Legal

Privacy Policy

Last updated: October 11, 2026

United States businesses only

Diurno HQ — Customer Intent Intelligence CRM is offered solely to businesses located and operating in the United States. It is not directed to or intended for individuals or entities outside the United States, and it is not intended for consumers or minors. By using the Service you represent that you are a United States-based business.

Diurno HQ builds Diurno HQ — Customer Intent Intelligence CRM on an ethos of honest, sourced research. This Policy explains what information the Service handles, how we use it, and the choices and rights you have. A defining principle is the boundary in Section 5: we pool only public facts about third-party companies, and we do not pool a customer’s private data.

1. Who we are and what this Policy covers

This Privacy Policy explains how Diurno HQ (“Diurno HQ,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with Diurno HQ — Customer Intent Intelligence CRM (the “Service”), a business-to-business sales-intelligence platform.

This Policy applies to the people whose information the Service handles:

  • our customers — the businesses that subscribe to the Service;
  • the users who access the Service on a customer’s behalf;
  • the individuals at third-party companies whose limited, public professional information the Service processes so that customers can research those companies, and whose contact details a customer may enter or import;
  • the recipients of email that a customer sends through the Service; and
  • the visitors to a customer’s website, where that customer has installed the Service’s tracking snippet.

This Policy is provided for transparency about how the Service handles information; it is not legal advice, and you should consult your own counsel regarding its application to your business.

2. United States only

The Service is offered solely to businesses located and operating in the United States. It is not directed to, intended for, or offered to individuals or entities located or operating outside the United States, and it is not intended for consumers or minors. By using the Service, customers and their users represent that they are United States-based.

Because the Service is designed for the United States market, this Policy is written around United States privacy law. See Section 13 for how we treat access from outside the United States.

3. Information we collect

We collect the following categories of information:

a. Account and authentication data

When you register and use the Service, we collect your name, your work email address, your organization, and account credentials (passwords are stored only in hashed form). To keep you signed in, the Service stores an authentication token in your browser’s local storage. This token is used only for authentication.

b. Workspace configuration and customer-entered data

We collect the information you configure and enter in the Service, such as your ideal-customer profile, personas, competitors, target-account lists, and any CRM, pipeline, notes, contacts, and hand-entered signals you record. Contacts can include names, titles and — where you type or import them — email addresses and phone numbers. The Service also stores the emails you send through it and the replies they receive. We refer to all of this as your Customer Data. Your Customer Data is kept private to your tenant, as described in Section 5. If you submit our order form or request a plan change, we also keep what you provide there: your name, work email, company, an optional phone number, the plan, and any notes.

c. Public third-party company information

To research the companies our customers choose to monitor, we collect facts about those third-party companies from publicly available web sources — for example, hiring signals, technologies in use, funding events, news, and firmographic details. Research saves findings with the public source URL they came from, and a claim it could not tie to a public source is labeled “needs verification” and does not count toward a score. Items a customer adds by hand are stored as the customer enters them.

d. Public professional information about individuals

As part of researching third-party companies, we process limited, publicly available professional information about individuals who work at those companies — specifically their name, job title, and public professional profile links — sourced from the public web. Research does not collect email addresses or phone numbers; any a customer stores for a person were entered or imported by that customer. We do not seek out home addresses, government identifiers, financial-account details, health information, precise location, or other sensitive categories of personal information.

e. Usage and technical data

We collect the minimal technical and log data needed to operate, secure, and troubleshoot the Service, including service logs and short-lived counters that limit abuse (these use the network address of a request). We keep cookies and browser storage to a minimum: a login token in local storage for authentication, as described above. We do not use third-party advertising trackers, we do not track you across other websites, and we do not build advertising profiles.

f. Email sent through the Service

When a customer sends email through the Service, we process the recipient’s address, the message, and any reply. Where the Service’s tracking is switched on, we record when a message was opened (through an invisible image) and when a link in it was clicked (links pass through a signed redirect); requests that look automated, such as security scanners fetching links, are recorded as automated. When a recipient unsubscribes (by pressing the button on the page the unsubscribe link opens, or their mail app’s own unsubscribe button), replies with a plain request to stop, a message bounces, or a recipient reports it as spam, the address is added to the sending organization’s do-not-email list; opening the unsubscribe page alone records nothing, and a recipient can undo their own unsubscribe with the Re-subscribe button on that page for 30 days after they made it (a hold the sender had set before stays in force, and the button does not restart follow-ups that were stopped); our service logs note each unsubscribe and re-subscribe by organization and a salted reference to the address, not the address itself. We keep that list so the opt-out still works if the customer later deletes the contact or the account.

g. Website visitor analytics

A customer can install our tracking snippet on its own website. For each page view the Service stores a salted, one-way hash of the visitor’s network (an IPv4 address, or an IPv6 /64 network; different in every workspace; the address itself is not stored), the registrable domain of the network’s reverse-DNS name when that name is confirmed (it resolves back to the same address), the page’s address and the referrer’s address cut to origin and path (no query string or fragment), and the date and counts. A visit is matched to a company the customer tracks only when that confirmed domain belongs to the company; the match identifies a network, not a person. Visitor records written by earlier versions of the Service may still hold the network’s full reverse-DNS name and the referrer’s query string until our nightly clean-up rewrites them to this shorter form (it works in batches, so a large backlog can take more than one night). Visitor rows are deleted after 90 days by default (Section 9). Customers decide whether to install the snippet and are responsible for telling their own visitors.

