The short version, which is not the legal version but is honest: there is no account, no login and no tracking pixel. The prospect names, companies and details you type are sent to our AI provider to write your line and then they are gone. We do not write them to a database, we do not sell them, and they are not used to train any model. We do store an email address if you hand us one, a note if you leave one, and a per-day count that keeps the free tier alive. Everything below explains that in full.
Warmline is operated by data according to me ("Warmline", "we", "us", "our") at warmline.dataaccordingtome.com.
For personal data about you, the visitor, we are the controller. For personal data about the people you write about, you are the controller and we act as your processor. That split matters, and it is set out properly in our Data Processing Addendum.
Contact for all privacy matters: amy@dataaccordingtome.com.
| What | Stored on our servers? | How long |
|---|---|---|
| Prospect name, company, detail, outreach reason, tone | No. Sent to the AI provider to write your line, then discarded. | Not retained by us |
| The generated line | No. Returned to your browser and not written down. | Not retained by us |
| Your IP address | Yes, as part of a daily rate-limit counter key | 48 hours, then auto-expired |
| Count of lines written site-wide | Yes, a single number with no personal data attached | Indefinite |
| Your local free-use counter | No. It lives in your own browser's local storage | Until you clear your browser data |
| Newsletter email address | Yes, if you submit one | Until you unsubscribe or ask for deletion |
| A note you leave in the notes box | Yes, held for manual review before anything is shown | Until you ask for removal |
| Server and hosting logs | Yes, held by our hosting provider | Per their retention, typically about 30 days |
When you type a person's name into Warmline, you are handing us personal data about somebody who is not in the room. We treat that seriously, and the design reflects it: that data is passed through, not kept.
Here is exactly what happens when you press "Write the line":
/api/write. Nothing else is sent: the tone wording and the banned-phrase list live on the server, so the browser cannot influence either.Our AI model provider processes the prompt under its own commercial terms, which include a commitment not to use business API inputs or outputs to train its models. It retains inputs only briefly for abuse detection and safety purposes. See section 7.
Two honest limits on that promise. First, if a request errors, the error status and a truncated provider message may be written to our hosting provider's function logs so we can debug. We do not deliberately log your prospect fields, but you should not rely on a technical guarantee that nothing ever appears in a log line. Second, our hosting provider necessarily sees the request in transit as the operator of the server.
| Data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Prospect input | Generate the line you asked for | Performance of a contract with you (Art. 6(1)(b)). For the prospect, you are the controller and you determine the basis. |
| IP address | Rate limiting, abuse prevention, cost control | Legitimate interests (Art. 6(1)(f)): keeping a free service running and not being drained by automated abuse |
| Email address | Send you occasional notes about new free tools | Consent (Art. 6(1)(a)), withdrawable at any time |
| Notes and display name | Feedback, and possible display on the site with your name | Consent (Art. 6(1)(a)) |
| Server logs | Security, debugging, service integrity | Legitimate interests (Art. 6(1)(f)) |
| Aggregate counter | Show how many lines have been written | Not personal data. No basis required. |
Where we rely on legitimate interests, we have considered your rights and freedoms and concluded that the processing is minimal, expected, and cannot reasonably be achieved another way. You can object at any time using the contact details in section 19, and we will tell you the outcome.
Warmline sets no advertising cookies and no analytics cookies. There is no consent banner because there is nothing to consent to.
We use one item of browser local storage, named opener_used, holding a single number: how many free lines you have generated on that browser. It is strictly necessary to operate the free tier, it stays on your device, and it is never transmitted to us. Clearing your site data removes it.
Our hosting provider may set a strictly necessary cookie for security or load balancing.
We do keep first-party product analytics, and they are deliberately minimal. They are plain counters held in our own storage: how many times the page was loaded, how many lines were generated, how many people pressed the example button or shared a line, and which of the four tones were chosen. There is no third party involved, no cookie, no device or browser fingerprint, and nothing that identifies you or follows you to another website. The counters are totals only, so no individual visit can be picked out of them.
Pages on this site link to third party sites (Substack, Gumroad, GitHub, LinkedIn, Upwork, Buy Me a Coffee). Those sites set their own cookies once you arrive. We do not control them.
We do not sell personal data. We share it only with the following categories of processor, only for the purposes below, and only under contracts that require them to protect it.
| Recipient | What they receive | Why |
|---|---|---|
| Hosting and serverless platform | Request data including IP address, and the request body in transit | Serving the site and running the API endpoints |
| AI model provider | The generation prompt, containing your prospect fields | Producing the line. Contractually committed not to train on business API inputs or outputs. |
| Key-value storage provider | Rate-limit keys with your IP address, the global counter, subscriber email addresses, submitted notes | Rate limiting, counting, and holding your email or note |
| Payment processor (only if paid plans launch) | Billing details you enter with them | Taking payment. We never see the full card number. |
| Email delivery provider (if we send a newsletter) | Your email address | Delivering the message you subscribed to |
We may also disclose data where we are legally required to, where it is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of any person. If Warmline is ever sold or merged, data may transfer to the acquirer, who would remain bound by this policy or give notice before changing it.
We operate from, and our providers are principally based in, the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data will be transferred outside your country.
Those transfers rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum where applicable, or the EU-US and UK-US Data Privacy Framework where the recipient is certified. We also apply the practical safeguards described in this policy: minimal collection, no retention of prospect data, and encryption in transit.
You can ask us for information about the transfer mechanism used for a particular provider by emailing us.
All traffic is served over HTTPS. API credentials live in server-side environment variables and are never exposed to the browser, which is the specific reason generation runs through our own endpoint rather than calling a model provider from the page. Input fields are length-capped, submitted notes are stripped of markup and escaped on render, and rate limits are enforced server-side where they cannot be bypassed by clearing browser storage.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where the law requires it, and we will notify you directly without undue delay where the breach is likely to result in a high risk to your rights.
If you are in the EEA or the UK, you have the right to:
To exercise any of these, email amy@dataaccordingtome.com. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We do not charge a fee unless a request is manifestly unfounded or excessive.
Because we hold so little, most requests are quick. If you only ever generated lines and never gave us an email address or a note, we most likely hold nothing about you beyond an expired rate-limit key and a hosting log entry.
Under the California Consumer Privacy Act as amended by the CPRA, California residents have the right to know, delete, correct, and to opt out of sale or sharing, and the right not to be discriminated against for exercising those rights.
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We have not done so in the preceding twelve months.
In the preceding twelve months we have collected the following statutory categories: identifiers (IP address, and email address if you gave one) and internet or network activity information (server log data). We collect these for the business purposes described in section 5 and disclose them only to the service providers listed in section 7. We do not collect sensitive personal information, and we ask you not to submit any.
To exercise a right, email amy@dataaccordingtome.com with "CCPA request" in the subject. We will verify your request by matching the information you supply against what we hold. An authorised agent may submit on your behalf with written proof of authority.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have comparable rights to access, correct, delete and port their data, and to opt out of targeted advertising, sale and certain profiling. We do not engage in targeted advertising, sale or profiling that produces legal or similarly significant effects. Use the same contact route and we will honour your request.
Where your state provides an appeal process for a refused request, you may appeal by replying to our decision. We will respond to the appeal within the period your state's law requires and will tell you how to contact your Attorney General if you remain unsatisfied.
If you believe someone entered your details into Warmline, here is the position. We do not hold them. We do not maintain any index, list or profile of people who have been written about, so there is nothing for us to search, disclose or delete on our side.
The controller of that data is the person who typed it in and who sent you the message. Your access, objection and erasure rights are exercisable against them, and their contact details should be in the message you received.
If you email us anyway, we will confirm the above in writing so you have a record, and we will assist the sender in responding to you as our Data Processing Addendum requires. If you believe someone is using Warmline abusively, tell us at amy@dataaccordingtome.com and we will act on it.
Warmline is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it promptly. Do not enter a child's personal data into the tool.
The tool generates text automatically, which is its purpose. We do not carry out automated decision making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you. Rate limiting is a simple counter, not a decision about you as a person.
We do not track you across sites, so a Do Not Track or Global Privacy Control signal does not change what we do. We honour those signals as an opt-out of sale and sharing by default, because we never sell or share in the first place.
We may update this policy. The "Last updated" date at the top always reflects the current version. If a change materially reduces your privacy protection, we will make a reasonable effort to flag it on the site, and by email if you are subscribed, before it takes effect.
data according to me
Warmline
amy@dataaccordingtome.com
warmline.dataaccordingtome.com
Please put "Privacy" in the subject line. We aim to respond within thirty days, and sooner where the law requires.
If you are in the EEA or the UK and you are not satisfied with our response, you may complain to your local data protection authority. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EEA, a list of authorities is published by the European Data Protection Board at edpb.europa.eu. We would rather you came to us first, and we will try to fix it.