Privacy notice

1. Who is responsible

Foundry Systems operates Blanket. We are responsible for our account, support, and service security records.

Customers decide which people and companies they research. They are responsible for their own use of contact data and messages.

2. Data we use

• Account details: email address, name, sign-in records, and access permissions.
• Saved work: product details, website addresses, research, drafts, sender details, replies, and contact blocks.
• Business contact details: names, roles, employers, work email addresses, and source links.
• Technical records: IP addresses, browser details, request times, and error categories needed to run and protect the service.

Data comes from you, invited account setup, public websites, and the business data provider Apollo.

Do not submit passwords, payment card details, or sensitive personal records. The service is for business research.

3. Why we use data

We use data to sign you in, save work, research companies, prepare drafts, provide support, and prevent misuse.

We use contract performance where processing is needed to provide the service to you. We use legitimate interests for security, support, and relevant business research. These interests include preventing abuse and helping customers check business information. We use legal obligations where the law requires a record. We request consent where required.

You need to provide the account and task data required for a feature. Without it, that feature may not work.

4. Service providers and AI

• Hostinger hosts the application server.
• Neon stores the application database.
• Anthropic processes task inputs for AI research and writing.
• Apollo provides company and professional contact information.

AI inputs can include product descriptions, relevant website text, business context, and message content needed for the task. Submit only material you can share for this purpose. Providers have their own retention and security terms.

Research can request public websites. Those websites receive ordinary connection information, such as the requested address and server IP address.

We do not sell account details or saved work to advertisers. We may disclose data when the law requires it, or to protect legal rights and service security.

5. Gmail

Gmail is optional. A connection is available only after the operator sets up a Google client. You must sign in to Blanket and give separate permission through Google before Blanket can access your mailbox.

With your permission, Blanket manages drafts and reads messages to check sent status and replies in tracked threads. It uses your mailbox address, message headers, recipients, subjects, message text, message identifiers, and connection permissions for these features. Google grants wider mailbox access than the tracked threads that Blanket checks.

You must review the complete email and approve each send. Creating a draft or running sync does not send an email. You can pause sending, disconnect Gmail, or send by hand in Gmail. A send that Google has already accepted can finish after you pause or disconnect.

Connection tokens are encrypted before database storage. Saved work can contain drafts, actual sent text, reply text, message identifiers, and send status. These records use the storage and retention rules below. Disconnect removes the active connection tokens and requests Google access removal. It keeps saved messages and contact blocks. Contact us to request deletion of saved data. Recovery copies follow the backup retention rules below.

You can also remove Blanket access in your Google Account connections. This does not delete messages already stored in Gmail or Blanket.

Gmail sync does not send mailbox text to the AI provider. If you select an AI task that uses a saved reply or message, its relevant text can be sent to Anthropic to complete that task. We use Google data only for the user features described here, service security, and applicable legal duties. We do not use it for advertising, sale, or training a general AI model. People do not read Google data unless you agree for specific support, access is needed for security, the law requires it, or the data has been combined and made anonymous for internal operations.

Blanket's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

6. Storage and international transfers

Service providers may process data outside the European Economic Area, including in the United States.

International transfers need a valid legal basis and applicable safeguards. These can include an adequacy decision or standard contractual clauses. Contact us for the locations and safeguards that apply to your data.

We use HTTPS, account access controls, restricted server permissions, and encrypted database archives. No service can guarantee that data will never be lost or accessed without permission.

7. How long we keep data

We keep account data and saved work while the account is open and the data is needed to provide the service. You can ask us to close an account or delete data.

We may keep limited records for legal duties, security incidents, disputes, or contact blocks that prevent unwanted messages. We assess these records by their purpose and any applicable legal retention period.

We normally rotate daily encrypted database archives after 30 days. The last valid copies may be kept longer if newer backups fail. Hosting recovery copies follow the hosting provider’s backup rotation. Backup data is used for recovery.

If a backup is restored, deletion and contact block requests must be checked before recovered data returns to use.

8. Cookies and browser storage

Necessary session cookies keep you signed in and let the service check account access.

Your browser can keep demo examples and a local recovery copy of unfinished work. Clear the site’s browser storage to remove those copies. This does not delete work already saved on the server.

This deployment does not use advertising cookies or third-party advertising trackers.

9. Your rights and objections

Depending on applicable law, you can request access, a copy, correction, deletion, or limits on data use. You may also have rights to data portability and to withdraw consent.

You can object to processing based on legitimate interests. You can object to the use of your data for direct marketing.

Email info@caracalintelligence.com with your request. We may need to verify your identity. If a customer controls the data, we will explain how to direct the request to that customer.

You can complain to the Autoriteit Persoonsgegevens in the Netherlands, or another competent data protection authority.

10. Research results and changes

AI suggests companies, contact roles, findings, and draft text. A person must check sources and decide what to use. We do not use the service for decisions with legal or similarly significant effects about individuals.

We will update this notice when relevant features or data practices change. The date above identifies this version. See our Terms of service for service rules.