Privacy Policy
Draft — needs counsel
This reflects the intended design but has not been reviewed by an attorney. A data platform holding consumer search records needs a real privacy policy before it takes a paying customer.
Account holders
We collect what credentialing requires: entity details, licence information, contact details for authorised users, and billing information. We use it to verify eligibility, provide the service, and meet our own obligations to data sources.
Search subjects
We process personal information about search subjects on behalf of credentialed clients acting under a documented permissible purpose. Subject identifiers submitted with a search are stored hashed. Search results are retained for 30 days and then purged. The search log — who searched, when, under what purpose — is retained for [LOG WINDOW — set with counsel; long enough to answer an audit, short enough to limit exposure] as the compliance record.
Disclosure
We do not sell personal information. We disclose to upstream data providers as necessary to perform a search, and otherwise only where required by law or valid legal process.
Subject requests
If you believe your information has been processed through this platform, write to accounts@lodestonedata.com. We will respond consistent with applicable law and our obligations to clients, which may limit what we can disclose.