Legal
Privacy Policy
Last updated October 14, 2026.
Updated October 14, 2026: This policy now explains how Intakra names the person who most likely owns each lead: what we store about them, where it comes from, how long we keep it, and how anyone can object or ask us to delete it. October 3, 2026: it explains the information shared with AI assistants you choose to connect.
Who we are
Intakra is an account-monitoring service for B2B sales teams, operated by Soxoa LLC ("Intakra", "we", "us"), based in Sacramento, California. This policy explains what we collect, how we use it, and the choices you have. Questions any time: hello@intakra.com.
Information you provide
Account and workspace details (your name, work email, company, and password, email sign-in code, Google sign-in, or Soxoa single sign-on), the target profile, offer description, and target-account lists you set up or import from your CRM, alert preferences (including any Slack webhook URL you add), billing contact details, home-base or physical-address information you choose to provide, and anything you send us for support.
Information we generate or gather
Public, company-level records about the accounts you choose to track: DNS records, certificate transparency logs, postings on public job boards, company websites, SEC filings, federal award data from USAspending, and WARN layoff notices. We store dated snapshots of what these sources showed so every observation can be checked. We also record product interactions, log and device identifiers, your feedback on opportunities (accept, dismiss, snooze, push to CRM), purchase and subscription transaction history, and push notification tokens and preferences.
People named in leads
For each lead, Intakra names the person at that company who most likely owns the project, so you know who to ask for, and may also name a backup person at the same company. For each person named (at most two per lead) we store only their name, job title, seniority and department, a link to their public LinkedIn page, when they started in the role when known, their business email address when our data provider rates it verified or likely deliverable, and a sentence on why we picked them. We never store phone numbers, personal email addresses or home addresses, and we do not show an email address for people at companies based in the EU, EEA, UK or Switzerland. Most names come from public sources about the company: officers named in SEC filings, leaders listed on the company's own website, and the hiring manager named in a public job post. When the public sources do not name the right person, the name, role, LinkedIn link and business email come from our people-data provider, MoltSets, for every customer (or through a customer's own MoltSets account if they connect one). When MoltSets has no match, we may ask a second people-data provider, Apollo, for one person with a verified business email. We delete these details 30 days after we fetch them, and the same day the workspace cancels or its trial ends. If you are one of these people, you can object or ask us to delete your details at any time by emailing hello@intakra.com; we will delete them and add your name, kept only as a one-way code, to a do-not-name list for that company, so we do not name you there again. When someone marks a person as the wrong or right contact, we keep that choice and the person's role, with the name kept only as a one-way code. Our legal basis where GDPR or UK GDPR applies is our customers' and our legitimate interest in business-to-business sales, limited to your professional role.
Intakra Field mobile data
With your permission, Intakra Field uses precise location to build nearby account lists and routes. It stores the visits, outcomes, debrief transcripts, contact details (which may include names, email addresses, and phone numbers), and follow-up tasks you submit as workspace content. Voice-debrief audio stays on your device and is transcribed only when on-device speech recognition is available; we upload and store the resulting text transcript, which an AI model provider processes to create the structured debrief. We do not upload or store the audio recording.
Cookies & analytics
We use strictly necessary cookies to keep you signed in and secure. Only after you consent, optional browser measurement may send PostHog a random page-memory journey ID, a query-free normalized route shape, and reviewed bounded fields such as coarse source or medium buckets, completion or failure stage, aggregate result counts, and elapsed time. It does not send scan domains, account, lead, or business identifiers. PostHog necessarily receives network metadata such as the direct request IP in transit, but GeoIP enrichment and person profiles are disabled. Meta Pixel remains disabled. After consent, Google Analytics measures only selected public marketing pages and bounded navigation actions using cookies that expire after 90 days. Private app, scan and report pages and URLs with query strings or fragments are excluded. Google advertising signals and automatic form, search and download tracking are disabled. No form values, scan domains or document contents are sent. The analytics choices below let you withdraw, which stops collection and removes Google Analytics cookies. No PostHog analytics event, anonymous ID, or retry queue is created before consent or stored in local or session storage; consented retry state lasts only in page memory, and withdrawal clears it immediately. Global Privacy Control and Do Not Track override a saved grant. Declining optional analytics does not affect core functionality.
