How we handle the business addresses we contact
Last updated: 2 October 2026. This page completes the privacy policy, which only covers people who use the service.
Who is responsible
Pierre Barreaud, sole trader operating under the business name TAOPIB (SIREN 952 940 021, Orléans companies register), 401 rue de Barbotte, 45160 Olivet, France. One person operates Kapari; the messages are written by a software agent, as explained below, and that person reads your replies. Questions: privacy@kapari.eu.
Where your address came from
From one of two sources, and the message you received says which.
A public web page where you published it yourself: your professional site, your firm's contact page, your newsletter footer, your faculty page, or a paper you authored. The message then names the site where we read it.
The Apollo.io business contact database, published by ZenLeads, Inc. (Covina, California, United States), to which we subscribe. We take your name, your role, your company and your business email address from it, and only an address that Apollo marks as verified. The message then says so in plain words. You can also ask Apollo to remove you from its database: apollo.io/privacy-policy/remove or privacy@apollo.io.
We never guess an address from a name and a domain: an address that is neither published nor verified by Apollo is not contacted.
Why we write, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, business address, role, organisation | Sending you a professional approach related to your work | Legitimate interest, Article 6(1)(f) |
| Where your address came from: the public page it appears on, or the Apollo.io mention | Being able to tell you its source, and to prove it | Legitimate interest, Article 6(1)(f) |
| Your public professional work (title, date, link) | Writing to you about something that actually concerns you, rather than a generic message | Legitimate interest, Article 6(1)(f) |
| Send date, any reply, any stop request | Not writing again, and honouring an objection | Legal obligation and legitimate interest |
We collect no special category data under Article 9 of the GDPR. We record no political, religious or trade union opinion, no health data, and no assessment of your age, your finances or your private life. Our outreach files are checked by an automated filter that rejects that kind of note.
For how long
Twenty-four months after the last exchange, then deletion. That is the period written at the foot of every message we send. If you ask us to stop, we keep your address in a suppression list only, precisely so that we never write to you again, and nothing else.
Who else has access
Nobody buys or rents these files from us. Apollo.io serves us as a source of addresses, never to send a message: it receives our search criteria (role, industry, company size, country) and, for a person we select, the request for their address, but neither our messages nor your replies. Five technical providers process them on our behalf, each for a single task:
- Supabase: stores your record (database hosted in Paris);
- Mistral AI: the agent's drafting of messages, run in the European Union;
- TypeSafe AI (United States): its Jev model checks the meaning of some texts, answers yes or no, and writes nothing; written confirmation of its contractual safeguards has not yet been obtained;
- Resend (United States): delivery of the messages we send;
- Hostinger International Ltd: hosting of our server and of the mailbox that receives your replies.
Who writes, who sends
We may as well say it plainly, since testing decisions before they are announced is our trade: our messages are written by a software agent, which signs as Keet and says so in every message. A quality rule reads them before anything goes out and turns some of them down; what it turns down, a person decides on. Sending itself is automatic, during business hours in your own time zone.
What is not automatic: if you reply, Pierre reads you and answers you himself. And if you do not reply, you get at most one follow-up, seven days after the first message, then nothing more.
What we measure, and what we do not
- No tracking pixel in our messages. We do not know whether you opened one, and we do not try to find out.
- The links in our messages go through our own server and record the click, its date and a truncated network address. It is the only way we know whether a message was of any use. No shortener, no outside tracker: the link leads to our page, and nowhere else.
- No selling, no sharing of your address, to anyone.
Our public pages are served by our own server, whose technical logs record visits as any web server does. That is the only trace we hold, and it does not identify you by name.
Your rights, and the easiest one
The easiest: reply STOP to our message. Your address leaves the file the same day and we never write again. No reason required.
You also have rights of objection, access, rectification, erasure, restriction and portability. Write to privacy@kapari.eu and we answer within thirty days. The right of access covers our notes too: if you ask what we wrote about you, we send it as it stands. That is exactly why we write nothing there that we could not show you.
If our answer does not satisfy you, you may complain to the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, www.cnil.fr. European data protection law applies to our messages because we are established in France, whatever your country of residence.