Intent Data Privacy Checklist: Sources, Permissions and Controls

Current MarketPulse workflow and review boundaries

MarketPulse is starting at $500/mo. Choose a topic, apply a saved ICP and review actual audience and contact fields. Source, recipient, purpose and channel approval remain separate checks before acting.

MarketPulse standard monthly plans

Plan	Topics and refreshes	Monthly exports
Starter	1 topic, weekly	25,000 contacts
Growth	3 topics, daily	100,000 contacts
Scale	10 topics, daily	Unlimited contacts

Swipe the table to see all columns.

A pull retrieves available data from the previous 24 hours for one topic. Daily use across all included topics provides 90 Growth pulls or 300 Scale pulls in a 30-day month. Weekly Starter pulls vary by calendar month. Available audience size and contact fields vary, and audiences may overlap. Refreshes stop at the plan limit without overage charges.

• Find and qualify: search the topic catalog, save your ICP, and review the people and companies that match.
• Act on the research: export qualified contacts or prepare an Outreach or Direct Mail workflow. Connected products, channel usage, and fulfillment may cost extra.
• Get help from AIMEE: Growth and Scale include AIMEE for the initial user to research accounts and prepare the next step through connected tools.

Agencies and other service businesses can build client deliverables around their available Intent Scans and exports. Keep each client’s scope, permissions, and service fees clear. A subscription is not a promise of a white-label platform or exclusive access to a market.

Explore MarketPulse and watch the demo or compare plans starting at $500/mo. Any early-access discount is a separate, time-limited offer shown to an eligible recipient.

Who this is for

• Agency owners selling or preparing to sell a recurring intent-data service.
• In-house or outside counsel translating applicable law into practical guardrails.
• Compliance, privacy, security, and RevOps leaders responsible for controls across multiple client workspaces.
• Client service leads who need clear approval, change-control, incident, and reporting procedures.

Why privacy and compliance affect profit and delivery quality

Privacy and operational review is not a one-time legal expense. It shapes gross margin, client trust, service continuity, and the amount of work that can safely repeat.

A documented operating model gives the team a shared record to check when a client requests a new topic, source, destination or channel. Reassess new jurisdictions, identity methods and text-message workflows. Measure actual review effort and rework rather than promising a reduction.

The opposite is expensive. An agency that collects first and asks later may need to disable workflows, delete data, rebuild notices, respond to client audits, investigate permissions, or unwind a vendor. It can also lose the trust required for a recurring service.

The commercial objective is therefore not “zero risk.” No serious data operation can promise that. The objective is known data, approved uses, proportionate controls, clear owners, fast exceptions, and evidence of execution.

The privacy and compliance framework

A practical privacy and operational review framework has seven layers.

1. Data and technology inventory

List every source, field, identifier, event, file, API, cookie or similar technology, model output, enrichment step, destination, user, subprocessor, and retention location. Include test systems, exports, spreadsheets, browser downloads, and agent tools – not only the primary platform.

For each item, record:

• What data enters.
• Where it came from.
• Whether it concerns an account, household, device, or person.
• What the agency and client plan to do with it.
• Which systems and parties receive it.
• How long it is retained.
• How access, correction, deletion, opt-out, and suppression requests flow.
• Who owns the record.

Verify the inventory against actual collection settings, destination records and exports. Assign owners to approve needed fields, access, retention, disposal and incident response. An inventory document alone does not prove the controls operate.

2. Role and responsibility map

Do not assume the agency is always “only a processor” or that a white-label arrangement makes the client solely responsible. Actual roles may vary by source and decision. Document who determines purpose and means, who supplies instructions, who receives rights requests, who maintains suppressions, who handles incidents, and who can add a new use.

The role map should align with contracts and operations. If the agreement says the client approves every purpose but an agency employee can independently reuse data across clients, the paperwork and reality conflict.

3. Source, notice, and permitted-use diligence

For every data provider or partner, request enough evidence to evaluate:

• Source categories and collection context.
• Notice and choice mechanisms.
• Geographic and data-type coverage.
• Whether account and person data are distinguished.
• Rights, suppression, deletion, and update processes.
• Permitted and prohibited uses.
• Resale, white-label, audience-upload, and onward-transfer terms.
• Retention, security, subprocessors, and incident obligations.
• Data-broker registrations or other relevant status where applicable.

Record the actual source explanation, notice, rights, update process and permitted downstream use. Have the responsible reviewers resolve gaps before approval. A supplier assertion or contract label alone does not establish that the proposed use is permitted.

4. Use-case and destination approval

Approve a specific path, not “marketing” in the abstract. For example:

company-level topic activity → named-account prioritization → CRM task → seller research

is different from:

person-level website event → mobile number enrichment → automated text message

The second path changes identity, contact, channel, intrusion, and legal analysis. The agency’s allowed-use matrix should classify each source × purpose × destination × jurisdiction as approved, conditional, or prohibited.

5. Data minimization, access, and security

Collect and retain only the fields the approved use needs. Gate person-level enrichment behind account fit. Use role-based access, separate client workspaces, multifactor authentication, secure transfer, encryption as appropriate, logging, export controls, and defined deletion.

Never place one client’s account, contact, campaign, or outcome data into another client’s workspace. White-label presentation does not reduce the need for logical separation.

6. Marketing, audience, and rights controls

Maintain current suppression lists and rights-handling paths across the agency, client, provider, and activation systems. Before each use, check opt-outs, customers, open opportunities, prior complaints, frequency, contact validity, jurisdiction, and channel rules.

Review email, phone, text, advertising and website technology requirements separately for the actual jurisdiction and use. Preserve the required notices, choices and permissions in the operating record. Do not assume a business audience or consent to one channel authorizes another.

7. Monitoring, incidents, change, and deletion

Review access, exports, errors, complaints, rights requests, suppressions, vendor changes, subprocessors, security events, and upcoming retention deletions. Treat a new source, jurisdiction, identifier, model, destination, channel, sensitive category, or agent permission as a change request.

An incident plan should identify detection, containment, evidence preservation, internal escalation, vendor and client notice, legal assessment, remediation, and lessons learned. Practice it before a real event.

How to build the program: a 12-step implementation guide

1. Name accountable owners

The agency owner is accountable for funding and enforcement. Privacy/legal reviewers interpret requirements. Security owns technical controls. RevOps owns field and system behavior. Client service owns approvals and evidence. No workflow should rely on “everyone” being responsible.

2. Create the system and data inventory

Start with the data map described above. Verify it against actual tags, integrations, exports, and user access. Include Claude, ChatGPT, AIMEE, or any other agent surface if client or personal data may enter it.

3. Classify data and prohibited use

Classify account, person, device, contact, behavior, inferred topic, sensitive data, client confidential information, and outcome data. Write a prohibited-use list, including any consequential eligibility or sensitive inference uses the agency will not support without explicit specialist review.

4. Map jurisdictions and channels

Record where the people, client, agency, vendors, systems, and campaign destinations may be located. Then map email, telephone, text, advertising, website tracking, and direct-mail rules separately. A business contact and a consumer contact can still be the same person.

5. Perform vendor and source diligence

Use a standard questionnaire, evidence request, risk rating, and approval record. Do not accept a logo-filled trust page as the entire review. Verify the contract matches the intended resale, client separation, export, agent, and destination model.

6. Write the role and contract matrix

For each source and workflow, define roles, instructions, permitted uses, confidentiality, security, subprocessors, rights assistance, incident notice, deletion, audit evidence, liability, suspension, and exit. The agency-client agreement should mirror provider restrictions.

7. Approve use cases

Create one page per use case with source, purpose, data, identity level, threshold, destination, message or action, owner, approval point, retention, suppressions, outcomes, and limitation. Decline or redesign uses that require more certainty than the data supports.

