Your work.
Your choice.

CompanySift helps you collect prospects from the pages you open in your own browser and prepare a first conversation. This page describes exactly what it reads, keeps and sends.

Operator: HN Hotels Private Limited, GSTIN 29AAHCH1024M1ZH. Contact nihafwork@gmail.com for privacy questions or if you cannot sign in.

Your account and workspace

Browsing does not require an account. Saving creates a private browser preview that expires after 24 hours. Creating an account keeps your prospects, offers, stages, notes and completed briefs across devices. We store your verified email address, an internal sign-in identifier and a salted password hash. Legacy accounts also have a hashed recovery key. We do not store the plaintext password or recovery key. A secure essential cookie maintains your session for up to 30 days.

Email registration and password recovery use links that expire after 30 minutes and can be used once. We store only the token hash; the queued email payload is encrypted and cleared after provider acceptance or an unconfirmed/permanent delivery failure. Expired identity requests are removed after a further 24 hours. Cloudflare processes the recipient address and message to deliver transactional emails. Provider acceptance does not guarantee inbox delivery. Resetting your password revokes previous browser and Chrome sessions. Existing accounts may continue using their original sign-in name and private recovery key, or add a verified email.

AI-assisted briefs

When you request a brief, OpenAI receives the sentence describing what you sell, the audience you named, and the non-contact fields of that one prospect as you collected them: for example name, category, headline, area, rating, review count and follower count, and whether a phone, email or website exists. Phone numbers, email addresses and WhatsApp numbers are never included, and neither are your notes or account identity. The model writes reasons that must each cite a captured field; a checker rejects any reason that cites a missing field or states a number or praise the fields do not contain. For a paid brief, reviewed rules supply a clearly labelled fallback when the AI attempt is unavailable or invalid. API requests use store:false. Provider processing and retention remain subject to OpenAI's API data policies.

What CompanySift for Chrome reads

CompanySift does not hold a directory of businesses or people. Every prospect in your workspace was collected by you, from a page you opened in your own browser, while you were signed in with your own accounts.

• Google Maps. When you press Collect this area or Fill details on the CompanySift panel, the extension reads the listings Google Maps returns to your tab and requests further result pages and place details the way the Maps page does, spaced like a person reading. Nothing is read until you press a button.
• LinkedIn, Sales Navigator and Instagram. Only after you press Collect as I browse in the side panel, and only in that tab, the extension reads the data those pages already received for you: names, headlines, roles, companies, locations, profile links and any public business contact details. It never sends its own requests to LinkedIn or Instagram, never reads or transmits your login cookies, and adds nothing to those pages. A pace meter stops collection when you view more profiles in an hour than people usually do.
• Any other website. Only when you press Save this business, and after you grant permission for that one site, the extension reads the business name and the phone, email, WhatsApp link and address the page publishes about itself.

Chrome browsing history, other tabs, passwords, messages and page content beyond these fields are never read. Collected fields are sent only to your CompanySift workspace. Your prospects are never shared with, joined to or enriched from any other customer's workspace, and they are never sold. Contact details are shown as the source page showed them; CompanySift does not verify them or establish permission to contact anyone, and it never sends messages. Buttons such as WhatsApp or Email open your own app with a draft; you decide whether to send it.

The companion connects only after you approve it from your signed-in account and stores a revocable CompanySift session token in local extension storage. Disconnect Chrome sessions from Your account to revoke access. Browser connections expire after 30 days or when credentials are reset. Chrome Web Store Limited Use: CompanySift's use of information received from these pages complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Payments and service providers

Cloudflare hosts the application and its databases. If a paid plan is enabled, Razorpay handles hosted checkout and payment details. CompanySift stores subscription identifiers, verified payment amounts, billing periods and refund/cancellation status. Card details are not collected by CompanySift. The exact seller and total price must appear in your quote before payment.

Abuse prevention and support

Short-lived hashes of connection addresses and sign-in/workspace identifiers limit abuse. We retain rate-limit counters for their admission window and remove expired counters on scheduled cleanup. Cloudflare may independently process connection information for security and hosting. IP-derived security counters are connection/location-related data; CompanySift does not request GPS or precise device location. Prospects you collect, brief usage and opaque service milestones record product actions, not general browsing activity. There are no advertising trackers in this service. Support requests contain the text you submit and an opaque workspace reference; do not include passwords or financial credentials.

Export and deletion

Export your kept prospects, notes and completed briefs from your workspace, or delete any single prospect. “Delete my account” first stops active renewals, then revokes sessions and removes your sign-in, prospects, offers, notes, support messages and brief content. If the payment provider cannot confirm cancellation, deletion stops and tells you to retry; it does not silently abandon a renewal.

Opaque financial/provider receipts and aggregate budget records may remain for accounting, refunds and abuse prevention. Already delivered sales milestones contain an opaque acquisition reference and outcome only, not your contact details or research content. An in-flight provider request cannot be recalled, but a deleted workspace cannot publish its result. Expired browser previews are removed by scheduled cleanup.

Questions or corrections

Use Support in your signed-in workspace for data corrections, access, deletion or billing questions. The current early release does not promise an automated support response or response time.

Last updated: 22 September 2026.