Privacy Policy

1. Information We Collect

Information you provide directly

• Account data: Email address, full name, company name, and password when you register.
• Payment data: Billing address and payment method details, processed and stored by our payment processor (Stripe). We do not store full card numbers.
• Communications: Messages you send us via email or our contact form, including support requests.

Information collected automatically

• API usage logs: Endpoint called, timestamp, response status, credits consumed, and originating IP address. Retained for 90 days.
• Device and browser data: IP address, browser type, operating system, and referring URL, collected when you access our website.
• Session data: Authentication tokens stored as strictly necessary session cookies (no tracking or advertising cookies).

Information we do not collect

We do not collect the content of the data returned by the API (e.g., enriched company records). We do not build behavioral profiles for advertising purposes.

2. How We Use Your Information

• Service delivery: Authenticating API requests, enforcing rate limits and credit quotas, and routing requests to the correct endpoints.
• Billing: Processing payments, issuing invoices, and calculating monthly credit resets.
• Communication: Sending transactional emails. We do not send marketing emails without explicit opt-in.
• Security and abuse prevention: Detecting unusual usage patterns and investigating suspected policy violations.
• Product improvement: Aggregated, anonymised usage analytics.
• Legal compliance: Responding to lawful requests from courts, regulators, or law enforcement.

3. Information Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

• Service providers: Hosting (AWS), payment processing (Stripe), transactional email (Postmark), error monitoring (Sentry). Each provider is bound by data processing agreements.
• Legal obligations: When required by a valid court order, subpoena, or applicable law.
• Business transfers: If we merge with or are acquired by another company, we will notify you 30 days in advance.
• With your consent: For any other purpose, with your explicit written consent.

4. Data Security

• All data in transit is encrypted with TLS 1.2 or higher.
• API keys are stored as SHA-256 hashes.
• Passwords are hashed with bcrypt (cost factor 12).
• Our PostgreSQL database uses encryption at rest (AES-256).
• We conduct quarterly access reviews and annual penetration tests.
• Access to production systems is restricted via enforced MFA.

If you believe your account has been compromised, contact [email protected] immediately.

5. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account termination.
• API call logs: Retained for 90 days, then permanently deleted.
• Payment records: Retained for 7 years to comply with financial regulations.
• Backup copies: May persist in encrypted backups for up to 30 days after deletion from primary storage.

6. Your Rights

Depending on your jurisdiction you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data.
• Portability: Receive your data in a machine-readable format (JSON or CSV).
• Objection: Object to processing of your data for certain purposes.
• Restriction: Request that we restrict processing while a dispute is resolved.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Cookies

We use only strictly necessary cookies:

• Session cookie (mops_session): Maintains your authenticated state. HttpOnly, Secure, SameSite=Strict. Expires at session end.

We do not use analytics, advertising, or third-party tracking cookies.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. If you believe we have inadvertently collected such data, contact us immediately and we will delete it.

9. International Transfers

If you access the Service from outside our home jurisdiction, your data may be transferred to countries with different data protection laws. Where required, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Changes to This Policy

We will notify you by email at least 14 days before material changes take effect.

11. Contact

Privacy: [email protected]
Security: [email protected]