Effective Date: 1 September 2026 · Version: 1.0
This Privacy Policy explains how Winnowfield ("Winnowfield," the "Service"), operated by Tru Performance ("we," "us," or "our"), collects, uses, shares, and protects information in connection with the Service available at winnowfield.ai and its associated applications and APIs.
1. Introduction
Winnowfield is a business-to-business (B2B) go-to-market and sales-outreach platform. It helps organizations identify target accounts and buyers, research and score prospects, draft and personalize outreach emails with the help of artificial intelligence (AI), and build, schedule, and send email campaigns from the organization's own connected mailboxes.
This Privacy Policy applies to:
- Users — the people who create accounts, join Workspaces, and use the Service (typically sales, marketing, and revenue professionals).
- Workspaces — the organizational accounts under which Users collaborate.
- Prospects and Recipients — individuals whose business contact information is processed within the Service as part of a customer's outreach activity, even though those individuals are not themselves Users.
If you are a Prospect or Recipient and want to understand or exercise choices about your information, see Section 12 (Your Rights and Choices) and Section 17 (Contact Us). Because a customer (not Winnowfield) decides who to contact and why, we may direct certain requests to the relevant customer acting as the controller of that information.
2. Definitions
- Workspace: a tenant account that owns campaigns, contacts, mailboxes, and settings, and to which one or more Users belong with defined roles.
- Roles: the permission levels within a Workspace — Owner, Admin, and Member — plus a platform-level super-administrator role used solely for operating the Service.
- Connected Account: an external mailbox or service (for example, a Google or Microsoft mailbox, a custom SMTP mailbox, or a HubSpot CRM) that a User connects to the Service.
- Prospect/Recipient Data: business contact and firmographic information about third-party individuals and companies that Users add to, import into, or enrich within the Service.
3. Information We Collect
3.1 Information you provide
- Account and profile information. Authentication is handled by our identity provider, Clerk. When you sign up or sign in, we and Clerk process information such as your name, email address, and authentication credentials. Within the Service we store a user record including your email, display name, and company/organization name, and (for certain invited or legacy accounts) a hashed password. We do not store your plaintext password.
- Workspace and team information. Workspace names, ownership, membership lists, roles, and invitation details.
- Sender profile and signature. The name, company, and signature details you configure for outreach, along with sending-domain settings.
- Campaign and content information. Campaigns, message sequences, email drafts, saved templates, audience selections, schedules, and related settings you create.
- Contacts and lists. Prospect and lead records you add or import, and the lists and segments you build.
- Support communications. When you submit a support request or the in-app assistant escalates one on your behalf, we store the ticket details (subject, message, category, and status) and correspond with you about it.
- Knowledge and configuration. Business profiles, knowledge-base notes and links, brand-voice settings, scoring and revenue configuration, and custom fields you define.
3.2 Information collected automatically
- Authentication and session data. Session information managed through Clerk (including signed, expiring session cookies verified on each request) so we can keep you signed in and enforce access controls.
- Operational and security logs. Records of significant actions within a Workspace (an audit log), including events such as connecting a mailbox, changing roles, or issuing API keys, together with actor, timestamp, and outcome. Sensitive values (such as tokens) are referenced only by a non-reversible identifier and are not logged in the clear.
- Usage and cost accounting. Internal counters that track feature usage and AI/enrichment spend for plan enforcement and billing simulation. This is maintained by us and is not shared with a third-party analytics provider.
- Campaign activity. Send records, delivery/engagement signals, unsubscribe events, and reply-matching metadata generated as campaigns run.
We do not use third-party web analytics, advertising, or product-tracking services (such as Google Analytics, Segment, or similar) on the application, and we do not use an external error-monitoring service in the application source.
3.3 Information from connected services
When a User connects an external account, we receive information from that provider as described in Section 5. This includes the connected mailbox's email address and the authorization tokens needed to send and read email on that account, and (for CRM connections) the credentials needed to push data to the connected system.
3.4 Information about Prospects and Recipients (third parties)
To provide outreach and research features, the Service processes business contact and firmographic information about third parties who are not Users. This can include names, job titles, employers/organizations, business email addresses, LinkedIn URLs, work history, company firmographics (industry, size, geography, funding), and AI- or research-derived insights (for example, account/person briefs and "why now" talking points). This information is added by Users, imported by Users, or obtained through the enrichment and research services described in Section 8.
Each contact record is associated with a lawful basis (defaulting to legitimate interest, with consent or contract also available) and a retention policy, as described in Sections 9 and 12.
4. How We Use Information
We use information to:
- Provide and operate the Service — create and manage Workspaces, accounts, campaigns, contacts, and mailboxes.
- Authenticate users and manage sessions — through our identity provider, and enforce role-based permissions.
- Send outreach on your instruction — compose, schedule, throttle, and deliver campaign emails through your connected mailboxes, and process replies and delivery signals.
