Privacy Policy
This policy explains what personal data Data At Scale LLC, a Delaware (USA) limited liability company ("we", "us"), processes, why, and what rights you have. It covers two distinct groups: customers (people with accounts on our platform) and creators (people whose public profile information appears in search results).
1. Customer data
| Data | Purpose | Retention |
|---|---|---|
| Name, work email, password hash | Account access, billing receipts, service notices | Life of the account + 14-day deletion grace |
| Organization details, team membership, roles | Access control and collaboration | Life of the account + 14-day deletion grace |
| Billing records, credit ledger | Metering, invoicing, audit | As required by tax and accounting law |
| Search and lookup history (what was requested, when, and what it cost) | Metering, billing history, support | Life of the account |
Passwords are stored only as one-way hashes. We do not sell customer data.
2. Creator data
Search results contain information creators have made publicly available on their platform profiles: display names, handles, profile URLs, audience statistics, profile descriptions, and — where a creator has published one — a contact email address. We process this data as a provider of business-contact discovery services; our customers act as independent data controllers for the results they retrieve and are responsible for their own lawful use (see the DPA).
Retention: results delivered to a customer are stored in that customer's workspace for up to 12 months after the search completes, then deleted. One exception: a creator a customer explicitly saves to one of their lists is kept until they delete it or close their account — it is a list they built on purpose, not a delivered search result. Email lookups are answered at the time you ask rather than from a standing copy we keep; we store the result only as part of your delivered search results, under the retention rule above.
Creator rights: if you are a creator and want your information removed from our systems, email [email protected] with your profile URL. We handle these requests individually: we will delete the records we hold about you and confirm what we removed, normally within 30 days. Two limits we would rather state plainly than gloss over. We cannot recall information already delivered to a customer before your request — you would need to approach that customer directly, and we will help you identify them. And because your profile is public, a later search may surface it again from the source; tell us if that happens and we will remove it again.
3. Sub-processors
| Provider | Role |
|---|---|
| Railway (US) | Application hosting and databases |
| Stripe (US) | Payment processing (we never store card details) |
| Resend (US) | Transactional email — account, billing and search notifications |
| Cloudflare (US) | Network routing in front of our own infrastructure |
| GitHub (US) | Source control and the container registry we deploy from |
| Google Fonts (US) | Serves the typefaces on our website and dashboard; your browser requests them directly, which discloses your IP address to Google |
4. Legal bases (GDPR)
- Customer data: performance of contract (Art. 6(1)(b)) and legal obligation for billing records (Art. 6(1)(c)).
- Creator data: legitimate interest (Art. 6(1)(f)) in enabling business-to-creator contact using information the creator has published for that purpose, balanced by the retention limits and removal rights above.
5. Security
Data is encrypted in transit; credentials and webhook signatures use industry-standard cryptography; access to production systems is restricted. We notify affected customers of any personal-data breach without undue delay.
6. Your rights
Depending on your jurisdiction you may have rights of access, rectification, erasure, restriction, portability, and objection. Contact [email protected]; we respond within 30 days.
7. Changes
Material changes to this policy will be announced to account holders by email at least 14 days before taking effect.