Privacy Policy

(a) Account information. When you create an account, we collect your email address. We don't collect or store a password: sign-in is handled by a one-time code sent to your email, and we never see or store that code after it's used.

(b) Purchase and subscription records. When you buy or subscribe to data, we record which banner or category, the tier, the price paid, and the purchase or renewal date, so we can enforce what you're entitled to access and provide you records of your own purchases.

(c) API keys. If you generate a programmatic API key, we store a cryptographic hash of it, not the key itself. We can verify a key you present to us, but we can't recover or display your key after the moment it's issued.

(d) Usage and log data. Our hosting and infrastructure providers (Section 6) automatically log standard technical information when you use the Service (IP address, browser/device information, pages or API endpoints requested, and timestamps) for security, abuse prevention, and diagnosing problems. We use this operationally; we don't build advertising profiles from it.

(e) Correspondence. If you email us, we keep that correspondence to respond to you and maintain a record of the interaction.

(f) Marketing sample downloads. If you download our free sample dataset, we collect the email address you provide so we can follow up about Afferent Synapse. You can unsubscribe from any marketing email at any time.

We use the information above to: authenticate you and maintain your account; process purchases and subscriptions and enforce entitlement to the data you've bought; provide customer support; send you transactional email (sign-in codes, purchase confirmations, and service notices; see Section 7 on your choices); detect and prevent fraud, abuse, and security incidents; and comply with our legal obligations. We do not use your account information to serve you third-party advertising, and we do not sell your personal information to data brokers or advertisers.

The store location, trade-area demographic, and public-program data available for purchase in the catalog is compiled from public government sources and licensed third-party data (retailer store locators, the U.S. Census Bureau, the FBI Crime Data Explorer, the USDA, the Department of Energy, and others; see Data Sources & Definitions for the full list). It describes retail locations and area-level statistics, not identifiable individuals, and is not personal information under this policy. This policy governs the information we collect about you, our customer, not the product itself.

All payments are processed by Stripe, Inc. We do not collect, transmit, or store your card number or other payment credentials on our own servers. Stripe handles that directly, in accordance with Stripe's own privacy policy, and shares with us only what we need to fulfill your order: confirmation that a payment succeeded, the amount, and billing contact details you provide at checkout.

We use a small number of strictly necessary cookies to keep you signed in and maintain your session. These aren't optional, since the Service can't authenticate you without them, and we don't use them to track you across other websites. We don't currently use third-party advertising or cross-site analytics cookies.

We don't sell your personal information. We share it only with the service providers (“sub-processors”) that operate the Service on our behalf, each bound by its own agreement and privacy practices, and only with the access each needs to do its job:

• Supabase: our database, backend, and authentication provider. Your account record, purchase history, and API key hashes are stored here.
• Stripe: payment processing, as described in Section 4.
• Resend: delivers the transactional emails described in Section 1(a) and 7 (sign-in codes, purchase confirmations, service notices).
• Vercel: hosts the Service and generates the technical log data described in Section 1(d).

We may also disclose information where required by law, subpoena, or valid legal process, to protect the rights, property, or safety of the Company or others, or in connection with a merger, acquisition, or sale of assets (with notice to you where required by law).

Transactional email. Sign-in codes and purchase/billing confirmations aren't optional. They're how the Service functions and how we confirm your own transactions to you. Any separate service-announcement email we send will include an unsubscribe option.

Access, correction, and deletion. You can request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and associated personal information, by emailing us at contact@afferentsignal.com. We'll verify your identity before acting on the request. Deleting your account doesn't affect data you've already purchased and downloaded, or records we're required to keep for tax, accounting, or legal purposes.

We retain your account and purchase records for as long as your account is active, and for a reasonable period after closure to satisfy tax, accounting, fraud-prevention, and legal obligations. Technical log data (Section 1(d)) is retained on a shorter rolling basis by our infrastructure providers, consistent with their own operational retention practices.

We rely on our infrastructure providers' security controls (encryption in transit, access controls, and routine security practices) and apply our own access restrictions on top, for example storing only a cryptographic hash of your API key rather than the key itself, so even we can't recover it. No method of transmission or storage is perfectly secure, and we can't guarantee absolute security, but we take reasonable, industry-standard measures to protect your information.

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we'll delete it.

The Service and our infrastructure providers operate in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

We may update this policy from time to time. If we make a material change, we'll provide notice by email or an in-app notice before it takes effect. Continuing to use the Service after a change becomes effective means you accept the updated policy.

Questions about this policy, or requests under Section 7, should go to contact@afferentsignal.com.