Privacy Policy

Aderic is operated by FireFly Tech Oy, a limited liability company registered in Finland, VAT number FI33521654, with its registered address at Sienimaenkatu 7C 24, 55510, Imatra, Finland (“Aderic,” “we,” “us,” or “our”).

This Privacy Policy explains how we collect, use, disclose, and protect information when you visit aderic.io, create an Aderic account, use the Aderic platform, participate in a trial, purchase lead credits, or otherwise interact with us.

Aderic is designed primarily for business use. It helps businesses that sell products or services into construction projects identify relevant opportunities, conduct targeted business outreach, and manage interested commercial conversations.

1. Information We Collect

Account Information

When you create an Aderic account, we may collect information such as:

• your name;
• work email address;
• account identifiers;
• authentication information;
• profile information provided by an authentication provider;
• your organization or business association.

If you sign in using Google, we may receive basic account information made available through the permissions you approve, such as your name, email address, profile image, and Google account identifier.

Business Profile Information

When you configure Aderic for your business, we may collect information such as:

• company name;
• company website;
• business type;
• products or services you want Aderic to promote;
• service territory or geographic coverage;
• project preferences;
• exclusions and targeting criteria;
• approved business descriptions;
• sender name and business email address;
• campaign settings and instructions.

We use this information to understand which construction opportunities may be relevant to your business.

Construction Project and Business Contact Information

Aderic may process information about construction projects, companies, contractors, developers, suppliers, and professional business contacts.

This information may come from:

• public records;
• building permit and construction data providers;
• company websites;
• professional and business directories;
• publicly available business information;
• search services;
• data providers that permit the relevant use;
• information provided directly by our customers or recipients.

Such information may include:

• project names and addresses;
• permit or project information;
• company names;
• professional roles;
• business email addresses;
• business phone numbers;
• project associations;
• publicly available company information;
• information relevant to determining whether a commercial opportunity may be appropriate.

Aderic is not intended to provide a general-purpose database of personal information or a bulk contact database.

Outreach and Communication Information

When an Aderic customer authorizes outreach, we may process information necessary to operate and monitor that outreach, including:

• sender identity;
• recipient business contact information;
• message content;
• message and conversation identifiers;
• delivery status;
• bounce information;
• replies;
• opt-out or do-not-contact requests;
• conversation status;
• Aderic’s classification of whether a response represents a qualified lead.

We may display relevant conversations and responses to the Aderic customer on whose behalf the outreach was performed.

Sending Connection Information

If you connect a business email address or another sending method to Aderic, we may process information required to establish and maintain that authorized connection.

Depending on the connection method, this may include:

• sender email address;
• sender display name;
• connection status;
• verification status;
• provider identifiers;
• authorization information;
• app-specific credentials or tokens where required by the supported connection method.

Aderic does not require you to provide the primary password for your email account.

Payment Information

When you purchase Aderic lead credits, payments are processed by a third-party payment provider or merchant of record.

We may receive and store information such as:

• customer identifier;
• transaction identifier;
• amount paid;
• currency;
• product or credit package purchased;
• payment status;
• refund status.

We do not need to receive or store your complete payment card number in order to provide the Service.

Usage, Device, and Security Information

We may automatically receive limited technical information when you use Aderic, including:

• IP address;
• browser and device information;
• requested pages;
• timestamps;
• session and authentication events;
• application errors;
• security and abuse-prevention logs.

We use this information to operate, secure, debug, and improve Aderic.

2. How We Use Information

We use information to:

• create and maintain user accounts;
• authenticate users;
• provide the Aderic platform;
• understand a customer’s business and offering;
• enforce confirmed geographic targeting;
• identify potentially relevant construction projects;
• research relevant companies and professional contacts;
• evaluate whether a project may fit a customer’s offering;
• prepare authorized business communications;
• send and manage authorized outreach;
• detect replies and stop applicable follow-up;
• classify and display qualified leads;
• notify customers about relevant results;
• provide customer support;
• process purchases and maintain lead-credit balances;
• detect fraud, abuse, security incidents, and technical failures;
• comply with applicable legal obligations;
• maintain and improve the reliability and quality of Aderic.

We may also use aggregated or de-identified information to understand product performance and improve the Service where such information can no longer reasonably identify an individual.

3. Artificial Intelligence

Aderic uses artificial intelligence to perform functions such as:

• understanding business offerings;
• evaluating construction project relevance;
• researching relevant business context;
• preparing personalized business communications;
• interpreting responses;
• summarizing conversations;
• determining whether a response appears to represent commercial interest;
• assisting with appropriate next steps.

Information reasonably necessary to provide these features may be processed by third-party artificial intelligence service providers acting on our behalf, including OpenAI.

Depending on the feature, this information may include business profile information, construction project information, relevant company or professional contact context, message drafts, and conversation content processed through Aderic.