- Provide AI-assisted features — generate research, segments, drafts, and other outputs as described in Section 7.
- Enrich and research accounts and contacts — through the third-party data services described in Section 8, when a User initiates it.
- Enforce plans and limits — apply feature gating, reveal allowances, and spend ceilings.
- Maintain security and prevent abuse — detect and prevent unauthorized access, enforce suppression/unsubscribe requirements, and keep audit records.
- Provide customer support — respond to and manage support requests.
- Comply with legal obligations and enforce our agreements.
5. Connected Accounts and OAuth
Winnowfield lets Users connect their own sending mailboxes and, optionally, a CRM. We request only the access needed to provide the features you use.
5.1 Mailboxes (Google, Microsoft, SMTP)
- Google (Gmail): we request the OAuth scopes
https://mail.google.com/, openid, and email. The mail scope allows sending and reading email on the connected account over authenticated SMTP/IMAP, which the Service uses to send your campaigns and to detect replies (see Section 6). Offline access is requested so the connection continues to work without you re-authorizing each time. - Microsoft (Outlook/Microsoft 365): we request
offline_access, openid, email, https://outlook.office.com/SMTP.Send, and https://outlook.office.com/IMAP.AccessAsUser.All. - SMTP: you may connect a mailbox by providing SMTP host, port, username, and password.
When you connect a mailbox, we receive and store the connected account's email address (to identify the mailbox and set the "from" address) and the authorization tokens or credentials required to send and read mail. We identify the connected account server-side from the provider; we do not rely on the browser to assert which account was connected.
5.2 How tokens and credentials are protected
OAuth refresh/access tokens and SMTP passwords are encrypted at rest using AES-256-GCM, keyed by a server-side secret. OAuth tokens are never stored in plaintext. In logs and audit records, credentials are referenced only by a non-reversible hashed identifier and are never written in the clear.
CRM connections (for example, HubSpot) use a private-app token that you paste; that token is stored on your Workspace record and used only to push data you choose to sync. (This CRM token is stored without the additional AES-256-GCM envelope applied to mailbox credentials.)
5.3 Disconnecting
You can disconnect a mailbox or CRM at any time from the relevant settings area. Disconnecting removes the associated credentials from active use; campaigns configured to send from a disconnected mailbox will no longer send from it.
6. Email and Communication Data
- Sending. When enabled, the Service sends campaign emails through your connected mailbox, on the schedule and within the throttle limits you configure. The Service is safe-by-default: unless sending is enabled and a mailbox is connected, sends are treated as dry runs — composed and logged but not delivered.
- Mailbox metadata. We store metadata about connected mailboxes (provider, email address, connection status, verification, and per-mailbox signature), separately from the encrypted credentials.
- Inbound email (replies). To stop sequences when someone replies and to record engagement, the Service reads inbound mail from your connected mailbox over IMAP and matches messages to the campaigns that prompted them. Bounces and complaints are used to update suppression lists automatically. We access inbound mail for these operational purposes.
- Recipient information. Recipient business contact details are processed to address and personalize your emails and to honor unsubscribe and suppression requirements.
- Signatures. Sender and per-mailbox signature details are stored and appended to outgoing messages as configured.
- Unsubscribe and tracking. Live campaign emails can include one-click unsubscribe headers and a footer link; unsubscribe links use an opaque token rather than placing the recipient's email address in the URL. Optional open- and click-tracking exist but are off by default in the sender profile and only apply to live sends when you enable them.
7. AI and Automated Processing
Winnowfield uses AI to power features including business/ICP understanding, segment derivation, natural-language-to-filter translation, account and person research briefs, email and sequence drafting, brand-voice extraction, readiness and "grounding" quality checks, name generation, and an in-app assistant ("Sig").
- What may be processed by AI. Depending on the feature, inputs may include text scraped from public company websites, prospect and company firmographics and briefs, your business knowledge base and brand-voice settings, and recipient records used to check that generated copy is grounded in real data.
- AI providers. AI requests are routed through an AI gateway (OpenRouter), which may in turn use one or more third-party model providers, which may include Anthropic, OpenAI, and Google models. We cannot, from the application alone, represent those providers' data-retention or model-training practices; those are governed by the providers' own terms, and you should review them where relevant. A sub-processor list can be provided on request (see Section 8).
- Outputs. AI-generated outputs (such as drafts, briefs, segments, and voice profiles) are stored within your Workspace so you can review and reuse them.
- Human-in-the-loop. The assistant is designed to prepare work for your review; it is not permitted to spend credits or send email on its own. AI outputs may be inaccurate and should be reviewed before use.
8. Sharing and Disclosure of Information
We do not sell personal information. We share information only as needed to operate the Service:
- Service providers / sub-processors. We use third-party providers to deliver the Service, including:
- Clerk — authentication and session management.
- Upstash (Redis) — primary data storage.
- OpenRouter — AI gateway, which may route to model providers such as Anthropic, OpenAI, and Google.
- Apollo.io — B2B contact/company data and enrichment.
- Exa — web research signals.
- Google and Microsoft — OAuth for connected mailboxes (send/read).
- Resend and/or generic SMTP — email delivery and bounce/complaint webhooks.
- HubSpot — CRM sync, when you connect it.
- Vercel — application hosting.
- Connected services you authorize. When you connect an account or sync to a CRM, information is shared with that service at your direction.
- Within your Workspace. Information is visible to other Users of your Workspace according to their roles and the visibility settings of the relevant records (for example, campaigns can be private, shared, or workspace-wide).
- Legal and safety. We may disclose information where required by law, to respond to lawful requests, or to protect the rights, safety, and security of Winnowfield, our users, or others.
- Business transfers. Information may be transferred as part of a merger, acquisition, financing, or sale of assets, subject to this Policy.
A current sub-processor list and a Data Processing Addendum can be made available to customers on request.
9. Data Retention
We retain information for as long as necessary to provide the Service, maintain records, comply with our legal obligations, resolve disputes, and enforce our agreements, subject to applicable law.
For Prospect/Recipient contact records, the Service applies a data-minimization approach: each record carries a lawful basis and a retention window (by default, 24 months), and records are classified as active, expiring soon, or expired so they can be reviewed and removed. Users and Workspace administrators can delete individual records and purge records that are past their retention window. Suppression/unsubscribe entries may be retained as needed to honor opt-outs.
Where specific statutory retention periods apply, those periods govern. We do not otherwise commit to a fixed deletion timeline beyond what is described here and in Section 11.
10. Data Security
We use technical and organizational measures appropriate to the nature of the information, including:
- Authentication and session management through our identity provider, with signed, expiring sessions verified on each request.
- Role-based access control and per-Workspace (tenant) data isolation.
- AES-256-GCM encryption at rest for sensitive mailbox credentials (OAuth tokens and SMTP passwords), with tokens never stored in plaintext and referenced in logs only by a non-reversible identifier.
- OAuth authorization protections for connector flows, including single-use, session-bound state/CSRF checks and PKCE for the platform's OAuth authorization server.
- Server-side request-forgery (SSRF) protections on outbound web requests used for research/enrichment.
- Security-relevant audit logging.
- Transport encryption for data in transit.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not claim any specific security certification. Any formal certifications or audits (for example, SOC 2) should not be assumed unless separately confirmed in writing.
11. International Data Transfers
We and our service providers may process and store information in countries other than the one in which you are located. Where information is transferred across borders, we rely on appropriate safeguards as required by applicable law. By using the Service, you understand that your information may be processed in jurisdictions with different data-protection rules than your own.
12. Your Rights and Choices
Depending on your location, you may have rights regarding your personal information, such as the right to access, correct, delete, or restrict certain processing, or to object to processing. Applicable rights vary by jurisdiction.
- Users can access and update much of their account, Workspace, campaign, and contact information directly in the Service, and can disconnect connected accounts at any time.
- Prospects/Recipients can unsubscribe from outreach using the unsubscribe mechanism included in messages; unsubscribing adds the address to a suppression list that stops further contact. Because the relevant customer decides whom to contact, we may forward or coordinate certain requests with that customer as the controller of the information.
To exercise a right or ask a question, contact us using Section 17. We may need to verify your identity before acting on a request, and we will respond as required by applicable law.
13. Account and Data Deletion
- Disconnecting integrations. You can disconnect mailboxes and CRM connections at any time, which removes the associated credentials from active use.
- Deleting content. Users with appropriate roles can delete contacts, campaigns, lists, and other Workspace content, and can purge contact records that are past their retention window.
- Account/Workspace closure. To request closure of an account or Workspace, or deletion of associated information beyond what you can remove yourself, contact us using Section 17. Some information may be retained as described in Section 9 (for example, to comply with legal obligations, honor suppression requests, or maintain security records).
14. Cookies and Similar Technologies
The Service uses session cookies provided by our authentication provider (Clerk) to keep you signed in and to verify your session on each request. These are necessary for the Service to function.
We do not use advertising cookies, third-party analytics cookies, or tracking pixels on the application, and there is no cookie-consent banner because only necessary session cookies are used. (Optional open/click tracking exists for outbound campaign emails only, is off by default, and is controlled by the sending User — see Section 6.)
15. Children's Privacy
Winnowfield is a B2B service intended for use by businesses and adult professionals acting in a business capacity. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child's information has been provided to us, contact us using Section 17 and we will take appropriate steps to remove it. (The specific minimum age, if any, should be confirmed during legal review — see the placeholder note in Section 12 of the Terms of Service.)
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date above and, where appropriate, provide additional notice. Your continued use of the Service after an update becomes effective constitutes acceptance of the revised Policy.
17. Contact Us
For privacy questions or requests: