Privacy

We store what you type, what we found for you, and what you thought of it. We do not sell it. We do not run advertising trackers. We do not store your IP address or your browser string in a readable form. We never ask you for anybody else’s email address. There is a delete button and it really deletes.

Cup of Leads is operated by DFX Intelligence, United States. For data protection purposes DFX Intelligence is the controller of the personal data described here. Write to hello@dfxintel.com about anything on this page. A person reads it.

• Your email address and name, so your leads have somewhere to go, so we can tell it is you next time, and so the free cup can be counted per person rather than per browser.
• The markets you describe, because that sentence is the research brief. We keep it so you never have to retype it, and we read it in aggregate to learn which markets the product is bad at.
• The leads we returned and what you thought of them, so we can show you your own history, avoid handing you the same company twice, and improve the ranking.
• Purchases, amount, date and what it bought. Card details are handled by Stripe and never reach us.
• How you arrived, the page or invite link you came in on, so we know what is working.
• Technical signals, hashed, a one way hash of your IP address and browser string, salted with a key only this system holds. It exists to stop one machine consuming the free service without limit. It cannot be turned back into an address and is not usable anywhere else.

Before you give us an email address you are an anonymous visitor with a random identifier in a cookie. If you later sign up, that history is attached to your account rather than abandoned, because losing the leads you just read would be worse for you than the alternative.

Where the UK or EU GDPR applies, our lawful bases are: performance of a contract, for everything needed to run your account and deliver research you asked for; legitimate interests, for keeping the free tier from being abused, for security, and for the business to business contact data described below; consent, for optional emails, which you can withdraw at any time from your account page; and legal obligation, for tax and accounting records of purchases.

The contacts we surface are business contacts at businesses: a name, a job title, a work email address or a published main line, a public profile link. They come from public sources, from company websites, from regulatory filings, and from licensed data providers. We do not collect special category data, we do not build consumer profiles, and we do not knowingly hold data about people in a personal rather than a professional capacity.

Our lawful basis for that processing is legitimate interests: helping one business identify another business it might sell to, using contact details those businesses publish for that purpose. You have an absolute right to object.

If you are one of those people and you would rather not be in our index, email hello@dfxintel.com. We will remove you and keep you out, so a later refresh does not put you back. You do not have to explain why and you do not have to be a customer.

You can share a link that gives you a free cup when somebody new signs up through it. We never ask you for your friend’s email address, and there is no field to paste one into. An invite is a link you send yourself, from your own messages, so we learn nothing about anybody who does not choose to arrive.

Some organisations give their members, readers or founders a co-branded page here. If you arrived through one, we record which partner sent you, once, on your first visit. That is how the partner knows their page is being used and how we know whose allocation paid for your research.

The partner never sees you. They do not receive your name, your email address, your searches, the companies you were shown, or anything that identifies you as an individual. There is no setting that turns this on, no tier that includes it, and no export that contains it.

What a partner does receive is a picture of their whole audience: how many people used the page, what categories of organisation those people were looking for, which geographies came up, what capital bands were mentioned, and what their members tend to prefer when choosing between two firms. Every one of those figures is a count across many people.

Nothing appears to a partner unless at least five different people are behind it. That threshold is enforced when the numbers are built, not when they are displayed, so a category only one or two people asked for is not merely hidden, it never leaves our systems. Your exact words are never shown to a partner either; a search is reported as a category, so “need a hard money lender in Worcester by Friday” becomes part of a count of people looking for real estate debt.

If we ever build a way for you to send your own hunt to a partner deliberately, it will be something you choose, one time, knowing exactly what is being shared. It does not exist today.

The research is done by large language models, currently Anthropic’s. The market you describe and the public information we gather are sent to that provider to do the work. Under our agreement with them, that content is not used to train models. No decision with a legal or similarly significant effect on any person is made automatically here: the product ranks companies and writes reasoning, and a human decides what to do with it.

• Vercel, hosting and delivery of the site.
• Supabase, the database, hosted in the United States.
• Anthropic, the models that do the research.
• Hunter and Apollo, contact lookups. They receive a company name or domain, not your identity.
• Stripe, payments. We never see or store card details.
• Resend, sending you email.

These are processors acting on our instructions, under contracts that require them to protect the data and forbid using it for their own purposes. We do not sell personal information, and we do not share it for cross context behavioural advertising, as those terms are used in United States privacy law.

If you choose to hand your leads to The General, that information moves to a separate DFX Intelligence product with its own terms. You have to ask for that explicitly, we record when you did, and nothing moves before then.

We will also disclose data where the law requires it, and if the business is ever sold or reorganised, in which case this policy travels with it and you will be told before anything changes.

Our systems and providers are in the United States. If you are in the United Kingdom or the European Economic Area, your data is transferred there under the standard contractual clauses, or an equivalent approved mechanism, in our contracts with those providers.

Traffic is encrypted in transit. Sessions are signed tokens rather than passwords, so there is no password of yours for us to lose. Sign in codes and links are stored as hashes and are single use. IP addresses and browser strings are only ever stored hashed with a private salt. Access to the production database is limited to the people who operate it. If a breach ever affects you, we will tell you and the relevant regulator within the time the law allows, and we will tell you what actually happened.

A signed session cookie, which is what keeps your leads attached to you across refreshes, and a short lived cookie that remembers an invite link you followed so the person who invited you gets credit. There are no advertising, analytics or third party cookies on this site, which is also why there is no cookie banner asking you to agree to any.

The account page has a delete button. It removes your account, your searches, your history, your ratings and your saved leads. Purchase records are kept where tax law requires it, without the rest of your profile attached. You do not have to email anybody to make it happen.

Depending on where you live you may have the right to know what we hold, to get a copy, to correct it, to take it elsewhere, to have it erased, to object to or restrict processing, and to withdraw consent. Residents of California and other United States states with comparable laws have the rights to know, delete, correct and opt out; we do not sell or share personal information, so there is nothing to opt out of, and we will never treat you differently for exercising any of this.

Email hello@dfxintel.com and we will do it. No forms, no account required, and we answer within 30 days. If we ever refuse, we will say why. In the United Kingdom or European Economic Area you also have the right to complain to your data protection authority, and we would rather you told us first.

This is a business tool and is not for anybody under 16. We do not knowingly collect data from children, and if we learn that we have, we delete it.

If we change anything material here we will update the date at the top and email account holders before it takes effect. We will not quietly widen what we do with data already collected.

DFX Intelligence, hello@dfxintel.com.