How do we find your customers?

A corporate address a company publishes on its own website, on a contact page anyone can view, is by definition public commercial information — and it is published precisely so that commercial approaches can be made. We take only information of that nature, from pages requiring no login, in areas the site owner permits. Personal addresses, mobile numbers and gated areas are architecturally out of scope.

We rely on the framework of the target market rather than a single justification. In the EU, GDPR's legitimate interest ground together with its direct marketing recital, applied with a written balancing assessment. In the UK, corporate subscribers are exempt from the consent requirement. In Türkiye, Law No. 6563 requires no prior consent for commercial electronic messages to merchants and tradespeople. For jurisdictions that do require prior consent, a country-level rules engine is on our roadmap.

Every first-touch email carries a one-click opt-out link and the standard headers that power your email client's own unsubscribe button. Once you opt out, the address is suppressed permanently across the whole platform — no brand and no user can email it again. You do not even have to click: replying 'do not contact me again' is enough, the AI recognises it and writes the address to the list. Undeliverable addresses go to the same list.

You do. Your records are isolated per account and no other user can see them. In enterprise deployments the platform runs on your own isolated server with your own database — in that scenario your commercial data never reaches us at all.

No, because no platform honestly can. People change jobs and companies retire domains. What we do is show the verification state on every record instead of hiding it, and never present an unverified record as a verified one. The same principle governs the match score: we do not manufacture a plausible-looking number for a company that could not be scored — every score you see has a real assessment and a one-sentence rationale behind it. An independent verification layer is on our roadmap.

A data source alone is not a defensible advantage. What is defensible is that the entire path from product description to the right counterpart is automated in one place: discovery, relevance scoring, product-specific offer generation, sending discipline, reply classification and automated response with a price list. The whole chain runs inside a single product.

Yes. ihracatAI's own outbound motion runs on the same discovery and sending discipline. We run the engine in our own sales operation before bringing it into the product — that makes it both our test bed and our accountability test.

We write this dependency into our open risk register: Layer 2 rests on a single licensed business data provider today. We mitigate it in two directions. Layer 1 (open web discovery) is a fully independent source and is already proven in our own sales operation; the moment it ships in the product, single-provider dependency structurally drops. The second direction is letting the customer connect their own business data licence — in that model the contract sits directly between customer and provider, so the risk never concentrates in one place.

Scale magnifies risk in an undisciplined engine. Here the working-hours window, address warm-up, spacing between sends, daily ceiling and relevance threshold are system defaults rather than settings a user can switch off, so they apply automatically as the user base grows. Opt-out and suppression already operate platform-wide. The one remaining gap is the country-level rules engine; once that ships, compliance is enforced at platform level independently of user behaviour.