Privacy Policy

As a controller, we process personal data about Site visitors, prospects who book a walkthrough, and account users.

As a processor, we process personal data contained in client data that the Service connects to and analyses for the client.

Empowered House P.S.A. operates the Empowered Intelligence product. It is the controller of Site and account data and the processor of client data. Empowered House P.S.A. is a simple joint-stock company (prosta spolka akcyjna) organized under the laws of Poland.

• Registered office: Droga Debinska 3A/3, 61-555 Poznan, Poland
• Court register (KRS): 0001253770
• VAT ID (NIP): PL 7831958235
• REGON: 545235669
• Contact for privacy matters: contact@empowered.house

We collect identity and contact data through the Site and walkthrough booking, including your name, work email, company, and role. We store contact form submissions in our own database, where only administrators of our content management system can see them, and in Attio, the CRM we use to manage contacts. We also collect information you provide about your organization and data sources, plus technical and usage data such as your IP address, device and browser data, and interactions recorded through cookies and similar technologies.

For account and pilot users, we collect account data such as name, work email, role, and authentication data. We also collect product usage data, including queries run, features used, and logs needed to operate and secure the Service.

Our legal bases are pre-contract steps and contract performance; legitimate interests in running, securing, and improving the Site and Service; consent for non-essential cookies and any marketing; and legal obligations such as accounting.

When a client connects Empowered Intelligence to its data, such as Roam, Notion, Airtable, Attio, Recruitee or a Google BigQuery dataset, the Service builds a semantic company model over the data and runs analytical queries against it. The connected data may contain personal data about the client's employees, customers, or contacts.

• The client is the controller and decides what data is connected and why.
• Empowered Intelligence acts as a processor and processes the data only on the client's documented instructions, as set out in the Data Processing Agreement between us.
• We do not use client data to train models or for any purpose other than providing the Service on the client's instructions.

The Service uses AI models from 2 sub-processors, each under contractual terms. Anthropic provides the Claude models that answer questions, extract statements from connected sources and write summaries; the relevant parts of client data are sent to Anthropic for this. OpenAI turns the text of extracted statements into embeddings, numerical representations the Service uses to find related statements; that text is sent to OpenAI for this.

Anthropic and OpenAI are based in the United States. Under their terms for business use, data sent to them through their APIs is not used to train their models.

The Service runs on Google Cloud. Its database is in the europe-west1 region, in Belgium. A client's BigQuery dataset stays in the region set for that dataset; when no region is chosen, BigQuery uses the US multi-region, so clients who need the EU should choose an EU region when the dataset is created. Dedicated, private cloud or on-premise hosting is available for regulated clients on request.

Answering a question or indexing a source involves sending relevant data to the AI sub-processors described above, which may process it in the United States under appropriate safeguards.

Before you choose in the cookie banner, and if you decline, PostHog counts page views and clicks anonymously: without cookies, without storing anything in your browser, and without identifying you; to count unique visits, PostHog uses a hash of your IP address and browser that changes every day. This counting is based on our legitimate interest in knowing how the Site is used (Art. 6(1)(f)). Analytics cookies, PostHog with cookies, Google Analytics, Snitcher and the LinkedIn Insight Tag run only after you click Accept; until then, the Site sends Google Analytics, Snitcher and LinkedIn nothing. The contact form is the one exception: it loads Google reCAPTCHA when you send it, as described below. With your consent, we use Google Analytics cookies to measure visits and usage of the Site.

The Site uses strictly necessary cookies to function. Only where you consent, we use PostHog with cookies for product and usage analytics; you can grant, decline, or withdraw consent through the cookie banner and your browser. Withdrawing consent does not affect processing carried out before the withdrawal. With your consent, PostHog may also record how you move through pages, such as clicks, scrolls and page changes, to help us fix usability problems. Anything you type into a form is masked and never recorded.

With your consent, we also use Snitcher, a business-visitor identification service that uses your IP address to identify the company or organization behind a visit. It identifies the business, not you as an individual, and sets one cookie, snitcher_device_id, kept for up to 1 year, plus short-lived session entries in your browser's storage, to distinguish visitors. Snitcher processes data within the EU (AWS, Frankfurt).

With your consent, we also use the LinkedIn Insight Tag. It lets LinkedIn count visits that come from our LinkedIn ads and show our ads to people who visited the Site. LinkedIn sets its own cookies and processes this data under its own privacy policy; it reports to us only totals and groups, not who you are. Until you click Accept, the tag does not load.

The contact form is protected by Google reCAPTCHA v3, which keeps automated spam out. When you submit the form, reCAPTCHA collects your IP address, browser and device data, and how you interacted with the page, and sends them to Google, which may set its own cookies. We use the result only to decide whether a submission came from a person. Google's processing is covered by the Google Privacy Policy and Terms of Service.

We share personal data with the following recipients:

• Service providers and sub-processors that help us run the Site and Service. These include Google Cloud for hosting, Anthropic and OpenAI for AI models, Attio as the CRM for contact form submissions, PostHog and Google Analytics for analytics, Snitcher for business-visitor identification, Google reCAPTCHA for spam protection on the contact form, and our hosting, cloud-infrastructure, email, and scheduling providers.
• Professional advisers when necessary.
• Public authorities when required by law.

We do not sell personal data.

Some sub-processors may process data outside the European Economic Area. These include Anthropic and OpenAI in the United States, Google, for reCAPTCHA, in the United States and, depending on the configured region, PostHog and Attio. Google may also process Google Analytics data in the United States. Snitcher processes data within the EU (AWS, Frankfurt). LinkedIn may process Insight Tag data in the United States. For processing outside the European Economic Area, we rely on an adequacy decision or appropriate safeguards such as the Standard Contractual Clauses. Details are available on request and in the DPA.

• Site and walkthrough enquiry data, in our database and in Attio: kept for up to 24 months after last contact, unless you ask us to delete it sooner.
• Account data: kept for the life of the account and a limited period afterwards.
• Client data processed as a processor: kept while the client's organisation exists in the Service, and returned or deleted on the client's written request as set out in the DPA. Database backups are kept for 7 days.
• Logs and security data: kept only as long as needed to run and secure the Service, then deleted.

We maintain technical and organizational measures appropriate to the risk. Access to client data is controlled at the data-source level, for example BigQuery roles, with access controls and logging. Data is encrypted in transit and, by Google Cloud, at rest. Access tokens for connected tools and BigQuery keys are additionally encrypted by the Service itself (AES-256-GCM, with keys held in Google Cloud KMS).

We are working toward recognized certifications, including SOC 2 and ISO/IEC 27001; we do not yet hold either certification. Current status and any available reports can be requested at contact@empowered.house.

If we are the controller of your data, you have rights to access, rectification, erasure, restriction, objection, and portability. You may also withdraw consent where processing is based on it. To exercise a right, contact contact@empowered.house.

If your personal data is part of a client's connected data, the client is the controller; please direct your request to that client, and we will assist them as required by the DPA.

You may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, or with the authority in your country of residence.

The Service is a business product and is not directed at children. We do not knowingly collect data from children under 16.

We may update this policy. The current version and its effective date are posted on this page; material changes will be made clear.

Send privacy questions to contact@empowered.house. Empowered Intelligence is built by EmpoweredHouse, a software company backed by Appunite.