8. Configure technical controls

Apply client separation, least privilege, authentication, encryption, logging, export restrictions, approval stops, suppression sync, retention jobs, and secure deletion. Test the controls rather than assuming the configuration works.

9. Configure notices, preferences, and rights operations

Counsel should determine which notices, consent or other basis, preference signals, opt-outs, access, correction, deletion, or objection processes apply. Build an intake and fulfillment path with identity verification, deadlines, exceptions, and evidence.

10. Train the delivery team

Training must cover more than legal terms. Show employees how to recognize a new use, avoid invasive outreach, handle an opt-out, store an export, use an agent safely, report an incident, and escalate ambiguity.

11. Run a controlled pilot

Use test or minimized data where possible. Validate source, identity, fit, contactability, suppression, routing, approvals, reporting, deletion, and outcome capture. Stop if a material control fails.

12. Operate the cadence

• Per activation: fit, freshness, identity, permission, validation, suppression, and approval checks.
• Weekly: exceptions, access anomalies, bounces, complaints, duplicates, and routing failures.
• Monthly: rights requests, deletion, vendor changes, usage, client scope, and control performance.
• Quarterly: access review, retention sample, training refresh, contract and subprocessor changes, incident exercise, and executive risk review.
• On change: renewed legal, privacy, security, and commercial approval.

The most useful systems, templates, and professional resources

There is no universal “top platform” for data privacy and compliance for agency intent services. The right stack depends on the agency’s jurisdictions, systems, size, data, channels, and client requirements. The operating artifacts come first.

1. System and data inventory

Use it to trace data from source through identity, enrichment, qualification, activation, reporting, and deletion. A tool can automate discovery, but an accountable person must validate purpose and ownership.

Limitation: inventories become stale unless changes trigger updates.

2. Vendor diligence and evidence register

Store questionnaires, contracts, security reports, subprocessors, source explanations, registrations, permitted uses, incident history where available, renewal dates, and approval conditions.

Limitation: documentation supplied by a vendor is evidence to evaluate, not an independent guarantee.

3. Role, contract, and allowed-use matrix

This ties data roles and contract clauses to actual uses. It prevents a delivery team from assuming one approval covers every client, destination, and channel.

Limitation: it requires legal interpretation and cannot be safely copied from another agency without review.

4. Preference, suppression, and rights system

Centralize the durable state needed to avoid reactivation after an opt-out or deletion. Define how updates propagate to client CRMs, outreach tools, audience destinations, vendors, and backups where applicable.

Limitation: connectors fail; reconciliation and exception monitoring remain necessary.

5. Security and access-control system

Use identity and access management, multifactor authentication, logging, secret management, secure transfer, endpoint controls, backup, and incident tooling appropriate to the risk.

Limitation: buying security software does not replace configuration, training, monitoring, or response.

6. Change and incident register

Track new sources, fields, topics, jurisdictions, destinations, agents, subprocessors, and permissions. Link each change to review, decision, implementation, and verification. Record incidents and near misses with corrective action.

Limitation: a register works only when teams are rewarded for escalating changes rather than hiding them.

7. Qualified legal, privacy, and security support

Outside counsel, a privacy professional, a security assessor, or a fractional lead may be appropriate when in-house expertise is not available. Define who advises, who decides, and how advice becomes an operating control.

Limitation: professional advice still depends on a complete and accurate fact pattern.

Generic privacy policy vs. use-case review

The policy and the operating review should reinforce each other. If the public description and the real data flow diverge, update the process, configuration, contract, or notice as appropriate.

When does a formal program become necessary?

Risk, not employee count, is the better trigger. A small agency may need a formal program as soon as it handles person-level behavioral data for several clients. A larger creative agency with no such data may need a different control set.

Escalate the program when any of these appear:

• Website visitor identification or cross-site topic behavior.
• Person-level enrichment, mobile numbers, or personal emails.
• Multiple clients, users, jurisdictions, or subprocessors.
• Audience uploads or cross-platform matching.
• Automated email, telephone, text, or browser actions.
• Sensitive categories, location, health, finance, children, or consequential decisions.
• Data resale, sharing, or white-label delivery questions.
• Client security questionnaires or regulated customers.
• Large exports, long retention, or broad employee access.
• Contractual audit, deletion, residency, or incident-notice obligations.