Authentication secrets, Google OAuth access or refresh tokens, email App Passwords, payment credentials, and similar security credentials are not intentionally provided to artificial intelligence models.

AI-generated information may be inaccurate or incomplete. Aderic uses structured data, source information, software rules, automated safeguards, and, where appropriate, human review to reduce errors, but we do not guarantee that AI-generated information will always be correct.

We do not sell private customer communications to AI providers.

We do not use information obtained through Google APIs to train, fine-tune, or improve generalized or foundation artificial intelligence or machine-learning models.

Additional information about how Aderic uses artificial intelligence is available on our AI Transparency page at aderic.io/ai-transparency.

4. Google User Data and Gmail Integration

Aderic allows users to connect supported Google accounts, including Gmail and Google Workspace accounts, to provide account authentication and email-sending functionality.

Google account information

If you use Google Sign-In or connect a Google account, Aderic may receive basic account information that you authorize, such as your name, email address, profile image, Google account identifier, and information necessary to maintain the authorized connection.

We use this information to authenticate you, associate the connected Google account with your Aderic account, display connection information, secure the integration, and provide the Google-enabled functionality that you choose to use.

Gmail sending permission

If you connect Gmail or Google Workspace for sending, Aderic may request the following Google OAuth permission:

https://www.googleapis.com/auth/gmail.send

This permission allows Aderic to send email from the connected Gmail or Google Workspace account on behalf of the user.

Aderic uses this permission only to provide email-sending functionality that the user enables through Aderic.

Aderic does not request Google API permission to read, modify, organize, or delete the user's Gmail inbox for this functionality.

Aderic does not use the Gmail API to synchronize or copy the user's general Gmail inbox.

Replies to Aderic-managed business communications may instead be processed through Aderic-managed reply addresses and conversation-routing infrastructure so that Aderic can detect responses, stop applicable follow-up, classify responses, and display relevant commercial conversations without requiring general Gmail inbox access.

Connecting Google for sending requests only openid, email, and gmail.send. The identity permissions identify the connected account; the sending connection does not request profile, Gmail inbox contents, mailbox history, labels, contacts, or other mailbox read access.

Gmail API sending is limited to supplier replies authorized in validated existing conversations after a bound recipient response, and explicitly enabled noncommercial connection checks between controlled accounts. Connecting a mailbox does not establish recipient consent. Aderic blocks unsolicited commercial first messages through Google OAuth. Replies reach Aderic through reply.aderic.io and Cloudflare, not through Gmail inbox access.

OAuth credentials

To maintain a Google connection and perform authorized sending when the user is not actively using the browser, Aderic may securely process and store Google OAuth access and refresh tokens.

These credentials are used only to maintain the integration and perform functionality authorized by the connected user.

OAuth credentials are treated as sensitive authentication information, protected using appropriate technical and organizational safeguards, and are not intentionally provided to artificial intelligence models.

Sending tokens are encrypted at rest using AES-256-GCM and remain on Aderic's servers. They are not returned to the user's browser, included in message content, or sent to AI providers. This Gmail relay feature sends the supplier's authored reply without passing it to an AI model; other AI-assisted features may process drafts and conversation content as described in this policy and our AI Transparency page.

Disconnect removes the active sending tokens from Aderic's connection record and stops new operations. Aderic also requests revocation from Google. If Google revocation cannot be confirmed, the connection stays disabled and Aderic tells the user to remove access in Google Account settings. Disconnection does not delete historical conversations, sending receipts, or suppression records retained under this policy.

App Password connections

Existing legacy email connections may use a Google-generated application-specific password. New customer connections use Gmail or Microsoft OAuth.

An App Password is a separate credential created by the user through Google for use by a specific application.

Aderic does not request or require the user's ordinary Google Account password.

Where an App Password is used, Aderic processes it only to authenticate the email connection and send messages through the connected account as authorized by the user.

App Passwords are treated as sensitive authentication credentials and are not intentionally provided to AI models.

How we use Google user data

Aderic uses information received from Google APIs only to provide or improve user-facing features that the user has chosen to enable.

We do not:

• sell Google user data;
• use Google user data for targeted advertising;
• transfer Google user data to data brokers or information resellers;
• use Google user data to create advertising profiles;
• use Google user data for credit-worthiness or lending decisions;
• use Google user data for unrelated surveillance or profiling;
• use Google user data to train, fine-tune, or improve generalized or foundation AI or machine-learning models.

Aderic's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Service providers

Where necessary to operate Aderic, information may be processed by service providers acting on our behalf for purposes such as hosting, security, application infrastructure, and user-facing artificial intelligence functionality.

We limit such processing to what is reasonably necessary to provide or support the applicable Aderic feature and subject it to the restrictions described in this Privacy Policy.

Google OAuth access tokens, refresh tokens, App Passwords, and similar authentication secrets are not intentionally provided to OpenAI or other AI models.

