Privacy Policy

This policy explains what personal data AIData.Broker collects, why, who else handles it, how long we keep it, and your rights. The controller is O-mega Enterprise, Inc, trading as AIData.Broker: we decide how and why the data described here is used.

• Operator: O-mega Enterprise, Inc
• Postal address: 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States

When a holder shares counts or a sample for a valuation, the holder decides what they are for, and we act for it under the valuation and sample processing terms, as its processor and, under California law, its service provider. Counts that are not personal data, combined with other holders' figures, join the market statistics our valuations are priced from, and for that use we decide ourselves. This policy covers what we collect for ourselves, and explains what we handle for holders.

It does not cover a buyer's or another company's own handling of data, which their own policies govern.

We count visits ourselves, without cookies. For each page view we record the page and the site's address, the page that sent you (its full address), the campaign tags in the link you followed, your country (from your network address, which we then discard), how long the page was open and how far you scrolled, whether your browser shows signs of being automated and the name an automated visitor gives itself, and a visitor code made by hashing your network address and browser details with a value that changes every day. We do not store the network address itself, and yesterday's code cannot be matched with today's. We also record a few actions as events: signing up for the newsletter (with the page and the role you chose) and following a link to a partner. We use these counts to see which pages are read and to tell people from automated visitors, and delete them after 180 days.

Our host also handles your network address to deliver each page and protect the site from abuse. Pages that show a company's logo ask Google's icon service for it, so your browser sends Google your network address and the page's site, under Google's own privacy policy.

• Your answers. The questions about the company and its data, and the company's name and website if you give them. We keep each valuation you ask for, whether or not you are signed in.
• Your email address. The valuation asks where to send it. We keep the address with the valuation, send the valuation to it, and write a few times in the month after it about what it means: what it rests on, how a sale runs, and selling it yourself or through us. We stop when you ask us to sell it, after the last of those emails, or when you use the unsubscribe link each one carries. Signing in with the same address puts the valuation in your account.
• The company lookup. When you type a website, we look the company up to fill in the form: we read its website, ask Suprsonic.ai for its public company profile, and ask PeopleSearch.im how many people work there and where, sending only the company's name and website. We keep the counts, not the profiles.
• Counts, not files. Any export you add is read in your own browser and not sent to us. What reaches us, when you ask for the valuation, is counts about the files: how many records and words, over which months, how many link to another system, are repeated or automated, or contain identifiers such as email addresses, the system and file types they came from, and a one-way code for each file so the same export measured again replaces its earlier count. To show whose records they are, it also sends the few internet domains the mailboxes use most and the company names that appear most as issuer or buyer on e-invoices, each with its count. A name that reads as a person's is dropped on your computer before anything is sent, unless it carries a company form such as Ltd or Inc. The counts are built to hold no names of people, no addresses, no file names and no text.
• A de-identified sample, if you choose to send one. It is de-identified in your browser by our standard (De-identification), with the original records, the list of who is who and its key kept on your computer. When it arrives, our rules and an AI model read it again, and whatever either still finds that could identify a person is replaced before it is measured. The model is Anthropic's, run for us through Founden: Anthropic may keep the text it reads for up to 30 days, and longer only where its safety systems flag it or the law requires, and does not use it to train its models. On our side the text is deleted once it is measured, in the same request, and no person reads it. We keep the measurements, the counts of what was replaced, the de-identification report (counts only), your confirmation and its time.
• A random token in a cookie lets a valuation made before you sign in reach your account once you do.

We use these to value your data and, without your name and combined with other holders' figures, in the market statistics every valuation is priced from. We do not use them to approach a buyer about your data unless you ask us to. For other kinds of data (video, speech, images, text, simulated environments, robot data), the valuation does its arithmetic in your browser and saves nothing unless you choose to send us a description.

When you describe data you hold, post a request for data, or register an introduction, we keep what you enter: your name, email address and role, the company or person the form is about, and your description of the data, its size, its rights and any concerns. We also keep the introducer code of the link you followed, and send you a confirmation and our mailbox a copy.

An introduction also records the name and, if you give them, the contact details of the holder you introduce. We contact that holder only after you tell us they agreed, and when we do, we tell them you gave us their details. We show you the introduction's stage, not the holder's name, records or figures.

• Your account: your email address and name, a protected form of your password (not the password itself), whether you confirmed the address, and for each sign-in its time, your network address and your browser, which we keep to secure your account. When you sign up, the platform checks the address against a list of throwaway email domains.
• Agreements: when you accept a mandate and the NDA (in one step) or the valuation and sample processing terms, we keep the exact text you accepted, its version and fingerprint, the holder's name and address, the full name and role you typed, your email address, the time, and your network address and browser at that moment, and we email you a copy with its fingerprint. This is the evidence of the agreement.
• The lot: what you enter in the workspace (the rights file, the datasheet, any buyer you leave out or add, your messages) and the record of every approach, offer and decision in the sale.