Even a low-risk pilot needs an inventory, owners, approved purpose, minimal access, suppression, security, deletion, and incident contact.

Signal sources, identity, activation, and evidence

Intent data changes the compliance decision because it connects observed behavior to prioritization or outreach. Treat each link as a separate question.

Those features do not transfer compliance responsibility to the platform. The agency and client still need to approve sources, roles, notices, channels, permissions, retention, and outcomes. BrandWell’s privacy policy and terms are diligence inputs, not a substitute for the buyer’s own review.

For agent-ready workflows, classify actions:

• Read: retrieve an approved record or report.
• Draft: prepare research, a message, or a summary without sending.
• Write: update a CRM or file.
• Send/upload: communicate externally or move data to a destination.
• Delete: remove or overwrite records.

AIMEE can organize supplied context through configured tools. Name the owners who approve destination writes, uploads, messages and deletion. Confirm actual tool support, permissions, acknowledgements and recovery; an instruction is not evidence that the action executed.

Pricing, cost, and investment

Privacy and operational review pricing should be modeled as an operating cost, not one legal line item:

total compliance cost = professional review + privacy/security tooling + implementation + vendor diligence + training + monitoring + rights/incident work + client-specific changes

Cost drivers include:

• Number of clients, sources, systems, users, and subprocessors.
• Person-level versus account-level data.
• Jurisdictions, channels, and sensitive categories.
• Volume of rights requests, suppressions, exports, and incidents.
• Client audit, insurance, residency, and contract requirements.
• Frequency of product, vendor, platform, or legal change.
• Internal expertise and availability.

Do not invent a universal budget. Ask providers and advisers for written scope and assumptions. Separate one-time setup from recurring operations and event-driven work. Add a change fee when the client requests a new source, destination, geography, or channel.

The ROI is mostly avoided loss and enabled revenue, so it should not be presented as a guaranteed return. Measure rework prevented, onboarding time, control completion, renewal support, incident impact, and gross margin alongside service revenue.

KPIs and benchmarks

A privacy and operational review KPI set can include:

• Inventory completeness and age.
• Workflows with named owner and approved purpose.
• Vendors with current diligence and contract evidence.
• Users passing least-privilege review.
• Suppression propagation success and latency.
• Rights requests completed accurately under the applicable process.
• Records deleted under schedule and exceptions.
• Exceptions, complaints, bounces, and opt-outs by client and channel.
• Incidents and near misses by cause, severity, detection, and closure.
• Training completion plus scenario-test performance.
• Change requests reviewed before launch.
• Client onboarding time and compliance-related rework hours.
• Direct delivery cost and gross margin by package.

Avoid vanity benchmarks such as “zero questions” or “100% compliance.” A healthy program surfaces issues and changes. Benchmarks should come from the agency’s risk assessment, contractual obligations, prior performance, and professional guidance – not an unrelated industry average.

Risks and failure modes

Technical risks

Broken suppression sync, unapproved trackers, shared folders, excess permissions, stale API tokens, missing logs, weak client separation, insecure exports, and failed deletion jobs.

Operational risks

No owner, incomplete inventories, undocumented manual steps, employees using personal tools, change requests bypassing review, and rights requests lost between agency and client.

Privacy and legal risks

Incorrect roles, missing or inaccurate notice, unsupported source or purpose, ignored objection or opt-out, inappropriate sensitive inference, and channel rules copied from another jurisdiction.

Commercial and financial risks

Unlimited audit support, unpriced client-specific controls, platform shutdowns, contract conflicts, insurance gaps, incident cost, and loss of recurring trust.

Vendor and continuity risks

Opaque sources, changed terms, new subprocessors, export limits, inadequate deletion assistance, weak incident notice, service discontinuity, and no migration plan.

