Validity Date: 15 July 2026
1. Introduction
At Filigran, we take your privacy seriously and are committed to protecting your Personal Data. This Privacy Policy explains how we handle your Personal Data, outlines your privacy rights and describes how applicable law protects you.
This Privacy Policy applies where Filigran acts as a Controller in connection with our website (filigran.io), Filigran Academy (academy.filigran.io) and our marketing, sales, business-development, account-administration and recruitment activities. This Privacy Policy does not cover personal data processed within our platforms. Where we host a platform for a customer (SaaS), that processing is addressed in the applicable Data Processing Agreement. Where a customer self-hosts (on-premises), the customer is responsible for that processing.
Please refer to the Glossary at the bottom of the Privacy Policy to understand the meaning of any defined terms used.
2. Who We Are
The following Filigran group entities may act as Controller or co-Controller responsible for processing your Personal Data, depending on your location and the nature of your interaction with us.
| Entity | Legal Name | Address |
| Filigran France | Filigran SAS | 66 avenue des Champs Élysées, 75008 Paris, France |
| Filigran USA | Filigran Inc. | 3500 DuPont Highway, Dover, DE 19901, USA |
| Filigran Australia | Filigran Australia Pty. Ltd | Suite 1101, Level 11, 68 York Street, Sydney, NSW 2000, Australia |
| Filigran Singapore | Filigran Singapore Pte. Ltd. | 9 Raffles Place, #26-01, Republic Plaza, Singapore 048619 |
The lead Controller for the purposes of GDPR is Filigran SAS (France). For data subjects located outside the EU/EEA, the relevant local entity above may act as Controller or as a representative of Filigran SAS.
For any privacy-related enquiries, please contact us at privacy@filigran.io regardless of your location.
3. How to Contact Us
If you have any general questions or concerns about this Privacy Policy or our processing of your Personal Data, you can contact us at privacy@filigran.io.
4. Types of Data We Collect About You
We may collect, use, store, and transfer one or more of the following categories of Personal Data about you, depending on the nature of your interaction with us:
- Identity Data: first name, last name, job title, company name, LinkedIn profile, employment role, employment seniority, and employment sub-role;
- Contact Data: email address, country, city, state/region, and time zone;
- Technical Data: IP address, IP-based location (city, country, region), and request metadata;
- Usage and Marketing Data: contact source, recent conversion page, last referring site, last page viewed, and clickstream or feature-usage data (where collected with your consent via cookies or similar technologies); and
- Account Data: user ID and account credentials.
- Recruitment Data: where you apply for a role with us, your name, email address, telephone number, CV/résumé information, LinkedIn profile, employment and work history, salary expectations, and right-to-work/visa information.
5. How Your Personal Data Is Collected
We use various methods to collect Personal Data from and about you, including through the following:
- Direct interactions — You may provide Personal Data to us by filling in forms or by corresponding with us by phone, email, or otherwise. This includes data you provide when you create a Filigran account (for example on XTM Hub or Filigran Academy), contact us to book a demo, complete surveys, participate in events, engage with our customer service and support, or interact with us for business-development purposes. We may also receive your contact details when they are shared with us by a colleague or event organiser.
- Automated technologies or interactions — We may collect Technical Data about your browsing actions and usage patterns as you interact with our Online Services, but only where you have provided your consent. This data may be collected using cookies, pixel tags, server logs and other similar technologies. For more details, please refer to our Cookie Policy.
- Third parties or publicly available sources — We may receive Personal Data about you from external sources, including content syndication and lead-generation partners, event co-hosts and organisers, business partners, data enrichment services, publicly available sources and third-party databases. In some cases, for example, where you download our content via a partner’s platform, we may obtain your details wholly from these third parties rather than directly from you. Where we obtain your Personal Data indirectly, this Privacy Policy tells you the categories of sources we use, and you can ask us for the specific source of your data at any time.
6. How We Use Your Personal Data
Below, we outline the ways in which we use your Personal Data, along with the legal bases we rely on to do so. Please note that we may process your Personal Data under more than one Lawful Basis, depending on the specific purpose for which it is being used. For more details about the Lawful Bases we rely on, please refer to the Glossary section.
