Where Your Prospect Data Goes: An Analysis of Apollo, Clay, and ZoomInfo
Sales intelligence platforms like Apollo.io and ZoomInfo use your company's private contact data to enrich the database they sell to all of their customers. This is often called a contributory, or "give-to-get," model: to get access to their database, you must contribute your own. When you connect your CRM or email, you grant them a license to scan your data, extract contact information, and add it to their central database for everyone to use.
The platform’s primary asset becomes the pooled data from its entire user base. Your proprietary contacts, email signatures, and CRM records become part of their product. While this creates a large dataset, it also introduces significant business and security risks.
What the Terms of Service Actually Say
The mechanics of this model are not hidden. They are described in the terms of service and privacy policies of the platforms that use it. We examined the policies for three major platforms to see how they handle customer data.
Apollo.io
Apollo’s privacy policy states that when customers submit data, "Apollo may use such information to grow, enrich, and verify the information included in our Contributory Database." When you sync your CRM or email, your contacts are used to enrich Apollo’s main database, which is available to all customers. Apollo is also registered as a data broker in California, a legal designation for companies that knowingly collect and sell the personal information of consumers with whom they do not have a direct relationship.
ZoomInfo
ZoomInfo operates a similar model with its “Community Edition,” also known as ZoomInfo Lite. In exchange for limited free access, users install a “Contact Contributor” application that grants ZoomInfo permission to scan their email. According to its privacy policy, it collects business information from email signatures, contact books, and email directories. This includes names, email addresses, phone numbers, and job titles. The contact data it extracts is a primary source for the database it sells to its enterprise customers.
Clay
Clay operates on a different model. It functions as a data orchestration platform, not a contributory database. Clay’s privacy policy states that customer data will only be used to provide its services and "will not be used by Clay for any other purpose." Clay’s terms define its role as a “data processor,” acting on the instructions of its customers, not as a data controller that uses customer data for its own purposes.
The Business Risks of Contributory Databases
Sharing your internal data with a central, multi-tenant database creates several risks that are often overlooked.
1. Data Leakage and Security Breaches
When your data is pooled with data from thousands of other companies, its security is no longer entirely in your control. A breach at the platform level can expose your proprietary information. In July 2018, Apollo.io experienced a major data breach where a database containing billions of data points was left exposed. The security researcher who discovered the breach confirmed that the exposed information included “client-imported data.” One Apollo customer, New Relic, publicly notified its users that contact information it had shared with the platform was compromised in the incident.
2. Compliance and Legal Liability
Sharing contact data without explicit consent can create legal liability under privacy regulations like GDPR and CCPA. Under GDPR, sharing data with a third party is a form of “processing” that requires its own lawful basis, separate from why you initially collected the data. Under CCPA, exchanging contacts for access to a database can be considered a “sale” for “valuable consideration.” This triggers obligations to provide consumers with a “Do Not Sell or Share My Personal Information” option. The 2022 settlement between the California Attorney General and Sephora established that sharing data with third parties for analytics can constitute a “sale,” setting a precedent for this broad interpretation.
3. Loss of Competitive Advantage
A carefully curated list of prospects and customers is a valuable asset. When this list is absorbed into a database that your competitors can also access, its strategic value diminishes. The unique leads your team spent months or years cultivating become a commodity, available to anyone with a subscription to the platform.
How to Protect Your Company's Data
The first step is to understand how your current tools handle your data. From there, you can take concrete steps to mitigate risk.
- Audit your tools. Review the terms of service and privacy policies for any platform connected to your CRM or email. Look for language about data contribution, licensing of your data, or use of your data to improve the service’s database.
- Limit permissions. When connecting a service, grant the most restrictive access possible. Avoid connecting accounts that contain highly sensitive customer or internal information. Use service accounts with limited scopes where possible.
- Ask providers direct questions. If the terms are unclear, ask your vendor’s security or legal team directly: ‘Do you operate a contributory database? How is my company's data isolated from other customers? Is my data used to enrich your central database?’
- Consider alternative models. Evaluate tools that do not rely on a give-to-get model. Platforms that source data from public sources or operate as pure data processors do not require you to contribute your private data to function.
Understanding the data model of your sales and marketing tools is critical. When a service offers access to millions of contacts, it is worth asking where that data comes from. In many cases, it comes from you.
