Privacy policy

What we collect from you

Your email address, your name if you give one, and a password hash or passkey credential, so you can sign in. Optionally your LinkedIn profile URL, if you choose to share it. A record of the meaningful actions you take in the product: the domains you look up, the systems you select, the instances you create, and the questions you ask the explorer. Standard server logs.

What we collect about companies

When a domain is entered, we read publicly available information about that company: pages on its own website, its brand record from Brandfetch, its detected technologies from BuiltWith, and publicly indexed news and coverage. All of it is material the company has published or that is already public. The crawler honours robots.txt, caps how many pages it reads, and identifies itself.

This research is stored once per domain and shared across everyone from that company who uses the product, so the same public pages are not fetched repeatedly. It is not tied to the individual who triggered it.

What the mock data contains

Every business record served by this product is synthetic. Customer names, contacts, transactions, tickets and figures are generated. Named individuals appearing as employees are either people the company has publicly identified as its leadership, or invented. No real customer data of any kind is ingested, stored or served.

Third parties we send data to

• Stripe, for subscription payments. We never see or store card details.
• Railway, which hosts the application and the instance databases.
• Resend, to deliver sign-in and password emails.
• HubSpot, where account activity is mirrored so we can support you.
• Brandfetch and BuiltWith, which receive the company domain being looked up.
• DeepSeek, or whichever language model provider is configured, which receives public company research and schema descriptions in order to generate records. Your questions in the explorer are sent along with the schema, never with the underlying rows before the query runs.
• Whichever web search provider is configured, which receives company-related search queries.

Retention

Instance databases are destroyed when the instance expires, hibernates or is deleted. Company research is retained so it can be refreshed incrementally rather than re-crawled. Account records and the event log are retained while your account exists. Ask us to delete your account and we delete both, along with every instance you own.

Your rights

Access, correction, export and deletion, on request. If you are covered by the GDPR or the CCPA, those rights apply to you in full. Write to paulcheek.com/contact.

If you are a company appearing in this product

Any employee of your company can enter its domain and generate synthetic systems that resemble it. If you would rather your company were not researched, write to us and we will exclude the domain.