Compliance

What Istos keeps

For an account, Istos keeps what the person using it puts in or what the agents produce for them:

• Documents they upload or paste: a resume, a company brief, notes on their voice.
• Contacts they add or the agents find: leads, investors, customers, with the email addresses the user or their own finder keys supplied.
• Drafts the agents wrote, and whether they were approved, sent or rejected.
• Logs of what each agent did, and a do-not-contact list.
• Keys and passwords they paste in for a mailbox, a model or an email finder, stored encrypted and used only to act for them.

The public preview on this site keeps its results for 7 days, then drops them.

Where it lives

Account data is stored in a managed database in the European Union. Text sent to a model provider to write or score something is processed under that provider’s data agreement. The privacy policy says the same in its own words.

Istos Agent holds no security certification, such as SOC 2 or ISO 27001, today. We will say so here if that changes.

What Istos never does

• Sell or rent your data, your contacts or the addresses you find.
• Use your documents to train models.
• Send a message without your approval. Every email waits in your queue until you approve it.
• Automate LinkedIn. LinkedIn messages are drafts you copy and send yourself.
• Guess an email address from a name pattern. An address comes from you or from a finder you connected.

Who is the sender

The person who uses Istos Agent is the sender of their outreach. They choose who to write to, approve every message, and send it from their own mailbox or a mailbox they connected. For the contacts and drafts in their account, they are the data controller and Istos Agent is their processor: it handles that data only to run the service for them, as set out in the terms.

For the account itself (an email address, a sign-in, billing), Istos Agent is the controller. The company behind the product is Halfwings.

Legal basis for cold email

Most people who write to business contacts they have not met rely on legitimate interest, which works when the message is relevant to the person’s job, the sender is plain about who they are, and the person can say no easily and is listened to. That is how the product is built: one-to-one notes, a clear opt-out and a list of people never to contact.

The rules differ by country. Some require consent before a first email, and the United States, the United Kingdom and Canada each have their own. Check what applies to the people you write to. This is not legal advice, and using Istos Agent does not make a campaign lawful on its own.

How a recipient opts out

Anyone can stop emails in four ways:

• Reply “no thanks”, “unsubscribe” or “remove me”. When the sender reads replies with Istos Agent, a clear request like that adds the person to their do-not-contact list and ends the thread.
• Use the link at the end of a cold email, or the unsubscribe button a mail app shows from the email’s List-Unsubscribe header. That stops that sender at once.
• Use the opt-out page to stop everyone using Istos Agent. We email a link that works once and expires in 24 hours. Confirm it and the address is blocked on every account.
• Write to info@istosagent.com and a person will do it for you.

The page answers the same way for every address, so it cannot be used to find out who is known. We keep only a one-way fingerprint of an opted-out address, enough to keep honouring it.

The do-not-contact list

Each account has a list of email addresses and whole domains it never writes to. A domain covers its subdomains. It is checked before a draft is written, before a paid address lookup, in the queue and again on the server just before anything sends. Someone on the list cannot be approved or sent to.

The sender can add people by hand, paste or import a file, and export the list. It also fills itself when someone replies asking to stop. A reply like “not interested right now, maybe next quarter” is not treated as an opt-out; it is shown to the sender to decide.

Finding contact details

Istos Agent does not sell or resell contact data. To find an email address, a user connects their own account with an email finder (Hunter, Prospeo or LeadMagic) and pays that provider directly. Istos Agent asks the provider on their behalf, keeps the answer in their account for 30 days so the same person is not paid for twice, and never sends to an address a finder could not confirm without a clear yes from the user.

Retention and deletion

Data stays while the account is open, and the user can delete contacts, drafts and documents at any time. When an account is closed, its data is deleted within 30 days.

An address that opted out through the opt-out page is kept as a fingerprint after that, so no one can email it by mistake. Ask for it to be removed at info@istosagent.com and we will.

Contact

Questions about this page, a request to access or delete data, or a complaint about an email sent with Istos Agent: info@istosagent.com.