We need these to provide the Service you asked for and to perform and prove the agreements.

If you sign up for our weekly newsletter we keep your email address, what you told us you are (if you did), the page you signed up on and the campaign tags in its link. Every issue carries a link that stops it, and your mail program's unsubscribe button stops it in one click. When you leave, we delete your subscription and keep only your address, on a list that keeps us from writing to it again.

Our mailbox keeps the email you send us, with its attachments, and when we open it we link each email to the records it concerns (a valuation, an agreement, a subscription, an outreach record) so we answer with the whole history in view. Please do not send us files, exports or logins: holder data reaches us only through the valuation and the workspace.

When an AI assistant connected to our MCP server calls one of its tools, we receive what the assistant sends for that call (the tool's name and its arguments) and, as with any request, its network address and software name. We do not receive the rest of your conversation, and the server needs no account, key or cookie. We count each call as we count a page view (the tool, the kind of data and the words searched for, your country, the name the assistant's software gives itself and the daily visitor code), and the server only reads published data.

We write to people at companies that we have reason to think hold data a buyer may want: a company that is closing or has closed, an estate in insolvency, or a company whose records match what buyers publish that they buy. If you received such an email:

• Where your details came from: your name, role and employer, your work email address and your professional profile link come from a licensed business contact database (PeopleSearch.im). Where a public record names you in a role at the company, we searched that database for your work address by your name. The fact that your company may hold such data comes from public records (company registers, insolvency notices, court and securities filings, layoff notices), news reports and public forums, archived copies of its website, or its own public pages and listings.
• What we keep: those details, the check of your address, the reason we wrote and the facts about your company we used, the emails we sent, whether each was delivered, and any reply.
• Why, and on what basis: to offer your company our service, on our legitimate interest in telling businesses about a service relevant to them. We write first only to work addresses in the United States and the United Kingdom, under the rules for business email there; in the United Kingdom only to companies and limited liability partnerships.
• How to stop it: every email carries a link that stops further email from us, and a reply asking us to stop does the same: we stop writing to you and keep your address on a list that keeps us from writing to it again.

You may also ask us to delete your details or object to this use, as section 21 explains.

To find companies with data to sell, we follow public registers and notices (company registers, gazettes of insolvency notices, court, securities and layoff filings), news reports and public forums, archived copies of company websites, and the pages a company publishes about itself, including its listing in a startup directory. Where such a record names a person in a role at the company, such as a director, a person with significant control, an insolvency officeholder or a founder, we keep that person's name, role, firm, register number, the days they took and left the role, the link to the record and, for a founder in a startup directory, the profile link the directory gives, and nothing more from that source: not an address, a date of birth or a nationality, even where the record shows one. We read these records again from time to time, so that we know when someone has left a role. We use them to know whom a sale would need to involve, and may look up that person's work address in PeopleSearch.im to write to them, as section 9 describes. We keep a log of the searches we run, which may name a person. We do not publish these names: our public register of closures names no person.

We do not write to each person we find in a public record to tell them, because that would take effort out of proportion to what we keep; this section is how we tell them.

When a holder accepts a mandate, we screen it and its signer against the sanctions lists at that moment, and run our other checks after it, before we approach any buyer, as how we verify every holder describes. A failed check ends the mandate that day. The checks handle personal data about the holder's signer, officers and beneficial owners and, when the holder is a person, about that person:

• The official register. We read the company's record (its name, number, status and address, its officers' names and roles and, where the register lists them, its beneficial owners) from the register itself where it offers a lookup (Companies House, Registre national des entreprises, Brønnøysund Register Centre, Finnish Patent and Registration Office, ARES, ACRA), from GLEIF or EU VIES, or from the register extract the holder adds.
• Documents the holder adds. A register extract, a written authorisation or a transfer document added in the workspace passes through Founden and Anthropic to be read by our AI systems for its facts. We keep those facts, the file's name and its fingerprint (its SHA-256 hash), not the file itself.
• The signer's address. We email a confirmation link to an address at the company's own domain. When the signer's address is not at that domain, we look up once whom it belongs to, through PeopleSearch.im.
• The brand. We read the brand's website (its home, terms, privacy, legal and contact pages) and its domain's public registration record (RDAP).
• Beneficial owners the holder names. Each one's name, whether it is a person or a company, its country and its share band.
• A holder that is a person. Their name and country, screened as below, and the evidence they give that they control the data (for code, the account that holds the repositories).
• The public record. A web search of news, court and regulator records about the company, its brand and its signer, read by our AI systems.
• Sanctions. The company, its brand, its signer, officers and beneficial owners are checked against the US Consolidated Screening List, the UN Security Council Consolidated List, the UK Sanctions List and the EU Consolidated Financial Sanctions List, and so is each buyer, by its name and those it names as owning it, before we approach it. We run the screening again every day while a mandate is in force.

