data in JSON format
Withdraw consent — unsubscribe from non-essential emails

To exercise any of these rights, email gdana@agentmail.to. We will respond within 7 business days.

7. Security

HTTPS-only access (TLS 1.2+)
API keys are stored as SHA-256 hashes, not in plain text
Login is passwordless (email verification code + API-key-last-4)
Rate-limited authentication endpoints (1 request per 60s, 5-attempt lockout)
Daily automated smoke tests for security regressions

8. International Transfers

Our servers are located in Hong Kong / Singapore. By using the service, you understand your data may be processed in these regions. We use providers that comply with equivalent data protection standards.

9. Children

Our service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has registered, contact us for deletion.

10. Changes to This Notice

Material changes will be reflected by a new "Last updated" date above. For substantial changes, we will notify active accounts by email at least 14 days before the change takes effect.

11. Contact

For any privacy question, email gdana@agentmail.to.

Cookies Notice · Terms of Service · Home