Disconnecting Google

You may disconnect your Google account from Aderic through the applicable account or integration settings.

After disconnection, Aderic will stop using that authorization for new actions and will remove, disable, or otherwise invalidate active integration credentials in accordance with our security and deletion procedures.

You may also revoke Aderic's access directly through your Google Account settings.

Certain records created while you used Aderic, such as message status, conversation records, security logs, billing information, suppression records, and audit information, may remain where reasonably necessary for the purposes and retention periods described elsewhere in this Privacy Policy.

5. How We Share Information

We do not sell personal information.

We may share information only as reasonably necessary with the following categories of recipients.

Service Providers

We use service providers for functions such as:

• cloud hosting and database infrastructure;
• authentication;
• email delivery and campaign operations;
• AI processing;
• construction and business data;
• search and information retrieval;
• payments;
• application monitoring and security.

These providers may process information only to the extent necessary for the services they provide to us, subject to their applicable agreements and policies.

Aderic Customers and Business Recipients

If Aderic conducts outreach on behalf of a customer, relevant information about that customer and its offering may be communicated to an intended business recipient.

If a recipient replies, the relevant reply and conversation information may be shown to the Aderic customer whose business initiated the outreach.

Legal and Safety Disclosures

We may disclose information when reasonably necessary to:

• comply with law, regulation, legal process, or valid governmental request;
• investigate fraud or abuse;
• protect the security of Aderic;
• protect the rights or safety of our users, recipients, Aderic, or others;
• enforce our Terms of Service.

Business Transfers

If Aderic or FireFly Tech Oy is involved in a merger, acquisition, financing, restructuring, or sale of assets, information may be transferred as part of that transaction subject to appropriate safeguards.

6. Business Contacts Who Do Not Have an Aderic Account

Aderic may process professional business contact information relating to individuals who do not personally use Aderic when that information is relevant to a specific commercial opportunity.

If you receive an Aderic-facilitated business communication, we may process:

• your professional name;
• organization;
• business role;
• business contact information;
• relevant project association;
• messages and replies;
• opt-out status.

If you do not want to receive further Aderic-facilitated outreach, use the opt-out method provided in the communication or contact privacy@aderic.io.

We may retain limited suppression information after an opt-out request so that we can respect the request and avoid contacting the same address again where appropriate.

7. Legal Bases Where Required

Where applicable law requires a legal basis for processing personal information, we rely on one or more of the following, depending on the circumstances:

• performance of our contract with a customer;
• legitimate interests in operating and securing a business software service;
• legitimate interests in relevant business-to-business communications where permitted;
• consent;
• compliance with legal obligations.

8. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may depend on:

• whether your account remains active;
• whether information is required to operate an active campaign or conversation;
• security and fraud-prevention requirements;
• payment and accounting obligations;
• legal requirements;
• dispute-resolution requirements.

When information is no longer reasonably necessary, we may delete or de-identify it.

Residual copies may remain temporarily in backups or security systems until those systems are overwritten in the ordinary course.

We may retain limited records where necessary to honor opt-out, suppression, fraud-prevention, payment, or legal obligations.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and destruction.

However, no online service, database, or transmission method can be guaranteed to be completely secure.

You are responsible for protecting access to your Aderic account and for promptly notifying us if you believe your account or connected sender has been compromised.

10. Your Choices and Rights

Depending on applicable law, you may have rights to request:

• access to personal information we hold about you;
• correction of inaccurate information;
• deletion of personal information;
• restriction of certain processing;
• objection to certain processing;
• a copy of certain information.

You may also:

• update your business profile in Aderic;
• pause applicable outreach;
• disconnect supported integrations;
• request account deletion;
• opt out of Aderic marketing communications.

To make a privacy request, contact privacy@aderic.io.

We may need to verify your identity before completing certain requests.

11. Account Deletion

You may request deletion of your Aderic account and associated personal information by contacting:

privacy@aderic.io

Deleting an account may not immediately remove information that we must retain for legitimate reasons such as:

• payment records;
• security records;
• fraud prevention;
• legal compliance;
• dispute resolution;
• honoring suppression and opt-out requests.

12. International Processing

FireFly Tech Oy is based in Finland, and Aderic uses service providers that may operate in the United States and other countries.

As a result, information may be processed outside the country where you are located.

Where required by applicable law, we take reasonable steps to use appropriate mechanisms and safeguards for international data processing.

13. Business Use and Children

Aderic is intended for business use.

It is not directed to children, and we do not knowingly offer Aderic to children.

You must be at least 18 years old and legally capable of entering into a binding agreement to create an Aderic business account.

14. Changes to This Privacy Policy

We may update this Privacy Policy as Aderic changes.

If a change materially affects how we use personal information, we will provide appropriate notice where required.

The effective date at the top of this page indicates when this Privacy Policy was last updated.

15. Contact Us

For privacy questions or requests:

privacy@aderic.io

For general support:

support@aderic.io