Trust & privacy
How we protect your data
All of these steps happen before a buyer sees any of your records.
- 01
Rights review
We check your customer contracts, privacy notices and data processing agreements, and leave out anything that can't be licensed.
- 02
Intake
You send an export or give read-only access to the systems and dates you choose. Data is encrypted in transit and at rest.
- 03
De-identification
We replace or remove names, contact details, account numbers and passwords, round dates and amounts, and redact free text.
- 04
Re-identification testing
We test whether any record can be singled out from a combination of fields and remove the ones that can.
- 05
Your review
You see the dataset, our report and the sample a buyer would get. Nothing moves without your sign-off.
- 06
Licensing
Buyers you approve sign terms that ban identifying anyone and reselling or sharing the data, and give us audit rights.
- 07
Deletion
We delete raw exports and remove our access once you approve the cleaned dataset.
What we promise
- ✓We review your customer contracts and privacy terms before touching any data.
- ✓Nothing is offered to a buyer until you approve the dataset and the buyer.
- ✓You can exclude any company, including all of your competitors.
- ✓Every license bans identifying anyone, reselling the data or combining it with other data.
- ✓We delete raw exports once you approve the cleaned dataset.
- ✓We only earn a commission when you're paid.
Where the limits are
- No de-identification method makes re-identification impossible. We reduce the risk, test for it and report what remains.
- Data already used to train a model can't be pulled back out of it. Withdrawal stops future sales.
- We are not your lawyer. For regulated data we'll ask your counsel to sign off.
Questions
What people ask us
UK and EU GDPR, and US state privacy laws including California's CCPA/CPRA. We apply the contract and technical safeguards those laws expect, even to de-identified data.