Optional analytics choices
Allow optional measurement or reject it. Rejecting also withdraws a previous choice without signing you out or clearing other site data.
No optional analytics choice is saved yet.
How we use information
To operate the product (monitoring the accounts you track, identifying possible buying windows and judging their relevance to your offer, alerts and digests, the CRM pushes you request, field routes, debriefs, and notifications), provide support, verify and process payments, secure and improve the service, and meet legal obligations. We do not sell personal information, use it for cross-company advertising tracking, or use your customer content to train external AI models.
Legal bases (EEA/UK)
Where GDPR / UK GDPR applies, we process personal data to perform our contract with you, for our legitimate interests in operating and improving the service, with your consent where required, and to comply with legal obligations.
Sharing & sub-processors
We share data with vendors that run the service under contract: application hosting, storage, and bot protection (Cloudflare Workers, R2, and Turnstile), database (Neon), transactional email such as sign-in codes, alerts, and account notices (Resend), CRM connections you authorize (Composio), payments (Stripe and Apple StoreKit), push delivery (Apple Push Notification service), AI model processing for public source text, your offer description, and submitted text (OpenRouter and the selected model provider, with the monitoring engine's calls routed through Cloudflare AI Gateway), error monitoring (Sentry), consent-based analytics (PostHog and Google Analytics), and public-source data providers: people data for the person behind each lead (MoltSets, for all customers, and Apollo when MoltSets has no match), job posts for companies whose own job page we cannot read (TheirStack), cited news (Exa), and the history of tools seen on company websites (BuiltWith). We also disclose information where required by law or to protect rights and safety. A current sub-processor list is available on request at hello@intakra.com.
Connected AI assistants
When you connect an AI assistant such as ChatGPT, you choose the Intakra workspace and permissions it can use. Intakra shares a verified account identifier and, when you grant the email permission, your verified email address with that assistant. Account-read permission lets it receive the selected workspace's tracked companies, recorded findings, source links, dates, and opportunity summaries, including the person we name for each lead and any backup: their name, role, LinkedIn page and business email (never an email for people at companies based in the EU, EEA, UK or Switzerland; see People named in leads above). Separate write permissions let it submit company domains to your list or replace your offering description. We store authorization records containing the client, account and workspace identifiers, granted permissions, expiry and revocation state, and one-way token digests to secure the connection. These records may remain as security records after access expires or is revoked. Authorizations last up to 30 days. You can review and revoke them at /oauth/connections; revoking stops further access through that authorization. It does not delete information the assistant already received. The assistant provider's privacy policy, retention rules and account settings govern its copies of that information.
Your account lists
Intakra does not send email to the accounts you track. The target-account lists and other content you upload or import are your workspace content. For any personal data in that content, you act as the data controller and Intakra as your processor.
Data retention
We keep workspace data while your account is active and as needed to provide the service. When you delete your account, we delete or de-identify production copies of your personal Field data within 30 days; residual backup copies age out under our backup-retention schedule, typically within 90 days. App Store lifecycle notices are retained as server-keyed, one-way digests without Apple's raw notification or transaction identifiers so we can prevent receipt replay and reconcile later Apple billing events; these de-identified security records are not linked to a deleted account. Shared workspace records may remain for other workspace members, and we retain billing, tax, security, or legal records longer where the law requires it.
Security
We protect data with encryption in transit, access controls, per-workspace isolation, and reputable infrastructure providers. No system is perfectly secure, but we work hard to protect your information and will notify you of material breaches as required by law.
International transfers
We are based in the United States and may process data there and in other countries where our providers operate, relying on appropriate safeguards (such as Standard Contractual Clauses) where required.
Your rights
Depending on where you live, you may access, correct, export, or delete your personal data, object to or restrict certain processing, and opt out of marketing. To exercise a right, email hello@intakra.com and we'll respond promptly and free of charge.
Children
Intakra is a business tool, not directed to children and not intended for anyone under 16.
Changes
We'll update this policy as the product evolves and revise the date below. We'll flag material changes in-app or by email.
Contact
Soxoa LLC (Intakra) · Sacramento, California, USA · hello@intakra.com.