Privacy notice

What we collect

We collect what you give us when you create an account, what your browser sends when you use the app, and the public-source material the pipeline analyses on your behalf:

• Account fields: email, display name, organisation name, password (stored as a salted bcrypt hash).
• Companies you add: name, root URL, and any sources you choose to attach (links, pasted text, uploaded files, LinkedIn URLs you provide).
• Analysis output: scores, evidence quotes, reports, PDFs, and the JSON payloads our pipeline produces from your sources.
• Operational logs: HTTP request lines, response status, and error traces. We retain these for up to 30 days for debugging.
• Email-verification + password-reset tokens — single-use, expire automatically, stored as sha256 hashes (never the raw token).

What we do with it

We use your data to run the product you signed up for: render the dashboard, run Vision analyses, generate reports, deliver transactional emails. We do not sell your data. We do not train third-party AI models on your account contents or your analysis outputs.

Who else sees it

Your account data and analyses are visible only inside your workspace. We use a small number of service providers to run the product:

• OpenAI — for the LLM extraction + scoring steps. Your selected source text is sent to OpenAI per request. We do not opt into model training; OpenAI retains API request content for up to 30 days for abuse monitoring.
• Resend — for transactional email (verification, password reset).
• Railway — our hosting provider. The database, API, and frontend run there.
• LinkdAPI — only when you explicitly request LinkedIn enrichment for a profile URL you provided.

How long we keep it

Account, company, and analysis data are kept while your workspace is active. You can delete a company (with its sources, runs, and reports) from the company page at any time. To delete the whole account, email us and we'll remove it within 14 days.

Your rights

Wherever you're based, you can ask us to: tell you what we hold about you, correct it, delete it, or export it. Send the request from the address on your account.

Cookies + analytics

We use one localStorage entry to hold your session token. We do not run third-party analytics, ad pixels, or session-replay tooling. The marketing landing fires a single first-party telemetry event when you click a major CTA (page + placement); no user identifiers are attached.

Changes to this notice

If we change anything material, we will update the "Last updated" date below and notify active users by email before the change applies.