Privacy policy

What we hold, and why

• Account data: your email, name and sign-in identifier from the shared Programmable sign-in, your organisation name, team membership and roles, notification preferences, API keys (hashed) and billing identifiers. To run your account.
• Your supplier data: the lists you upload, the matches and decisions people on your account make, notes, tags, contact emails for suppliers, documents suppliers provide, and the resulting findings, evidence and audit trail. To provide the Service: this is data you control and we process on your instructions.
• Public-record data: facts about business entities fetched from the Programmable.info registry (SAM.gov public extracts, the Consolidated Screening List, state business registries), kept as dated evidence against your list.
• Operational data: server logs without keys, cookies or request bodies; an append-only audit log of actions on your account; error reports with no personal data; email delivery records.

What we do not do

We do not sell personal data, pool customers' data, train AI on it, or use it for advertising. We never load records about individuals from exclusion lists. Supplier documents are encrypted at rest and shown only to the customer that holds that supplier's file.

Suppliers

If you are a supplier and a customer of ours has your company on a list, we hold your company's public-record facts and whatever your customer or you added (contact email, documents). The customer is the controller of that file; contact them first, or us at [email protected], and we will pass the request on or act on it as their processor.

Where it goes

Hosting is in the United States. The subprocessors we use, and what each one sees, are listed on the subprocessors page.

How long

For as long as you keep your account and the data in it. Superseded evidence and old check records are pruned after two years; findings and the audit log are kept with the account. Deleting a watchlist deletes everything in it. Deleting the account deletes everything within 30 days, apart from invoices and what the law requires us to keep. Email delivery records are kept for 90 days.

Your rights

You can export everything in your account and delete it yourself from Settings. For access, correction or deletion requests you cannot do yourself, or to complain, write to [email protected]. Where EU, UK or similar law applies you also have the rights it gives you, including to complain to a supervisory authority.

Cookies

One encrypted session cookie for sign-in. No advertising or analytics cookies.

Changes

We will note changes here with a new date and tell account owners in the Service when they matter.