| Purpose of Processing | Type of Personal Data Processed | Lawful Basis for Processing | Disclosure to Third Parties |
| Create and manage your Filigran account | Identity Data, Contact Data (email, country, job title), Account Data | Performance of a contract | Auth0, HubSpot |
| Register contacts; respond to demo and contact-form requests; manage the commercial relationship | Identity Data, Contact Data | Legitimate Interests (B2B commercial development) | HubSpot |
| Segment contacts and tailor communications | Contact Data (location, time zone), Identity Data (employment role, seniority, sub-role) | Legitimate Interests | HubSpot |
| Send marketing communications | Identity Data (name), Contact Data (email) | Consent | HubSpot |
| Website and contact analytics (tracking visitor behaviour and interactions) | Technical Data, Usage and Marketing Data | Consent (via cookie/tracker consent) | HubSpot and providers listed in the Cookie Policy |
| Product and feature-usage analytics | Pseudonymised Account Data (user ID), Usage and Marketing Data (clickstream) | Consent (where cookie-based) | PostHog |
| Manage customer relationships and record account interactions (CSM activities) | Identity Data (name, title), Contact Data (email) | Legitimate Interests / Performance of a contract | Planhat |
| Provision and manage support accounts | Contact Data (email) | Performance of a contract | Jira |
| Manage recruitment: evaluate candidates, communicate with applicants, schedule interviews and assess qualifications | Recruitment Data | Taking steps at the candidate’s request prior to entering a contract; Legitimate Interests (assessing suitability); and, for right-to-work/visa checks, compliance with a legal obligation | Ashby (ATS), LinkedIn Recruiter, recruitment agencies |
| Maintain a talent pipeline for future opportunities | Recruitment Data | Consent | Ashby (ATS) |
| General customer and prospect data analysis | Identity Data (name), Contact Data (email) | Legitimate Interests | OpenAI, Anthropic |
The specific processors supporting each activity are set out in Annex 1, which forms an integral part of this Privacy Policy and is the definitive list of our processors. The advertising and analytics providers used for cookies are identified in our Cookie Policy.
7. Change of Purpose
We will only use your Personal Data for the purposes for which it was collected, unless we reasonably determine that a different use is compatible with those original purposes. If we ever need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis for doing so.
In limited cases, we may process your Personal Data without your knowledge or consent, but only where required or permitted by law and always in accordance with our legal obligations and data protection responsibilities.
8. International Transfers
We may transfer your Personal Data outside the European Economic Area (EEA) or the United Kingdom (UK) to third-party service providers based in other countries.
Where such transfers are to countries that do not offer an adequate level of data protection under applicable laws, we implement appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or other approved mechanisms, to ensure your data remains protected.
9. Data Security
We have implemented appropriate technical and organisational security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your Personal Data to those employees, agents, contractors, and other third parties who have a business need to know. They will only Process your data on our instructions and are subject to a duty of confidentiality.
We have procedures in place to deal with any suspected Personal Data breach or incident and will notify you and any applicable regulator of a breach where we are legally required to do so.
10. Data Retention
We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, provide our Services, comply with legal obligations, resolve disputes, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.
To determine the appropriate retention period, we consider the type and sensitivity of the data, the purpose for Processing, potential risks, and legal requirements.
Where Personal Data is no longer needed, we will securely delete or anonymise it. In some cases, we may retain anonymised data for analytical or statistical purposes indefinitely.
Where you apply for a role with us and are not successful, we retain your Recruitment Data for no longer than two (2) years from our last meaningful interaction with you, unless you have consented to us retaining it for longer to consider you for future opportunities, or we are required to retain it to comply with a legal obligation.
11. Your Legal Rights
You have the following rights in relation to your Personal Data, subject to certain conditions under applicable data protection laws:
- Access — You have the right to request information about how we Process your Personal Data and to access the Personal Data we hold about you.
- Correction — You may request the correction of inaccurate Personal Data we hold about you.
- Erasure — You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent or successfully objected to Processing, in accordance with applicable law.
- Restriction — You may request that we suspend the Processing of your Personal Data in certain circumstances. In such cases, we will only retain the data for the exercise or defence of legal claims.
- Portability — You may request to receive your Personal Data in a structured, commonly used, and machine-readable format, and to have that data transmitted to another party, where technically feasible.
- Object/Withdrawal of consent — You may object to the Processing of your Personal Data where we rely on legitimate interest or withdraw your consent at any time where Processing is based on consent.
- Complaint — You may raise a data protection complaint directly with Filigran in the first instance by contacting us at privacy@filigran.io. We will acknowledge your complaint within 30 days of receipt, investigate it promptly, and keep you informed of the outcome without undue delay. You also have the right to lodge a complaint with a supervisory authority at any time: in France, the Commission Nationale de l’Informatique et des Libertés (CNIL), www.cnil.fr, which is the lead supervisory authority for Filigran SAS; if you are in the United Kingdom, the Information Commissioner’s Office (ICO), www.ico.org.uk; if you are in Australia, the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au; and, if you are in the United States, your rights and the authority to whom you may complain will depend on your state of residence. Raising a complaint with us first does not affect your right to complain to a supervisory authority.
The exercise of some of these rights (in particular the rights to erasure, restriction of Processing, or objection) may prevent Filigran from being able to provide all or part of the Online Services, where the Processing of Personal Data is strictly necessary for the performance of the contract.
