Privacy policy

Last updated: October 27, 2026

This Privacy Policy explains how Alain Business Center Technology ("Fullturn," "we," "us") collects, uses, and protects information in connection with the Fullturn platform (getfullturn.com). It covers two distinct roles Fullturn plays, which is important for understanding your rights:

For account-holder data (the people who sign up for and use Fullturn), Fullturn is the data controller.
For Customer's contact data (the contacts and companies a Customer imports, enriches, or emails through Fullturn), Fullturn's Customer is the data controller and Alain Business Center Technology acts as the data processor, acting only on Customer's instructions.

If you are a person who received an email sent through Fullturn, or whose information was imported into Fullturn, please direct privacy requests to the business that used Fullturn to contact you first. If that is not practical, contact us at support@getfullturn.com and we will route your request to the relevant Customer or handle it directly where appropriate.

1. Information we collect

Account data: name, email address, and a securely hashed password (bcrypt) for anyone who creates a Fullturn account, plus team membership and role information.

Customer-imported contact data: when a Customer imports or connects contacts, Fullturn processes whatever fields the Customer supplies or enriches — for example name, email address, job title, company, LinkedIn URL, and engagement history (opens, clicks, replies). Fullturn processes this data as instructed by the Customer, who is the controller of it.

Provider credentials: API keys and OAuth tokens for third-party integrations a Customer configures (for example AI providers, email-sending providers, or mailbox OAuth) are encrypted at rest using AES-256-GCM.

Email content and engagement tracking: outbound emails sent through Fullturn include invisible open-tracking pixels and click-tracked links so Customer can measure engagement. Fullturn records when an email is opened or a link is clicked, and associates that event with the recipient contact record.

Lead-capture form submissions: when a visitor submits a lead-capture form on a Customer's published article or site, Fullturn records the submitted fields (for example name, email, and message) on behalf of that Customer.

2. Cookies

Fullturn uses only strictly-necessary cookies — specifically a session authentication cookie required to keep you signed in. Fullturn does not use advertising cookies, third-party analytics cookies, or any cookie that requires consent under applicable ePrivacy law. Because Fullturn does not set non-essential cookies, we do not display a cookie consent banner.

3. Sub-processors

Fullturn uses sub-processors to provide the Service. The specific sub-processors engaged for a given Customer depend on which integrations that Customer configures. Categories of sub-processor include:

AI model providers (for example Anthropic, OpenAI, DeepSeek, Google Gemini) — used for SEO content generation and email drafting;
Email-sending infrastructure (the mailboxes you connect, such as Microsoft 365, Google Workspace or your own SMTP server), used to deliver outbound campaigns;
Mailbox OAuth providers (Google, Microsoft) — used to connect a Customer's sending mailbox and unified inbox;
Contact-data and enrichment providers (for example People Data Labs) and email-verification services — used to build and validate contact lists;
Twilio — used for call/SMS-adjacent features where enabled;
Hosting, database, and infrastructure providers (for example Vercel, Neon, Upstash, Inngest) — used to run the application, store data, cache, rate-limit, and schedule background jobs.

We maintain data processing terms with our sub-processors consistent with our obligations under GDPR and equivalent laws. A current list of active sub-processors for your account is available on request at support@getfullturn.com.

3a. Google user data

When you connect a Google mailbox, Fullturn asks Google for permission to see the email address you signed in with and to send email as that mailbox (the Gmail send permission). That is all Fullturn asks for by default. Fullturn uses this access only to:

show which mailbox you connected;
send the one-to-one business emails and replies you write or approve in Fullturn, from the mailbox you chose, with an unsubscribe option.

Fullturn does not ask Google for permission to read your Gmail. To track replies for a mailbox, you connect it with an app password over IMAP instead of through Google sign-in. A mailbox connected before October 27, 2026 may still hold the broader permission it was given then; for those mailboxes Fullturn uses it only to recognise replies to emails Fullturn sent, so a contact who answers is taken out of the sequence, and never to move, label, archive or delete a message. If Fullturn ever offers an optional step that reads replies through Google, it will ask you separately, for that mailbox only, and this policy will be updated first.

Fullturn never reads your other mail, never uses Google user data to build advertising profiles, never sells it, never uses it to train generalized AI models, and never lets a person read it except with your explicit consent, for security or abuse investigation, or where the law requires. Google user data is stored encrypted and deleted when you disconnect the mailbox or delete your workspace. You can also revoke Fullturn's access at any time in your Google Account permissions.

Fullturn's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3b. Browser extension

The Fullturn Lead Extractor browser extension reads the LinkedIn people-search page you have open, only when you press a button, and sends the people it lists to your own Fullturn workspace. What it reads, sends and stores is described in the extension privacy policy.

4. Retention

We retain account data for as long as the account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce agreements. Customer contact data is retained per the Customer's configuration and instructions, including suppression/unsubscribe records, which we retain indefinitely so that a previously-unsubscribed or erased address is not re-imported and re-contacted.

5. Your rights (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, individuals have the right to access, export, correct, and erase their personal data, and to object to or restrict certain processing. For account holders, Fullturn provides an in-app data export tool and honors deletion requests sent to support@getfullturn.com. For Customer contact data, Fullturn provides its Customers with in-app tools to export a full record of what is held about a contact and to erase a contact's personal data (which anonymizes the record and preserves only a suppression entry so the address cannot be re-imported and re-emailed). If you are a contact who wants to exercise these rights directly, email support@getfullturn.com and we will either action the request or direct it to the relevant Customer as required.

Account deletion for account holders is currently handled by request — contact support@getfullturn.com to request deletion of your account.

6. International transfers

Fullturn and its sub-processors may process and store data in countries other than where you or Customer's contacts are located, including the United States and the United Arab Emirates. Where we transfer personal data protected by GDPR or UK GDPR internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognized under applicable law.

7. Security

We use industry-standard technical measures to protect data, including HTTPS/TLS in transit for all traffic, AES-256-GCM encryption at rest for stored integration credentials, hashed (bcrypt) account passwords, and role-based access controls within each Customer's team. No method of transmission or storage is 100% secure, but we work to protect data using measures appropriate to its sensitivity.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

9. Contact

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to support@getfullturn.com.