4. How we use information

We use the information described above to:

  • provide, operate, and maintain the Service and your workspace;
  • perform research on the third-party companies you choose to monitor and generate the intelligence, signals, and suggested outreach the Service is designed to produce;
  • authenticate you, secure the Service, and prevent fraud and abuse;
  • provide customer support and respond to your requests;
  • process billing and manage subscriptions;
  • send email on a customer’s behalf, honor opt-outs, and show the customer which companies visit its website or engage with its email;
  • monitor, improve, and develop the reliability and quality of the Service; and
  • comply with legal obligations and enforce our terms.

To generate research, we send the research request to an AI provider, or to an AI agent that we operate, as described in Section 7. A request can include a company’s name and website, your workspace’s targeting profile (its name and description, geography and metro areas, ideal-customer criteria, personas, competitor names, sales-play names and any research guidance you wrote), a note you attach to the request, and, for checks on a company’s people, the names and titles of the contacts on that account.

5. The shared public-intelligence corpus — and the private-data boundary

To research third-party companies efficiently, we maintain a shared corpus of public, web-sourced facts about third-party companies. A snapshot is keyed by the company’s website domain and is built from a fixed list of fields: the company’s name, website, industry, headquarters, employee count and territory facts (each with its source), signals, technology and competitor evidence with their source links, and named contacts with their sources. The corpus is reused across customers to power research.

The shared corpus pools only public facts about third-party companies. Its purpose is to reuse public knowledge about the market so that customers benefit from research already done, without re-fetching the same public sources.

The corpus is built so that it does not include a customer’s private data. It does not store, and we do not share with any other customer:

  • your targeting or interest — a snapshot is keyed by the company, not by the customer, and we design the Service so that it does not tell one customer that another customer researched a company;
  • your notes;
  • your hand-entered signals, contacts or technologies;
  • the conclusions a workspace draws from the facts — why-now text, ICP-fit reasoning, sales-play copy, scores, scoring-rule codes or persona labels; or
  • your CRM, pipeline, contacts or email.

These stay tenant-private. A competitor or technology that a research answer only repeats from a customer’s own catalog, with no evidence or source of its own that names it, is kept on that customer’s account and not written to the snapshot. When a customer’s research reuses a snapshot, the facts are filed under that customer’s own rules and scored with that customer’s own model. In short: the corpus reuses public knowledge about the world; it does not reuse your private knowledge about your pipeline. Your Customer Data is used only to provide the Service to you.

A person named in a snapshot can ask us to remove them (Section 11). A customer who removes a contact from its own account stops that customer’s research from adding the person back; removing the person from the shared snapshots is something we do on request, because a change there affects other customers’ research. Research that later reads the same public pages can find the same public information again.

7. How we disclose information; subprocessors

We do not sell your personal information (see Section 8). We share information only as described here, and we engage service providers (subprocessors) who process information on our behalf under contracts that require appropriate confidentiality and security. Our subprocessors fall into these categories:

  • AI research providers (for example, Perplexity, OpenAI, and Anthropic), including an AI agent that we operate on one of these providers’ models, which process research requests and public context to help generate intelligence;
  • An email delivery provider (for example, Resend), which sends the email a customer sends through the Service, and the Service’s own notification emails, and receives the replies. It therefore processes recipient addresses and message content; and
  • Cloud hosting, database, and infrastructure providers (for example, Railway, Cloudflare, and Supabase), which host, store, and help secure the Service.

A customer can also connect services of its own choosing — Slack or a webhook address, and Salesforce, HubSpot or OnePageCRM. We send data to them only when the customer connects and uses them, and only what the push or notification needs; what those services do with it is governed by the customer’s agreement with them.

The providers named above are examples; our current list of subprocessors is available on request at contact@diurnohq.com. We may also disclose information to professional advisors, to comply with law or valid legal process, to protect our rights and the safety of others, and in connection with a merger, acquisition, or sale of assets (subject to this Policy).

8. We do not sell your personal information

Diurno HQ does not sell personal information for money, and we do not share personal information for cross-context behavioral advertising. We do not use third-party advertising trackers, and we do not disclose personal information to data brokers for their own marketing purposes. Information is used to provide and improve the Service, as described in this Policy.

9. Data retention

We retain your account and Customer Data for as long as your organization’s account is active. Deleting an account, a contact or a workspace in the Service deletes it from our database together with the records that depend on it (for an account, for example, its contacts, emails, sequence enrollments, next steps and evidence). A few things deliberately outlive a deletion: the do-not-email list (so an opt-out keeps working); finished research jobs, which stay as history without the account link; and website visits matched to a deleted account, which stay as anonymous visits with the matched company and network name removed. We delete an organization and everything under it when its owner asks us to by emailing contact@diurnohq.com; before doing so we may keep the data for a limited period so that we can support wind-down, meet legal and accounting obligations, and resolve disputes.

