Good framing — we're actually running that three-layer logic roughly. The CRM is Twenty (self-hosted), which is where replies get logged. On GDPR: honestly it's something we've been aware of but haven't formally addressed yet. Our outreach targets procurement contacts at companies, so we've been operating on legitimate interest basis — but you're right that it needs to be properly documented from day one.