Where the contact data comes from

Our two data sources

When you build an audience in Pitch2Retail, the contact records come from one (or both) of these:

Both sources are public-information based. Apollo aggregates publicly available work-context data and runs it through verification pipelines. Google Places exposes the same listings you see when you search a store on Google Maps.

Apollo.io — verified B2B contacts

Apollo is a SOC 2 Type II certified B2B sales intelligence platform with around 275 million person profiles. They are our primary source for buyer-role contacts at retail chains.

How Apollo gets the data:

• Public web sources (company websites, press releases, public filings, conference attendee lists)
• Licensed data partnerships with B2B data providers
• Opt-in contributor network (sales reps who connect their inboxes contribute non-PII metadata)
• Contact form submissions on Apollo's own products

What we use Apollo for:

• Searching by company domain + role keywords (e.g., "buyer", "category manager", "procurement")
• Pulling work email + verification status
• Pulling job title and LinkedIn URL for personalization

What we don't use Apollo for:

• Personal email addresses (we filter these out — only role-based or work emails are imported)
• Phone numbers (Apollo provides them; we don't import or expose them)
• Mass data dumps (we pull contacts on-demand for each audience build, not in bulk)

Read Apollo's privacy posture: apollo.io/privacy-policy

Google Places — indie retailer discovery

For independent stores that don't have a named buyer in Apollo (typical for single-location boutiques, indie wineries, gift shops, specialty grocers), we use the Google Places API to find them.

What Places returns:

• Business name, address, website, phone, opening hours
• Place type tags (gift_store, liquor_store, restaurant, etc.)
• Up to 10 photos of the storefront/interior
• Star rating + review count

Where the email comes from for indie retailers:

1. We retrieve the store's website from Places
2. Our crawler visits the contact / about page (respecting robots.txt)
3. If a public info@ / hello@ / contact@ email is published on the page, we surface it for your review
4. You confirm the email before any send — masked until you approve

If no public contact email is findable, the contact is marked "manual research required" and won't be auto-emailed.

How verification actually works

Email verification happens at three checkpoints:

Apollo classifies emails into three buckets, which we expose to you:

• Verified — SMTP handshake completed cleanly. Highest confidence. ~92% of our reveals.
• Likely deliverable — Catch-all domain (we can't directly confirm the inbox exists, but the domain accepts mail). Use with care.
• Unverified — Could not confirm. Excluded by default from sends.

Data freshness and update cadence

Apollo refreshes its verified contact pool continuously. Because we pull on-demand for each audience build (rather than caching a static list), every audience you create reflects Apollo's most current data at that moment.

• Per-audience builds: live query at audience creation time
• Re-verification cadence: any contact older than 90 days in your audience is flagged for re-verify before the next sequence touch
• Job-change detection: when Apollo flags a person as having changed companies, we mark the contact stale and prompt you to refresh
• Google Places refresh: indie retailer data refreshed weekly or on-demand per audience

What we don't do

Suppression and removal

Anyone who unsubscribes, marks one of your sends as spam, hard-bounces, or asks to be removed is added to your tenant's permanent suppression list within minutes. The list is enforced at send time — even if the same contact reappears in a future Apollo refresh, they will be silently skipped.

Recipients who want to be permanently removed across all Pitch2Retail customers (a "global suppression") can email remove@pitch2retail.com. We honor these within 10 business days as required by CASL s.11(3) and CAN-SPAM s.5(a)(4).

For the underlying source: contacts can request removal directly from Apollo via apollo.io/privacy-policy (the data subject deletion link is in the footer of every Apollo page). Once removed at the source, they will not reappear in future audience builds.

Your uploaded data

If you upload your own CSV of contacts (e.g., your existing customer list), that data is governed by the same rules:

• Stored in Canada (DigitalOcean Toronto)
• Encrypted at rest (AES-256-GCM) and in transit (TLS 1.3)
• Never shared, never sold, never used for AI training
• Deletable on request — full account deletion processed within 30 days

You remain the controller of your uploaded data. We are the processor. See our Data Processing Agreement for the full controller/processor terms.