Apollo

The privacy policy states that when Customers submit data, Apollo may use it to grow, enrich and verify its Contributory Database, which is then made available to all other customers. This indicates Apollo asserts broad usage rights over submitted data rather than treating it as the exclusive property of the submitting customer, though ownership as such is governed by a Terms of Service not supplied here.

The supplied documents do not clearly address ownership of AI-generated outputs (email personalization, insights, lead scores). The policy refers to derived personal information and inferences that Apollo generates and retains, suggesting Apollo treats generated/derived data as its own. No clear grant of output ownership to the user is stated.

The privacy policy explicitly states Apollo uses Service Information and business contact data as inputs to internally developed models and third-party AI providers, and to create new products and tools. Submitted data is also used to enrich a database resold to all customers. An opt-out/objection right is mentioned but the default is training and profiling use.

The privacy policy provides a general, open-ended retention standard (data is kept as long as useful) rather than a defined schedule, and states the data is non-sensitive and not subject to sector-specific retention rules. Deletion is available via a Privacy Center/Remove request, but Apollo retains suppression-file data and notes deletion does not reach third parties who already hold the data.

Sharing is central to Apollo's model — its contributory database is sold/made available to all customers, and Apollo is a registered data broker. Beyond the service-integral sharing, the policy also discloses sharing with advertising and data platforms, data enhancement/marketing partners, and 'business and data partners in the course of creating new data services.' This extends beyond what the user's own use requires and includes adtech/data-broker style disclosure, warranting RED.

The policy does provide concrete opt-out mechanisms: a Privacy Center to opt out of the database, a Remove request, CCPA opt-out of sale/sharing, GDPR objection rights, an AI/profiling opt-out, and advertising opt-outs via NAI/DAA. However opt-outs are largely reactive (individuals must find and request them), suppression data is retained, and opt-out does not reach third parties who already hold the data — limiting effectiveness.

The consumer privacy policy references CCPA and GDPR compliance obligations and data-broker registration but names no third-party certifications or audit reports. It adheres to Google API user-data policy. No SOC 2, ISO, or EU AI Act attestation appears in the consumer documents (those appear only in the enterprise DPA). Against the marketing_adtech baseline, CAN-SPAM and TCPA are referenced in the affiliate ToS; core adtech frameworks like IAB TCF are not claimed.

The consumer documents describe AI features (email personalization, insight generation, lead scoring, agentic workflows) and profiling but provide no transparency into model logic, no explainability commitments, and no enterprise auditing of AI decisions. It only points to an external AI Policy not supplied here. Given automated profiling of individuals, the silence is a meaningful gap.

The consumer privacy policy is weak on security specifics — it disclaims that measures will eliminate risk and pushes responsibility onto users, with no encryption or control detail. It references no breach history. (Substantive controls — encryption in transit/at rest, access controls, SOC 2 Type II audit, incident logging — appear only in the enterprise DPA's Exhibit 2, not the consumer policy.)

The consumer privacy policy does not distinguish free versus paid tiers in data handling. It applies uniformly to Customers/Users. A material delta does exist between these consumer terms and the enterprise DPA (see enterprise object), but within the consumer documents themselves no tier-based difference is disclosed.

The consumer privacy policy does not squarely state that staff may read user prompts/outputs, but it broadly reserves rights to analyze, troubleshoot and record data, and to record events/meetings for training purposes. The enterprise DPA (not consumer) confirms a subset of employees can access customer data. The consumer silence on human review of AI inputs is a gap.

The privacy policy discloses that Apollo may share information with law enforcement, government agencies and courts when it deems disclosure appropriate or legally required, and in corporate events like bankruptcy or acquisition. No specific litigation or government-request history is disclosed. The broad, discretion-based disclosure language raises exposure concerns.

Apollo collects extensive PII on individuals who are not its direct users — names, work emails, phone numbers, job titles, employers, locations, IP addresses, device identifiers and inferred geolocation — sourced from third parties and public scraping, then enriched with inferences and resold. While Apollo characterizes this as non-sensitive business data, the scale, involuntary collection of non-users, profiling, and broker resale place this at high risk. The policy claims no sector-sensitive data but geolocation and device IDs are collected.

The privacy policy is dated September 16, 2025 — under 12 months before the analysis date — and demonstrably covers the AI capabilities the product ships: it addresses AI/ML processing, lead scoring, agentic workflows, third-party AI providers, and profiling, matching the marketing surface's AI-powered features. This is strong coverage plus recency.

Two consumer documents were supplied (Affiliate ToS and Privacy Policy) plus an enterprise DPA. The Affiliate ToS covers only the referral program and does not conflict directly with the Privacy Policy. One notable tension: the DPA's Exhibit 2 states 'Apollo never sells personal data to any third party,' while the consumer Privacy Policy describes Apollo as a registered data broker and describes sharing with advertising/data partners — reconcilable under differing legal definitions but worth flagging. Only minor tensions are present; no clear cross-document license/retention contradiction within the consumer set.