Opting out, and what Cuvy counts as a sale

On this page

• Which reader you are
• What Cuvy holds, and where it comes from
• Whether this is a sale, and on what basis
• How to opt out
• What suppression does
• What it cannot do
• Your other rights
• How we check it is you
• Authorised agents
• Browser signals and this website
• If you are a Cuvy customer
• Where to write

Which reader you are

Two different people arrive at a page like this, and they need different answers.

You are in the data. Your work email is in Cuvy's contact index, possibly because an email from a stranger led you here. You have no account and there is nothing for you to log into. This whole page is for you, and the request in how to opt out takes about a minute.

You are a customer. You pay for Cuvy and you want to know what it does with the data you use. Read whether this is a sale, and then the section about your account, which is governed by different documents.

What Cuvy holds, and where it comes from

Cuvy keeps an index of business contact details so that a customer searching for somebody at a company can be told how to reach them at work. For a person in it, that is typically:

• Identifiers — name, work email address, sometimes a personal email address, sometimes a business phone number, sometimes a professional profile address.
• Professional information — employer, job title, seniority, the company's domain and location.

It comes from datasets we license, from sources published openly on the web, and from what our own lookups establish. We do not hold sensitive personal information as the CPRA defines it: no government identifiers, no financial account details, no precise location, no health data, nothing about race, religion, union membership or sexual orientation. We do not knowingly hold information about anyone under 16, and we do not make information about a minor available to a customer.

Who receives it: Cuvy customers, who are businesses, when they look somebody up; and the service providers who help us run the service, listed by category in the privacy policy. Nobody else. There is no advertising network in this picture at all.

Whether this is a sale, and on what basis

Under the California Consumer Privacy Act as amended by the CPRA, a "sale" is making personal information available to another business for money or other value. Cuvy hands a customer a contact detail and the customer spends a credit for it. We treat that as a sale, and we do not spend this page arguing our way out of the definition.

We could try. The usual argument is that business contact data is not really personal information, and it fails: the exemption that once covered business-to-business contacts expired at the start of 2023 and was not renewed. A work email address is personal information about a person, and a person who wants out should get out. What we do with a close call is the most useful thing you can know about a data company, so here is ours, stated once.

We do not share personal information in the sense the statute uses, which is disclosure for cross-context behavioural advertising. Cuvy does no advertising of that kind, buys no audience segments and sells none. There is nothing here to opt out of on that front, and no "limit the use of my sensitive personal information" link below, because there is no sensitive personal information to limit.

How to opt out

Email support@cuvy.io with the subject line Do not sell, and in the message:

1. The email address or addresses you want suppressed, work or personal.
2. Your name, and the employer they are attached to if you know it.
3. A phone number, only if it is one you have seen us provide and you want it suppressed too.

That is the whole request. There is no account to create, no form and no cookie to set. We acknowledge within ten business days and suppress the address within 30 days, usually the same week — the statute allows 15 business days for an opt-out of sale and 45 calendar days for a request to know, delete or correct, and we work to the shorter of whichever applies. If a request genuinely needs longer than the law's default, we will write and tell you why.

You do not have to be in California. The statute gives Californians the right; we apply the same route to everybody who asks, because operating two standards would mean deciding where you live before deciding whether to respect the request.

What suppression does

When a request is processed, the address stops being available. It is not returned in a search, not handed to a customer, not exported, and not counted as something Cuvy can find.

What we keep is the address itself, on a suppression list, and nothing around it. That sounds contrary and it is deliberate. Our index is rebuilt and refreshed from datasets that will contain your address again in six months. If we deleted the record outright, the next load would quietly put you back and you would have to ask a second time. The only way to keep an address out permanently is to remember that it must stay out. Keeping the minimum needed to honour your own request is what the statute expects, and the list is used for that and nothing else.

If you would rather we held nothing at all, say so and we will delete instead. Please understand what you are choosing: we will have no way to recognise the address if it arrives again in a future dataset.

What it cannot do

Opting out stops Cuvy providing your details. It does not reach the people who already have them, and it is worth being straight about that rather than letting you find out from your inbox.

• It does not stop email you are already receiving. Cuvy sends no outreach at all — not on a customer's behalf, not from their account, never. If a message arrived, a customer sent it from their own system. Reply and ask them to remove you; they are obliged to honour it.
• It does not recall data already provided. A customer who obtained your address before your request keeps their copy, and they are the controller of it. We will tell them you have objected if you ask us to.
• It does not cover other companies. If your address is also with three other data vendors, each has to be asked separately. We cannot suppress you anywhere but here.

If a sender will not stop and you cannot work out who they are, forward us the message. We can often tell whether the address came from us, and we would rather know which customer is behaving that way — it is a breach of our acceptable use rules.

Your other rights

The same email address handles all of these, and none of them costs anything:

• Know. Ask what we hold about you and where it came from, and we will send it in a readable form.
• Delete. Ask us to remove it, with the caveat in what suppression does.
• Correct. If the employer or job title is wrong, tell us and we will fix it. This one is used more than people expect, and it is a reasonable thing to want.
• Opt out of sale. The request described above.
• No retaliation. Nobody is charged a different price or given a worse service for exercising any of this. For a person in the data there is nothing to retaliate with; for a customer, a request about your own account changes nothing about your plan.

How we check it is you

Enough to be sure we are acting on the right record, and no more. Sending the request from the address you want suppressed is sufficient on its own. If you cannot — you have left the employer, the mailbox is closed — tell us the address and something that ties you to it, such as where it worked. We will not ask for identity documents, and we will not make you create an account to prove you exist.

If we cannot verify a request we will say so and explain what would settle it, rather than refusing without a reason.

Authorised agents

An authorised agent may make a request for you if they include your written permission. We may contact you to confirm it. There is no form to notarise and no portal to register with.

If you handle requests in volume, write once and ask how we would like the list, and we will agree a format. Several hundred separate emails is slower for both of us.

Browser signals and this website

cuvy.io runs no analytics and carries no advertising pixel, and it sets no cookie unless you open the live chat — which is loaded only when you press the button for it, and never with the page. Either way nothing about your visit is sold or shared, so there is nothing here for a Global Privacy Control signal to switch off. We mention it because a page like this is expected to address the signal, and the honest answer is that this website does not do the thing the signal exists to prevent.

The opt-out that matters here is about the contact index, not about browsing, and it is the email request above.

If you are a Cuvy customer

This page does not govern your account. What we hold about you as a customer, how long we keep it and how to have it deleted are in the privacy policy; how we handle the data inside your workspace, and the roles each of us plays, are in the data processing agreement.

One practical point. You are the controller of your own outreach, so an opt-out somebody sends to us does not discharge an obligation they have given you. If a person asks you to stop, that request is yours to honour, and our suppressing the address afterwards is a separate thing that happens on our side.

Where to write

support@cuvy.io, subject line Do not sell. A person reads it. If you would rather speak to somebody first, support explains how to reach us and what a reply takes.