We keep each check's result, with its source and when it was read, with the lot, and we add the company's register record (its officers and, where listed, its beneficial owners) to our record of that company, which section 10 describes. We do this on our legitimate interest in knowing whom we deal with and that a holder may sell what it offers, and because sanctions law forbids us to deal with listed persons.

• We do not buy a holder's data, take ownership of it, or license or sell it in our own name. The holder, or a provider it chooses, delivers the data to the buyer, and the buyer pays the holder.
• We do not sell, rent or license personal data to anyone, and we do not "share" it for advertising as California law uses the word.
• We keep and use de-identified data only in de-identified form and do not try to re-identify anyone in it, and in every sale we run we ask the holder to bind the buyer to the same (De-identification).
• We show no advertising, and the site sets no advertising or analytics cookie.
• Our AI systems choose which businesses to write to, draft and send the emails and value data; none of this has legal or similarly significant effects on you.
• Our checks of a holder run automatically, and a failed check ends its mandate that day, which is necessary to perform the mandate lawfully. A possible sanctions match goes to a person before we act on it. A holder whose mandate a check ended is told why, can ask a person to look at it again and give its view, and we restore the mandate if the check was wrong.

• Contract: to provide what you asked for (a valuation, an account, an agreement and the sale under it), and to take steps you asked for before one.
• Legitimate interests: to run and secure the Service (sign-in records and logs), to count visits so we know which pages are read, to improve our valuations, to follow public records and keep company records current so we can find holders, to check holders and screen parties before we act, including against sanctions lists, to write to you in the month after a valuation you asked for about what it means and how a sale runs, and to write to businesses about a service relevant to them. Our interest in each is running a lawful and secure brokerage. You may object at any time, and we then stop unless our reasons override yours or we need the data for a legal claim.
• Consent: for the newsletter, which you can stop at any time.
• Legal obligation: to keep the records tax and company law require.

The site sets only the cookies it needs to work:

• adb_checks (30 days): lets the valuations you made before signing in reach your account once you sign in. It holds random tokens only.
• aidb_via (90 days): keeps the introducer's code from the link you followed, so that the introducer is credited if you later ask us to sell.
• the sign-in session cookies (7 days): keep you signed in to your account and workspace. Each is renewed while you use the site, and signing out removes it.

There are no analytics, advertising or tracking cookies. You can block cookies in your browser; the public site still works, but you cannot sign in, and a valuation made before you sign in will not reach your account.

These companies process personal data for us, each only to do its job for us:

• Founden (the platform this service runs on), in the United States: everything the Service holds, as the platform that hosts our code, our mailbox and our outbound email, runs the AI systems that operate the Service, checks sign-up addresses against throwaway email domains, and passes the email we send to people who did not ask for it to its sending provider.
• Render Services, Inc. (hosting for the platform), in the United States: what passes through the platform: email, AI requests and the documents they read, mailbox reads and contact lookups.
• Vercel Inc. (hosting), in the United States and Vercel's edge network: every request to the site (network address, browser details and the page asked for) and our logs.
• Neon (database), in the United States: accounts and sign-in records, valuations and counts, agreements and the record of each sale, form entries, newsletter subscribers, people we write to, company records with the people named in public records, holder checks, visit counts and logs.
• Resend (email delivery), in the United States: the address and content of the email the Service sends, such as account confirmations and the newsletter.
• Anthropic PBC (the AI models our operator runs on, through Founden), in the United States: what the AI systems read to do their work: email sent to us, form entries, counts, drafts, the documents a holder adds for verification, a valuation sample after it was de-identified (read once, to find what the de-identification missed), and web searches of the public record about a holder and its signer.
• AgentMail (email to people we write to without being asked), in the United States: the address and content of each such email, and the replies to it.
• Suprsonic.ai (company data and email address checks, from Apollo, Brandfetch and the company's own website), in the United States: the website address typed into a valuation, to fill in what public data says about that company, and the work address of each person we write to without being asked, to check it can receive email first.
• PeopleSearch.im (business contact data, from its provider Icypeas), in France (Icypeas): names, roles, employers and work email addresses of people at companies we write to; the names of people a public record names in a role at a company, to find their work address; for a valuation, how many people work at the company and where (we keep the counts, not the profiles); and whom a holder signer's address belongs to when it is not at the company's domain.

