Privacy

Last updated 19 October 2026

Who we are

Ignaru is operated by Jawad Jalal, trading as Ignura, until Ignura Ltd is incorporated.

Ignura Ltd is a UK company that is not incorporated yet. It has no company number or registered address to give, so this page has none. When it is incorporated, this page will name it.

Questions about your data, or a request to use any of your rights: email privacy@ignaru.com or book a call.

The short version

Ignaru helps a team find leads, write outreach and book calls. To do that it stores your account, your team’s work and the leads your team adds.
No email goes to a lead, and no public post goes out, unless an Admin on your team says yes. Every email names the sender and has a one-click unsubscribe link.
We do not sell personal data, show ads, or train AI models on your data. AI requests go to hosts that keep nothing and train on nothing, except the places this page names.
Our app and database run in London. Some providers are based in the United States or elsewhere, and this page names them.
You can export your data, and delete your account or your team, yourself in Settings.

Two roles

Your account. For your sign-in, billing and how you use the service, we decide what happens to the data. We are the controller.

Your team’s data. Leads, drafts, replies, calls, notes and chat belong to your team. Your team decides who to contact and why, so your team is the controller and we process that data for it, on its instructions. The processing terms are in our terms.

What we collect

Account. Your email and name, and the team you belong to with your role (Admin, Operator or Viewer). Ignaru gives you an avatar and a colour. If you upload a profile photo, it is stored in our file storage and shown only to people on your team. When you ask for a sign-in code, your IP address and browser details go to WorkOS, our sign-in provider, to protect the account.
Your team’s work. Canvases and their steps, comments and drawings, leads, drafts, replies, booked calls, the Brain (facts Iggy learns about your business), Iggy chat with any text files you attach, team chat and direct messages, marketing assets, an activity log, and your team’s settings.
Leads. For each person your team adds or Iggy finds: name, work email, role, company, website, LinkedIn address, why they fit, and what public pages and your connected tools say about them. Where we can find one, we also store a public photo of the person from their own profile (X, GitHub or Gravatar) or from a data provider. Lead photos are shown only to your team.
Public pages. When Iggy reads a company’s website, or a public profile linked from it, we fetch those pages and keep what the work needs.
Connected apps. When you connect Gmail, new messages in that inbox reach us through Composio. We keep the text of a message only when it comes from one of your leads (as a reply, with the quoted history removed). For any other message we note that mail arrived, with no sender, subject or text. Outlook is used to send mail from your team’s Microsoft account.
Keys and tokens. If you add your own AI model key we store it encrypted (AES-256-GCM) and show only its last four characters. API tokens are stored as a one-way hash.
Billing. Your plan, seats, credit balance and history, and the Stripe customer and subscription ids. Card details go to Stripe and never reach us.
Technical. Error logs, with emails, tokens, cookies and keys removed before they are written. Error reports (see Error monitoring). Rate limits count requests per IP address in memory and do not store them, unless your deployment turns on shared rate limits with Upstash, which keep the counts, and IP addresses, there.
Landing page questions. Questions typed to Iggy on our home page go to an AI model for an answer and are not stored.

Why we use it, and the lawful basis

To run the service you signed up for: sign-in, canvases, drafting, sending what you approve, billing. Basis: our contract with you.
To keep it secure and working: rate limits, abuse prevention, logs and error monitoring. Basis: our legitimate interest in a safe, reliable service.
To keep billing and tax records. Basis: legal obligation.
Lead data: we process it for your team. Your team needs its own lawful basis to contact each person, usually legitimate interests for business outreach.

We do not send marketing email. We do not use your data for advertising.

AI

Iggy uses AI models to read your website, research and score leads, write and rewrite drafts, sort replies, prepare call briefs, answer in chat and make marketing assets. The text a task needs goes to the model: for example your site’s pages, a lead’s details, your Brain facts and a reply you received.

Work paid in credits goes through the Vercel AI Gateway to three models: DeepSeek V4.1 Flash (the default), DeepSeek V4 Pro and Claude Haiku 5.5. For these models the gateway is asked for hosts that keep no prompts or answers (zero data retention) and do not train on them, and it may use only those hosts. No host in mainland China is used, including DeepSeek’s own API.
Today that means DeepInfra, Morph and Parasail for DeepSeek V4.1 Flash; Azure, DeepInfra and Baseten for DeepSeek V4 Pro; and Anthropic, Amazon Bedrock, Claude on AWS and Google Vertex for Claude Haiku 5.5. If no such host is available for a model, the gateway uses the strictest route left and we log it.
Breakdown research on rival companies sends the company’s name, its site and the question to Perplexity’s Sonar model through the gateway. That call does not yet ask for zero data retention, so Perplexity’s own data terms apply to it. At medium and high effort, every line of a finished breakdown is also sent to Sonar the same way, to check each claim against the live web before you see it.
Lead checks use a model from TypeSafe AI through the gateway, which keeps nothing and does not train on the data. We can switch this check off.
Voice, where we have switched it on, runs on OpenAI. OpenAI does not train on that audio but does not offer zero data retention.
If your team adds its own key (Anthropic, OpenAI, Google Gemini or OpenRouter), chat turns where you pick that model go to that provider on your account. Canvases, background drafting, and Iggy in comments and team chat still use the gateway.
We do not train or fine-tune any model on your data.
Iggy can score and rank leads. It never sends on that basis alone: a person approves every email.

What gets sent on your behalf

An email to a lead needs an Admin’s yes, either on the Approve screen or when Iggy asks in chat. Iggy cannot send email when no one is there to say yes.
Approved emails go from your team’s connected Gmail or Outlook account, or through the team’s Glasa or sequencer campaign, so your team is the sender.
Every email Ignaru sends for your team ends with the sender’s name, company and postal address and a one-click unsubscribe link. Nothing is sent until an Admin has entered that address. Emails sent through other connected apps get the same footer where the app lets us add it to the body.
In Auto mode, which only an Admin can turn on, Iggy can act in your other connected apps without asking each time, for example posting a Slack message, updating a CRM record, or changing Gmail labels or archiving mail. Email and posts to public places still need an Admin’s yes.
Calendar invites are queued for an Admin to approve. Once approved, Google sends the invite to the guests.
Sign-in codes and team invitations are emailed by WorkOS. Ignaru sends no other email of its own.

These providers process data for us. Each gets only what its job needs.

Infrastructure

Vercel: hosting, scheduled jobs, the AI Gateway, file storage (Vercel Blob), and a sandbox in which we read public websites. Our functions run in London.
Supabase: our database and live updates, in London (eu-west-2).
WorkOS: sign-in, teams, roles and invitations.
Stripe: subscriptions, credit packs and invoices.
PostHog (EU Cloud): analytics with your consent, and error monitoring (see Cookies and Error monitoring).
Upstash: shared rate limits, only if we switch them on.

The AI models and hosts listed under AI, reached through the Vercel AI Gateway.
Perplexity, for rival research and fact checks in breakdowns, through the gateway.
OpenAI, for voice, only where we have switched it on.
fal.ai: the text prompt for a marketing video clip, when a team makes one.
Anthropic, OpenAI, Google Gemini or OpenRouter, only for chat turns on a team’s own key.

Your apps and your leads

Composio: connections to your apps, the sends from your Gmail or Outlook account, and app actions. It receives what each action needs, for example the recipient, subject and body of an email you approved, and it holds the sign-in tokens for your apps.
Google, for Gmail and Google Calendar, through Composio (see Google user data). Google Fonts is listed below.
Microsoft, for Outlook, through Composio.
Glasa: cold email campaigns, only if your team connects it. It receives the leads and emails your team approves for a campaign.
Lemlist, Instantly and Smartlead: sequencers, only if your team connects one. We reach them through Composio.
Monid: the data account Ignaru uses for paid lookups, when we switch it on. It passes lookups on to Apollo, Hunter, People Data Labs, Firecrawl and Apify.
Apollo, Hunter, People Data Labs, Firecrawl and Apify: paid data lookups on people and companies, reached through Monid or through Composio. Apollo, Hunter and Firecrawl also get a balance check with our key, which contains no lead data.
Gravatar: for a lead with an email address, we send a SHA-256 hash of that address to look for a public picture.
GitHub, Bluesky, YouTube, TikTok and Discord: public profile pages linked from a company’s site, read by username or address. We send only the address of the page.
Companies House, SEC EDGAR, Hacker News, the Y Combinator company list and the App Store: public records, searched by company name, domain or app name.
Cal.com: the booking form at /call. What you type there goes straight to Cal.com.
FirstPromoter: our affiliate program, only if a partner’s link brought you here and you allowed cookies. When your team buys a plan or credits it receives your email, your team id and the partner’s code, and it sees that customer’s payments in Stripe so it can pay the partner.
Google Fonts: breakdown boards and shared demo boards load the fonts of the company they are about from Google. Viewing one sends Google the viewer’s IP address and the font names.

Apps your team connects (Gmail, Outlook, Google Calendar, HubSpot, Slack, Hunter, Apollo and others) run on your team’s own accounts under their own terms. We also fetch public web pages, such as your site and lead company sites, to read them.

We share data with others only if the law requires it, or to protect people or the service from harm.

Google user data

Ignaru reads and sends Gmail, and reads and adds Google Calendar events, in the Google accounts your team connects, through Composio. We ask for Gmail read-only, compose and send access. We keep the text of a message only when it is a reply from one of your leads.

Ignaru’s use of information it receives from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that data only to provide the features your team connects. We do not use it for advertising, and we do not sell it. We transfer it only to provide those features (Composio carries it for us), to keep it secure, or where the law requires. Our staff read it only with your team’s consent, to investigate a security or abuse problem, or where the law requires.

Where it is stored, and transfers outside the UK

Our database and the app’s functions run in London. WorkOS, Composio, Stripe, Vercel and several AI and data providers are based in the United States or elsewhere outside the UK, or process data there. PostHog processes our error reports and analytics in the EU. Where a provider handles UK personal data outside the UK, we rely on UK adequacy regulations (including the UK-US data bridge for certified companies) or the UK International Data Transfer Addendum in that provider’s data processing terms. Our chat AI requests never go to hosts in mainland China; see AI above.

How long we keep it

Your team’s data stays until you delete it, or close the team or your account.
Deleting a lead, canvas, draft or Iggy file moves it to Recently deleted, where it can be put back for 30 days. After 30 days it is removed for good, and so is whatever depended on it: a lead’s drafts and replies go with the lead. A deleted team chat message is gone for the team at once and removed for good after 30 days.
Deleting a team removes everything in it straight away: canvases, leads, drafts, chat, model keys, and its connected apps. Its WorkOS organisation is deleted too. Deleting your account removes you from Ignaru for good: teams only you are in are deleted, you are removed from the rest, and what you wrote there goes while your name comes off the work that stays.
Billing records are the one thing deleting a team does not remove. UK tax and accounting rules require us to keep them, so we keep the team’s credit and plan history for 6 years after deletion, and then remove it. We first strip out everything personal: names, email addresses, notes, and who spent or granted what. What stays is amounts, dates, reasons, and the payment and invoice references, under an internal team reference. Stripe keeps the invoices and payment records it made for the team, under its own terms.
A sent email stays in the inbox it was sent from. We keep the draft record while the lead exists.
Disconnecting an app removes the connection at Composio straight away.
Copies in our database host’s backups are kept for that host’s backup period.
API tokens expire after a year. Sign-in helper cookies expire after 10 minutes.
Logs and error reports are kept for the period set by Vercel and PostHog for our plan.

Cookies and browser storage

wos-session: keeps you signed in. Strictly necessary. It lasts up to 400 days unless you sign out.
Sign-in helpers (ig_oauth_nonce, ig_auth_pending and a WorkOS one): protect a sign-in in progress. Strictly necessary. 10 minutes.
Browser storage for your interface choices, such as a collapsed sidebar, your last canvas, table columns and recent searches. It stays on your device until you clear it. Unsent chat text and approvals waiting in Iggy are kept in session storage, until the tab closes.
ig_consent: remembers your analytics choice. Strictly necessary. Six months, then we ask again.
ig_region: holds only “eu” or “x”, from your country, so we know whether to ask. Strictly necessary. Ends with your browser session.
Analytics (PostHog, EU Cloud): pages viewed, clicks, and session replays in which every word on screen and every input is masked. It stores an identifier in your browser. In the UK, the EEA and Switzerland, or if we can’t tell where you are, none of it loads until you say yes. Elsewhere it loads unless you say no. A no clears what it stored.
ig_ref: if you arrived through a partner’s link (?via= or ?ref=), the partner’s public code, so they are paid if your team buys. 60 days. It is a marketing cookie and follows your analytics choice: in the UK, the EEA and Switzerland it is set only after you say yes, and saying no removes it.
The booking form at /call is a Cal.com frame and may set Cal.com’s own cookies.

We never capture shared boards, public demo boards or unsubscribe pages. Our server also records product events per team (for example, “a draft was approved”) with no personal data and no IP address. We use no advertising cookies; ig_ref is the only cookie that tells anyone how you found us.

Error monitoring

When something breaks we send an error report to PostHog in the EU so we can fix it. Before it leaves our server we remove emails, tokens, keys, cookies and the query part of web addresses. A report includes the page or route, your team id, your user id if you are signed in, and the error and where in our code it happened. It sets no cookies and records no IP address.

Security

Data travels over HTTPS. Every record belongs to one team, and the server checks your team and role on every request. Model keys are encrypted and API tokens are hashed. Only an Admin can approve sends, change billing or turn on Auto mode.

Your rights

Under UK data protection law you can ask us to:

give you a copy of your personal data;
correct it;
delete it;
restrict or object to how we use it;
give you your data in a format you can reuse.

You can do most of this yourself. In Settings, Export downloads your data as one JSON file, or everything in the team (Admins), or the leads as a spreadsheet. In Settings, Danger zone deletes a team (Admins) or your account. Deleting a team is refused while a paid plan is billing. Deleting your account is refused while you are the only Admin of a team with others in it, or while a team only you are in still has a paid plan.

For anything else, email privacy@ignaru.com and we will reply within one month. You can disconnect an app or leave a team yourself at any time.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113. We would like the chance to sort it out first.

If a team using Ignaru contacted you

That team chose to contact you and is responsible for it. Every email sent through Ignaru names the team and its postal address and has a one-click unsubscribe link. Using it, or replying that you are not interested, puts your address on that team’s do-not-contact list: Ignaru then refuses to draft for you or send to you from that team again. The team can also delete your details from Ignaru. You can also email privacy@ignaru.com, and we will pass your request to the team and help it act on it.

Children

Ignaru is for businesses and is not meant for anyone under 18.

Changes

When this page changes we update it here and change the date at the top.