Privacy Notice
Why this section exists
Anapan provides sales intelligence to businesses. To do that, we hold professional information about people who work at the organisations our customers sell to and serve. We have not obtained that information from you directly, and we do not hold your phone number or email address.
This section sets out what we hold, where it came from, why we hold it, and what you can do about it, as required by Article 14 of the UK and EU General Data Protection Regulation.
Who we are
Midsummer Technologies Private Limited, trading as Anapan AI, 166 Jankivihar Colony, Lucknow 226021, India.
For the information described here, we are an independent controller. We decide what to collect, where to collect it from, and what to do with it. Our customers do not make those decisions for us.
For privacy questions and to exercise any of the rights described below, contact dpo@anapan.ai. We acknowledge requests within 48 hours.
What we hold about you
A short professional record. For people at organisations our customers monitor, we hold:
- Your name
- Your profile image, where you have made one publicly available on a professional profile
- Your professional title, employer, and location — city, region or country, as you have published it
- Your professional profile and biography
- The web address of your professional profile
That is the whole of what we keep about most people. We do not hold your career history, your education, or a list of your skills as part of this record.
We do not hold your contact details. No phone numbers, no email addresses. We also don’t hold your home address, your personal social media accounts, or anything you’ve posted in a personal rather than professional capacity.
Research, where a customer asks for it. If one of our customers is researching your organisation and asks for information about you specifically, we generate an assessment of what you are likely to be focused on professionally, based on your role and what you have published.
To produce it we retrieve your employment and education history, professional experience, skills and qualifications, and your public professional activity such as posts and comments, from our data provider at that moment. We use them to generate the output and then discard them. We do not store your career history, and we do not keep copies of your posts.
This is an inference, not a fact, and it may be wrong. It is shown to the customer who asked as research material, and no decision about you is made automatically on the basis of it. It exists only for the customer who requested it, is not shared with other customers, and is deleted when that customer stops being our customer.
Special category information. We do not want, seek or use information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, or sex life or sexual orientation. When we receive data from a provider, we apply filtering and redaction to detect and remove information of this kind before we store it or use it for AI processing. Your profile image is personal data, but we do not analyse it to work anything out about you.
Where we get it
Third-party data providers. The information about you above comes from specialist data providers. We assess each provider before we work with them and on a recurring basis afterwards, including how they source data, what legal basis they rely on, and whether they have the right to supply it to us.
This happens in one of two ways. Either a customer gives us the web address of your professional profile and we ask our provider for information about you; or a customer names an organisation and our provider identifies the people there who are relevant. We do not collect your profile from LinkedIn or any other professional network ourselves.
Public company sources. We also collect information from public corporate websites — leadership pages, press releases and similar. Our crawler reads and respects each website’s robots.txt instructions and does not visit pages a site has asked automated crawlers to leave alone. We do not get around login screens, paywalls or other access restrictions.
Why we hold it
So that we can provide sales intelligence to our business customers: maintaining accurate information about organisations and the people associated with them, generating intelligence about those organisations, and producing the research described above when a customer asks for it.
We do not use this information to train AI models, and the AI providers we use are contractually prohibited from training on it. We do not license it to third parties for their own purposes. Our customers pay us for access to the intelligence we produce; whether that arrangement constitutes a “sale” or “sharing” under Californian law is a question we are assessing, and this section will be updated with the outcome.
Our legal basis
Legitimate interests — Article 6(1)(f).
Our interest is in operating a sales intelligence business. Our customers have a corresponding interest in understanding the organisations they sell to and identifying who within them is relevant to a given conversation.
We have weighed this against your interests and rights. The information is professional rather than personal, relates to you in your working capacity, and is drawn from what you or your employer published professionally. We concluded our interests are not outweighed by yours.
You are entitled to disagree, and you can object — see below.
Who sees it
Our business customers, through our platform. The people who see it are their sales and account management staff.
We also use service providers who process information on our behalf: cloud hosting, AI processing, monitoring and analytics. A current list is at trust.anapan.ai.
Where we hold it
Our platform and all the information we hold are hosted on Amazon Web Services in the United States (Oregon). We are based in India, and our staff access that US environment remotely to run and support the service. We do not store your information in India. Most of our service providers are based in the United States.
Where information about people in the UK or the European Economic Area is transferred to us or to our service providers, we rely on the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum where UK law applies. The same clauses govern the supply of information to us by our data provider.
How long we keep it
The short professional record stays while our data provider can still confirm you are where we think you are, and while at least one of our customers is researching your organisation. We delete it if:
- Our provider stops returning you across six consecutive refresh cycles — we refresh twice a month, so around three months without confirmation;
- The customer researching your organisation stops being our customer, and no other customer is researching it; or
- No customer has asked us for intelligence about you for eight months
Research is deleted when the customer it was generated for stops being our customer, or replaced if that customer regenerates it.
We do not keep old versions of your professional record or our research output. When we refresh, the current record is updated and the previous version is gone. We do not keep a history of where you used to work, and we do not keep copies of the source material our provider sent us. We do keep a minimal record of which customer received research about you and when, so that we can answer your questions about who has your information and tell them if you ask us to delete it.
Your rights
You can ask us to:
- Show you what we hold. We will send you a copy, tell you which provider it came from, and — if you ask — name the customers who have received information about you.
- Correct it. If something is wrong, tell us. If you think our research or professional inference about you is wrong, we will look at the underlying sources and regenerate it, or record that you disagree.
- Delete it. You can ask us to erase your information.
- Restrict it. You can ask us to stop using it while a dispute is resolved.
- Object. Because we rely on legitimate interests, you have the right to object to us holding your information at all. In practice, for information of this kind, an objection results in removal.
What happens when you object. We delete your record and any research generated about you, and add a one-way hash of your professional profile web address to a suppression list. Every time we receive data — on our regular refresh or when a customer asks for research — we check it against that list and discard anything matching before it enters our systems. The list holds no readable information about you, is never shown to customers, and is kept for as long as we are keeping you suppressed.
What deletion by us does not reach. We should be straightforward about this. Deleting your information from our systems does not remove it from:
- Our customers’ own systems, where they have already exported it. They control that, not us. We notify every customer that received information about you, without undue delay, so they can act on it in their own systems. If you ask us who those customers are, we will tell you.
- Our data provider’s database. We stop taking your information; we cannot delete theirs. You have rights against them directly.
- Our AI providers’ operational logs, which hold processed data for a limited period. They are contractually prohibited from training on it, but it persists for that window.
Contact dpo@anapan.ai. We will acknowledge your request within 48 hours and respond within one month. You can also complain to a data protection authority — in the UK, the Information Commissioner’s Office; in the EEA, the authority where you live or work.