To exercise any of the rights listed above (other than the right to lodge a complaint with the CNIL), please contact us at privacy@filigran.io.
12. Third Party Websites
Our Online Services may contain links to third-party websites or applications, and other websites or applications may link to ours. These third-party services are not under our control, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party websites or applications you visit or interact with.
13. Cookies
For more information about the cookies we use, please refer to our Cookie Policy.
14. Changes to Our Privacy Policy
We may update this Privacy Policy from time to time in our sole discretion. If we make any material changes, we will notify you in accordance with applicable legal requirements. Your continued use of our Online Services after any updates take effect is subject to the updated Privacy Policy.
15. Additional Information for United States (California and Other State) Residents
This section provides additional information required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA/CPRA”), and applies to California residents. The relevant Filigran entity for US residents is Filigran Inc., 3500 DuPont Highway, Dover, DE 19901, USA.
Categories of personal information. We may collect the categories of personal information described in the “Types of Data We Collect About You” section above. For CCPA/CPRA purposes, these fall within the following statutory categories: identifiers; internet or other electronic network activity information; professional or employment-related information; and commercial information. We collect this information from the sources, and for the purposes, described elsewhere in this Privacy Policy.
Sale and sharing of personal information. We do not sell your personal information for money. We may “share” certain online identifiers and internet-activity information with advertising and analytics partners for cross-context behavioural advertising through cookies and similar technologies. You can opt out of this sharing at any time using our cookie settings tool, and we honour Global Privacy Control (GPC) browser signals. We do not knowingly sell or share the personal information of consumers under 16 years of age.
Sensitive personal information. We do not use or disclose sensitive personal information for purposes that would give rise to the right to limit its use under the CPRA.
Your California rights. Subject to applicable law, you have the right to: know about and access the personal information we have collected about you; delete your personal information; correct inaccurate personal information; opt out of the sale or sharing of your personal information; limit the use of sensitive personal information; and not receive discriminatory treatment for exercising your rights.
How to exercise your rights. You may submit a request by emailing privacy@filigran.io. To verify your request, we may ask you to provide your first and last name, email address, and city and state of residence, and to confirm which right you wish to exercise; we can only act on verified requests. You may use an authorised agent to submit a request on your behalf, accompanied by proof of authorisation.
Other US states. Residents of other US states with comprehensive privacy laws (including Delaware, Colorado, Connecticut, Virginia, Utah and Texas) may have similar rights to access, correct, delete, and opt out of targeted advertising or the sale of their personal information. To exercise any such rights, please contact us at privacy@filigran.io.
US contact: Filigran Inc., 8 The Green, #20799, Dover, DE 19901, USA; privacy@filigran.io
Glossary
- Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
- Data Protection Legislation means any applicable data protection laws and regulations, including (without limitation) the General Data Protection Regulation (EU) 2016/679 (GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), the French Loi Informatique et Libertés (Law No. 78-17 of 6 January 1978, as amended), and any other applicable data protection laws in the jurisdictions where the relevant Filigran entity operates.
- Lawful Basis/Bases means the legal grounds on which we are permitted to Process your personal data under Data Protection Legislation.
- Online Services means all digital products and services provided by Filigran, including our website (filigran.io), Filigran Academy (academy.filigran.io), any product demonstration or trial environments, and any paid subscription products and services.
- Personal Data means any information about an individual from which that person can be identified. It does not include where the identity has been removed (i.e. anonymised data).
- Processor means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller.
- Processing means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, use, storage, disclosure, transfer, or deletion.
- Technical Data means internet protocol (IP) addresses, IP-based location data, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access our Online Services.
Annex 1 – List of Processors
The processors below support the processing activities described in this Privacy Policy. Where a processing location is marked for confirmation, the actual location depends on the region selected in that provider’s configuration.
| Company Name | Processing | Location of Processing | Who Is Impacted |
| Auth0 | Account creation and authentication | European Union (Frankfurt, with failover to Dublin) | Account holders (XTM Hub and Filigran Academy) |
| HubSpot | CRM, marketing communications, contact segmentation and website/contact analytics | European Union | Prospects, business contacts, marketing subscribers and website visitors |
| PostHog | Product and feature-usage analytics | European Union | Account holders / product users |
| Planhat | Customer success management | European Union | Customer contacts |
| Jira (Atlassian) | Support ticket management | European Union | Support account holders |
| Ashby | Applicant tracking system (recruitment) | AWS – United States | Job applicants / candidates |
| LinkedIn Recruiter | Candidate sourcing (recruitment) | United States | Job applicants / candidates |
| OpenAI | LLM (Large Language Model) | AWS – United States | Prospects, customers users, marketing subscribers and website visitors |
| Anthropic | LLM | AWS – United States | Prospects, customers users, marketing subscribers and website visitors |