Automated clean-up. By default — these are defaults, and our operators can change them — a nightly job blanks the raw text of finished research jobs after 30 days, deletes website-visitor rows after 90 days (the “Visited your website” signals they produced stay), and deletes finished research-job history after 365 days. Accounts, contacts, notes, emails and other records you create are not removed by this job; they stay until you delete them.

Copies outside our database. Deleting data in the Service does not remove copies a customer already pushed to Salesforce, HubSpot, OnePageCRM, Slack or a webhook, or email already delivered; those are removed in those systems.

Backups. Whether a backup of the database exists, and how long it is kept, depends on the plan our database provider supplies and on copies our operators make; we do not promise a particular backup schedule or retention period here. Where a backup does exist, it is kept for a limited period set by whoever made it, deleted data can remain in it until it ages out, and we do not edit backups.

We retain public facts in the shared corpus for as long as they remain useful and supported by a public source, refreshing or re-sourcing them over time. Individuals may request removal of their public professional information as described in Section 11.

10. Security

We use reasonable administrative, technical, and organizational measures designed to protect information, including encryption of data in transit, token-based authentication with hashed passwords, checks in the application that keep each organization’s data separate, and reputable hosting infrastructure. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us promptly at contact@diurnohq.com.

11. Your choices and privacy rights

a. Account holders and their users

You can review and update much of your account information within the Service. You may also request access to, correction of, or deletion of your account information by emailing contact@diurnohq.com. If you use the Service under an organization’s account, some requests are controlled by that organization, and we may direct your request to it.

b. California residents (CCPA/CPRA)

Because some of our customers, users, or the individuals referenced in third-party company data may be California residents, we provide the following. Subject to verification and legal limits, California residents have the right to know and access the personal information we hold about them, to request deletion, to request correction, to opt out of the “sale” or “sharing” of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.

  • We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes that would trigger the right to limit.
  • Categories we collect include identifiers (such as name, work email, phone number where a customer stores one, job title, and organization), professional or employment-related information (such as job title, employer, and public professional profile links), commercial information (such as subscription and order records), and internet or network activity (service logs; for customers who install our snippet, a hashed network identity and the pages viewed; and email open and click events).
  • Sources are you and your organization, a customer that stores your details in its workspace, and publicly available web sources.
  • Purposes are those described in Section 4, and we disclose information to subprocessors for business purposes only, as described in Section 7.

To exercise these rights, email contact@diurnohq.com. We will take steps to verify your request by matching it to your account or to the public record referenced, and we will respond within the timeframes required by law. You may use an authorized agent to submit a request on your behalf.

c. Individuals featured in third-party company data

If you are an individual whose public professional information (such as your name, job title, or public professional profile link) appears in the Service, or whose contact details a customer has stored, you can request access to, correction of, or removal of that information by emailing contact@diurnohq.com. We will locate the records associated with you and correct or remove them where we hold them, subject to legal and operational limits; removing a person from the shared research snapshots is done by us on request. We match the name as you give it, ignoring case and spacing but not accents or other spellings, so tell us each spelling to look for; for a name written without spaces (Chinese, Japanese, Korean, Thai), a longer name that contains it cannot be told apart from it, so we read the surrounding text first. The removal covers what is stored when we act on it: research reads public sources, so a later research run that finds your public professional information again can add it back, and you may ask us to remove it again. Records a customer keeps in its own workspace are controlled by that customer, and we may direct your request to it; when a customer removes a contact from its own workspace, that workspace’s research does not add the same person back.

To stop a customer’s emails, use the unsubscribe link in the message and press the button on the page it opens: that adds your address to that sender’s do-not-email list, and the sender’s sequences to you end.

12. Children

The Service is a business-to-business tool that is not directed to, or intended for, children. We do not knowingly collect personal information from anyone under 18 years of age, and the Service is not intended for consumers or for personal, family, or household use. If you believe a child has provided us personal information, contact us at contact@diurnohq.com and we will take appropriate steps to delete it.

13. International users — United States only

The Service is intended solely for businesses located and operating in the United States, and information is processed in the United States. The Service is not directed to, or offered to, individuals or entities outside the United States, including in the European Union, the European Economic Area, or the United Kingdom. This Policy is not designed to address, and we do not offer the Service under, the EU/UK General Data Protection Regulation or similar non-United States frameworks.

If you access the Service from outside the United States, you do so on your own initiative, and you must not use the Service if doing so is not permitted where you are located.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page, and, for material changes, we will provide reasonable notice. Your continued use of the Service after changes take effect constitutes your acceptance of the updated Policy.

This Policy is governed by the laws of the State of Texas, United States, consistent with our Terms & Conditions.

15. Contact us

For any question about this Policy or about how we handle information — including access, correction, or removal requests, or to obtain our current list of subprocessors — email us at contact@diurnohq.com.