Check California’s current DROP processing guidance if the operation is subject to data-broker requirements. Determine applicability from the actual facts. Where the GDPR applies, Article 21 provides a right to object to direct-marketing processing, including related profiling; after an objection, processing for that purpose must stop. This does not summarize every applicable duty.

Support reliable multi-client delivery

Privacy and compliance should be a visible service layer, not a vague disclaimer.

Scope agency service fees separately from actual research subscription and delivery costs. Verify custom client interfaces, integrations and data rights separately. Budget client-specific review, security work, jurisdictions, incident response and operating effort without assuming a wholesale or white-label entitlement.

Track whether controls support dependable delivery: resolved duplicates, suppression timing, clear roles, completed approvals and accurate reports. Renewal or retention impact needs its own evidence. Review expansion as a change to the actual workflow and scope.

Operational checklist

• Inventory data, technologies, systems, users, vendors, exports, agents, and retention.
• Classify identity level, data sensitivity, and prohibited uses.
• Map agency, client, provider, and destination roles per workflow.
• Perform source, notice, choice, security, and contract diligence.
• Approve each purpose, destination, jurisdiction, and channel.
• Minimize enrichment and gate it behind fit.
• Separate clients and apply least privilege.
• Sync suppressions, preferences, and rights handling.
• Define retention and verify deletion.
• Set agent permissions for read, draft, write, send, upload, and delete.
• Train staff on real scenarios and escalation.
• Review exceptions weekly and controls quarterly.
• Test incidents and migration.
• Log changes before activation.
• Obtain qualified legal advice for the actual facts.

Frequently asked questions

How should an agency approach privacy and compliance for intent services?

Build a repeatable operating system around inventory, roles, source diligence, use approval, minimization, security, rights, suppression, retention, incidents, and change. Align public statements, contracts, configuration, and actual practice.

What process, ownership, controls, and cadence are required?

Name executive, privacy/legal, security, RevOps, and client-service owners. Run checks before each activation, exception review weekly, rights and vendor review monthly, access and retention review quarterly, and renewed approval on material change.

Which systems, templates, or professional services are most useful?

Prioritize a data inventory, vendor evidence register, role and allowed-use matrix, preference and rights system, access and security controls, change register, incident playbook, and qualified legal/privacy/security support.

How do the main operating options compare?

A generic policy describes broad practices but does not approve a workflow. Internal operations provide context but may lack specialist expertise. External advisers add expertise but still need accurate facts. Software helps with inventory or execution but does not decide what is lawful. Most agencies need a coordinated combination.

What investment and ongoing cost should an agency expect?

Model professional review, tooling, implementation, vendor diligence, training, monitoring, rights and incident work, plus client-specific changes. Scope varies too much for a responsible universal price.

Which operating and financial metrics should an agency track?

Track inventory and approval coverage, access review, suppression latency, rights and deletion performance, incidents, training, pre-launch changes, rework, onboarding time, direct delivery cost, renewal, and gross margin.

At what agency size does a formal program become necessary?

Use risk rather than headcount. Person-level behavioral data, multiple clients, audience uploads, automated outreach, sensitive categories, several jurisdictions, or client audit obligations are strong triggers even for a small agency.

Which signal, identity, activation, and evidence controls matter most?

Preserve source and timestamp, separate account from person identity, require fit and necessity before enrichment, approve destinations and channels, record suppressions and decisions, and measure outcomes without retaining unnecessary raw data.

What are the biggest operational, security, and continuity risks?

The biggest risks are an unknown data inventory, weak client separation, incompatible contracts, uncontrolled exports, broken suppressions, unreviewed changes, over-privileged agents, opaque sources, and no incident or migration plan.

How should privacy and compliance support multi-client intent delivery?

Make controls part of the product: separated client workspaces, approved source sets, identity thresholds, channel rules, agent approvals, weekly QA, monthly value reporting, retention, and change control. Price exceptional requirements rather than hiding their cost.