How WinBackOps handles information.

1. Who operates WinBackOps

WinBackOps is operated by the person or entity identified below. “WinBackOps,” “we,” “us,” and “our” refer to that operator.

2. Scope and our role

This policy applies to the public WinBackOps website, customer accounts, imports, campaigns, reply handling, support, and related service operations.

For account, website, security, billing-administration, and direct business-contact information, we generally decide why and how the information is used. For opportunity, lead, customer, and message data uploaded or supplied by a WinBackOps customer, the customer generally decides the purposes of processing and WinBackOps processes the data to provide the service. The exact legal roles may depend on the circumstances and applicable law.

3. Information we handle

Depending on how the service is used, WinBackOps may handle:

• Account and authentication data: names, business email addresses, organization membership, roles, password hashes, and sign-in or session information.
• Organization settings: business contact details, website, address, phone number, timezone, sender identity, sender domains, and campaign preferences.
• Imported opportunity data: CSV files and mapped fields such as names, email addresses, phone numbers, job or estimate information, dates, source, status, reasons, notes, consent or opt-out indicators, and other fields selected by the customer.
• Import and derived data: original filenames, file hashes, headers, mappings, validation results, rejected rows, normalized values, deterministic scores, segments, and eligibility results.
• Campaign and delivery data: templates, approvals, recipient addresses, rendered subjects and messages, scheduling, provider identifiers, and delivery, bounce, complaint, failure, or suppression events.
• Reply and outcome data: inbound sender and recipient details, subject lines, reply text, sanitized HTML, attachments indicators, classifications, confidence, intent, objections, actions, follow-up status, human review or overrides, appointments, jobs, revenue, and attribution records.
• Support and business communications: messages and information supplied when a customer contacts us or participates in a pilot.
• Technical and security data: IP address, browser user agent, session activity, application events, queue activity, and security or error logs.
• Billing-administration data: invoice, payment-status, and plan records maintained for business administration. The current public site does not include an integrated card checkout.

Customers control the columns and content they import. They should not upload sensitive or unnecessary personal information.

4. Why we use information

We use information to provide and secure accounts; validate and process imports; identify eligible recovery opportunities; prepare, approve, schedule, and deliver campaigns; receive and classify replies; create handoffs and outcome records; maintain suppressions and opt-outs; troubleshoot and improve reliability; prevent misuse; communicate with customers; administer invoices and pilots; comply with legal obligations; and establish, exercise, or defend legal claims.

5. Customer-provided lead and opportunity data

Customers must have the rights and lawful authority needed to upload data and direct WinBackOps to process it. Customers are responsible for the content of their lists, the audiences they select, campaign approval, required notices, outreach rules, and responding to data-subject requests relating to their data.

We do not sell customer lead or opportunity data. We use it to provide, protect, maintain, and support the service, and as otherwise required by law or agreed with the customer.

6. Automated reply classification

WinBackOps uses an AI service to help classify inbound replies and propose operational actions. The request may include the reply text, subject, relevant opportunity context such as job type or lost reason, and a limited portion of the previous recovery message. The application is configured to request that the AI provider not store these API responses for model use.

The resulting classification, confidence, model metadata, and proposed action may be stored in WinBackOps. Authorized users can review or override classifications. The current service does not use AI to generate lead scores; opportunity scoring and eligibility are rules-based. Automated output may be inaccurate and should not replace appropriate human review.

7. Service providers and disclosures

We disclose information only as reasonably needed to operate the service, follow customer instructions, protect rights and security, complete a business transaction, or comply with law. Providers may include:

• Resend, for outbound email delivery, inbound email receipt, and delivery-status webhooks.
• OpenAI, for limited inbound-reply classification as described above.
• Infrastructure providers, for application hosting, databases, private file storage, queues, backups, and operational logging.
• Business providers, such as email, support, invoicing, security, and professional advisers.

We may also disclose information to authorities or other parties where we reasonably believe disclosure is required by law, necessary to protect people or the service, or needed to investigate fraud, abuse, or security incidents.

8. Cookies and similar technologies

WinBackOps uses essential Laravel session and security cookies to keep users signed in, protect forms against cross-site request forgery, and maintain application security. These cookies are necessary for the requested service.

The current public marketing pages do not use analytics cookies, advertising cookies, or tracking pixels. Because only essential cookies are currently used, WinBackOps does not display a separate cookie-consent banner. If non-essential tracking is introduced, this policy and the consent approach should be reviewed before launch of that tracking.

9. Retention and deletion

We retain information for as long as reasonably needed to provide the service, follow customer instructions, maintain security and business records, resolve disputes, and meet legal obligations. The application does not currently apply one fixed deletion period to every category.

Imported CSV files and resulting opportunity records may remain in private application storage and the customer workspace after an import is committed. Campaign, message, reply, audit, and outcome records may be retained to operate and document the service. Suppression and opt-out records may be kept longer where needed to prevent future unwanted messages and demonstrate compliance.

Customers may request deletion or export of their workspace data, subject to contractual, technical, security, backup, legal, and suppression-record requirements. Backup copies may remain until overwritten through normal retention cycles.

10. Security

We use safeguards appropriate to the nature of the service, including access controls, password hashing, authenticated organization workspaces, private application storage for imports, request validation, cross-site request forgery protection, encrypted transport where configured by the deployment, and audit or event records for sensitive workflows. No system can guarantee absolute security.

Customers are responsible for protecting their credentials, limiting user access, and notifying us promptly of suspected unauthorized use.

11. International processing

WinBackOps and its providers may process information in countries other than the country where an individual or customer is located. Privacy laws may differ across those locations. Where applicable, we use contractual or other recognized safeguards for restricted international transfers.

12. Privacy rights and requests

Depending on location and applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and to complain to a competent data-protection authority. These rights may be limited by exceptions in applicable law.

If a request concerns data supplied by a WinBackOps customer, contact that customer first where practical. We will assist the customer as appropriate. To submit a request directly, use the contact details below. We may need to verify identity and authority before acting.

13. Email choices and suppressions

Recovery emails sent through WinBackOps include a customer-specific unsubscribe process. An unsubscribe, opt-out reply, complaint, qualifying bounce, provider suppression, or wrong-contact result can stop active recovery sequences and create a suppression record for that organization.

This recovery suppression system is separate from any list or suppression process used for WinBackOps’ own business-to-business sales outreach. Customers remain responsible for honoring all other legally required channel and contact preferences.

14. Changes to this policy

We may update this policy when the service, providers, or legal requirements change. The effective date above will be updated when a revised policy is published. Material changes may also be communicated through the service or by email where appropriate.

15. Contact

Questions about this policy or WinBackOps privacy practices can be sent to: