Privacy policy

DRAFT — not reviewed by a lawyer and not in force. Text in [square brackets] must be completed before publication.

Who we are

Attestry is operated by [legal entity name, registered address, registration number] ("Attestry", "we"). Privacy contact: [privacy e-mail address]. [EU representative under GDPR Art. 27 and UK representative, if the operator is established outside the EU/UK.] [Data protection officer, if one is appointed.]

Two kinds of personal data

Our customers' account data. Name of the company, the user's e-mail address, a password hash, billing status, API usage logs and security logs. We use it to provide the service, bill for it and keep it secure (GDPR Art. 6(1)(b) and (f)).

Business-contact data about professionals. When this feature is enabled for a country, Attestry returns professional information (name, job title, employer, work e-mail address, professional profile link) obtained from licensed commercial data vendors and official company registers. We do not collect it by scraping websites or social networks. We do not process personal e-mail addresses, private phone numbers, home addresses or special categories of data.

Why and on what legal basis we process business-contact data

Purpose: letting our customers find and keep accurate records of business contacts for business-to-business communication. Legal basis: [legitimate interests, GDPR Art. 6(1)(f) — to be confirmed by counsel with a documented balancing test for each country before the feature is switched on there]. Where a country's law requires consent for this processing, the feature stays off for that country.

Where the data comes from

Each source, its licence and how long we keep its data is published at /v1/sources and on our website. Each field we return names its source.

Who receives it

Our customers, who must use it only for the purpose they declared and under our terms; and our processors: [hosting provider, country], [payment provider], [e-mail provider]. [International transfers and the safeguard used, e.g. Standard Contractual Clauses.]

How long we keep it

Account data: for the life of the account and [period] after closure where the law requires. Usage and security logs: [period]. Stored copies of source records: only where the source's licence allows, for the period shown at /v1/sources, then deleted automatically. Do-not-process entries: kept as one-way keyed hashes for as long as needed to honour the request.

Your rights

You can ask to see, correct or delete data about you, object to its use, or opt out of its sale or sharing, at /privacy-request, free of charge and without an account. Deletion, objection and opt-out requests take effect as soon as you confirm your e-mail address. We answer access and correction requests within 30 days. You can complain to your data protection authority [name the lead authority]. California residents: [Delete Act / CCPA disclosures and data-broker registration number, if registered].

Security

Passwords are hashed with Argon2id. API keys and do-not-process entries are stored as keyed hashes. Access is logged. Details: SECURITY.md.

Changes

We will publish changes here with the date they take effect. Last updated: [date].