We also share personal data:

• With Google, only as section 2 describes, when a page shows a company's logo.
• With buyers, only with the holder's written agreement. A description of a holder's data reaches a buyer only once the holder has agreed in writing, and a buyer that posts a request is not named to a holder without the buyer's agreement.
• With introducers, only the stage of the holders they introduced.
• With professional advisers, such as lawyers and accountants, where needed.
• With authorities, where the law requires it or to protect our rights or others' safety.
• With a company that takes over the Service, which we require to keep this policy's promises.

To run the Service and fix errors, our systems log events, including the email address a message was sent to and error reports from your browser. Our host keeps its logs for a short period, and we keep the most recent warnings and errors.

AIData.Broker is run with AI systems that we operate and are responsible for, built on Anthropic's models through the Founden platform. To do their work they read what you send us (email, form entries, counts, a de-identified sample, verification documents, workspace messages) and what they look up for it in public sources and the business contact database, as section 9, section 10 and section 11 describe, and they write our research, valuations, drafts and replies. The same rules in this policy apply to them.

We are based in the United States, so what you send us from elsewhere is handled there, and most of the companies above process it there. When we pass personal data from the European Economic Area, the United Kingdom or Switzerland to a company that handles it for us, we rely on that company's own data protection terms and the transfer mechanism they provide, such as the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and the UK and Swiss equivalents, or the EU-US Data Privacy Framework where the company is certified.

• Visit and tool-call counts: 180 days.
• Sign-in records: while the session lasts (7 days, renewed while you use the site).
• Valuations, counts and sample measurements: until you delete the valuation in your workspace, or ask us to close your account or, for a valuation made without an account, to delete it. A valuation for which a mandate was accepted is kept as long as that mandate's record.
• Mandates and NDAs, and the record of a sale: for as long as claims under them can be brought and as tax and accounting law require. The valuation and sample processing terms are deleted with their valuation.
• Accounts: until you ask us to close yours, together with what it holds, except what the lines above keep longer.
• Forms, introductions and email: while the matter is open, and then as long as needed to answer for it, or until you ask us to delete them.
• Newsletter subscribers: until you leave; then only the address, on the do-not-write list.
• People we wrote to: until you ask us to stop or to delete them; then only the address, on the do-not-write list.
• Names from public records and holder checks: while the company may still sell data, or while the lot they concern is open; for a lot with an accepted mandate, as long as the law requires a record of the transaction.
• Logs: our host keeps its own for a short period, and our database keeps the most recent 1,000 lines.

A workspace can be opened only by the account that holds the valuation and by our operators, and the database enforces it row by row. Data travels encrypted, and passwords are stored only in protected form. No system is perfectly secure; if a breach affects you, we tell you and the authorities as the law requires.

Wherever you live, you can ask us to tell you what we hold about you, give you a copy, correct it, delete it, or stop using it for a purpose, and to stop our email. Depending on the law where you live, you may also have the right to restrict our use, to move your data, to object to processing based on legitimate interests, and to withdraw consent. We answer these requests by hand, for every place your data is kept, including the records described in section 9, section 10 and section 11.

California and other US states. Residents of California and of other states with privacy laws can ask to know, access, correct and delete their personal data, and will not be treated differently for asking. In the last 12 months we collected identifiers (names, email addresses, the network addresses of sign-ins), professional information (roles and employers), internet activity (page views, kept 180 days), commercial information (valuations, agreements and offers) and sensitive information only as your login; we draw no inferences about you. The sources, purposes, recipients and retention of each are in the sections above. We do not sell or share personal data, so there is nothing to opt out of, and we use sensitive personal data (your login) only to sign you in. You can use an authorised agent, and we will ask you to confirm the request.

How. Write to us at hello@aidata.broker, or reply to any email from us. We answer within the time the law sets (one month in the EEA and the UK, 45 days in California), and we may ask you to confirm who you are. In the EEA you may also complain to your data protection authority, and in the UK to the Information Commissioner's Office.

The Service is not for anyone under 18, and we do not knowingly collect their data. We do not take data about children to market. If you think we hold a child's data, write to us and we will delete it.

We change this policy when the Service changes what it does with personal data, and the date at the top says when the current version took effect. We do not use data collected under an earlier version for a new purpose without telling you first and, where the law requires, asking you.

Questions, requests or complaints about this policy or your data: write to us at hello@aidata.broker.

• Operator: O-mega Enterprise, Inc
• Postal address: 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States