Privacy Policy

01Who we are (data controller)

MarketPrior, Inc., incorporated in Delaware, United States, is the controller for personal data processed through this website and account signups. For personal data you upload into your tenant workspace, you are the controller and we act as your processor — see the Data Processing Addendum. Contact: privacy@marketprior.com.

02What we collect and why

• Account & contact data (name, work email, company, role) — to create your workspace, respond to demo requests, and provide support. Legal basis: contract and legitimate interests.
• Usage & security logs (IP, device, audit events) — to operate, secure, and meter the service, and to maintain a tamper-evident audit trail. Legal basis: legitimate interests and legal obligation.
• Subject & tenant content you submit (the companies and founders you assess, and your notes) — processed solely to produce your source-cited diligence findings. We do not use it to train models. Legal basis: contract (processed under the DPA).
• Support and contact requests you send from the dashboard, the contact form or the website's bug-report button — your message, your name and email if you give them, your account and workspace when you are signed in, and, unless you untick it, technical details (the page you were on, browser and screen size, and recent failed requests or errors in that tab). Used only to answer you, fix the problem and follow up on a sales enquiry you made. Our support tool sorts each request and may draft a reply, but a person approves every reply before it is sent; bug reports are passed to our maintenance service so the problem can be fixed. Legal basis: contract and legitimate interests.

03People named in public records

To produce diligence findings and leads, we process limited personal data about people who appear in public records in a professional capacity — for example company officers, founders, beneficial owners and business contacts. We act as controller for this data.

• What: name, professional role and company, and business contact points (such as a work email) published on the company's own website, in statutory registers and public filings, or in public code repositories. We keep the source and collection date for each field.
• Lawful basis: legitimate interests (GDPR / UK GDPR Art. 6(1)(f)) in business due diligence and B2B prospecting about the person's professional role. Public-register data is limited to name and officer role. We do not intentionally process special-category data.
• Safeguards: contact details are masked by default and revealed only to authenticated customers on a logged, metered request; we do not sell this data.

04Opt-out and data-subject requests

If you appear in our data you can object at any time — the objection is honoured globally, across all customer workspaces, and removes your contact data from future results.

• Opt out: email privacy@marketprior.com or send a POST with your email address to https://marketprior-diligence.fly.dev/v1/contacts/opt-out.
• Access, export or deletion: email us, or send a POST to https://marketprior-diligence.fly.dev/v1/contacts/dsr with your email and an action of export, delete or opt_out. Exports are released only after we verify you control the mailbox.
• Source of the data: on request we tell you which public source each field came from and when it was collected.

Responses are uniform, so a request never reveals whether we held data about an address. We respond within the time limits set by applicable law (one month under GDPR).

05How we use it

To deliver and improve the service, authenticate users, maintain audit and security records, bill accounts, and communicate with you. We do not sell personal data and we do not use submitted subject or tenant content to train machine-learning models.

06Sharing and sub-processors

We share personal data only with the service providers that help us run MarketPrior: hosting (Supabase, Fly.io, Cloudflare), payments (Stripe), sign-in (Google), email (Supabase, Resend), AI processing (phi-cloud and the model hosts it uses, Laya, AdaptivMapr), public-web collection (twin-browser), support handling (FounderReply, code-anything) and website analytics (Monopea, run by the same operator; see Website analytics below). They act under contract and only as needed. The full, dated list is in the DPA. We disclose data when required by law or to protect rights and safety.

07International transfers & data residency

We host the service in the EU: the database in Switzerland and the application servers in Germany. Some providers — Cloudflare's edge network, Stripe, Google sign-in, Resend and any US model provider reached through our model gateway — may process data outside the EEA/UK. Where they do, we rely on the EU Standard Contractual Clauses (and the UK Addendum) or an adequacy decision.

08Retention

We keep personal data only as long as we need it, then delete or anonymise it automatically:

• Account data — while your account exists. When you delete your account (below) it is removed.
• Monitoring alerts and Ask assistant history — kept for the life of the workspace unless a workspace admin sets automatic deletion after 30, 90, 180 or 365 days in Settings.
• Contact data on people named in public records — deleted 365 days after it was last refreshed or verified; after an opt-out it is no longer shown in any workspace.
• AI usage records — 90 days.
• Platform audit log — 365 days.
• Support and contact requests — 2 years, then deleted, including the copies held by our support tools; removed earlier if you delete your account. Our email provider (Resend) cannot delete individual messages: it keeps its copy under its data processing terms while we use it, and deletes it within 90 days after that ends.
• Billing, payment and credit records — 10 years, to meet accounting and tax obligations.
• Record of your acceptance of these terms and this policy — while your account exists, then kept in pseudonymised form as evidence.

09Your rights

Subject to applicable law (including GDPR), you may request access, correction, deletion, restriction, portability, and objection, and may withdraw consent. Submit requests to privacy@marketprior.com. You may also complain to your local data-protection authority.

10Deleting your account

You can delete your account at any time in Settings → Profile → Delete account, or by emailing privacy@marketprior.com. We disable your sign-in within minutes and, without undue delay and within 30 days, delete your login and personal account data and replace your identifier in audit records with a pseudonym. Data in a workspace belongs to that workspace and stays with your team; it is deleted when the workspace is closed. Billing records are kept as set out under Retention.

11Security

We use encryption in transit and at rest, a separate database schema per workspace, access controls, and an append-only, tamper-evident audit trail. Report security concerns to security@marketprior.com.

12Website analytics

We measure visits to this site and the dashboard with first-party, cookieless analytics, hosted on Cloudflare by Monopea, which is run by the same operator as MarketPrior. It sets no cookies and stores nothing in your browser. Your IP address and user agent are only used to compute a hash with a salt that rotates daily (each salt is deleted within 48 hours); they are never stored. We keep only the page path (with ids removed), the referring site’s host name, UTM campaign tags, your country, your device class (mobile, tablet or desktop), whether you signed up or completed a checkout, and that daily hash, for 90 days. If your browser sends Do-Not-Track or Global Privacy Control, nothing is sent. Legal basis: legitimate interests.

13Cookies and local storage

We use only strictly necessary cookies and browser storage. There are no advertising, analytics or cross-site tracking cookies, so we do not show a cookie banner.

• Sign-in session — keeps you signed in and protects sign-in requests (the authentication session, a short-lived sign-in verifier, and a flag that only says a session exists). Cleared when you sign out.
• Workspace — remembers which workspace you are working in (up to 30 days).
• Preferences — interface settings such as theme, data-residency choice and layout, kept in your browser’s local storage and never sent to us for tracking.

On the sign-in and sign-up pages, the “Continue with Google” button is loaded from Google. If you use it, Google may set its own cookies under Google’s privacy policy.

14Changes

We will post material changes here and update the version and effective date above. Signed-in users are asked to review and confirm a new version of this policy or the terms before continuing.

15Contact

• Privacy questions and data-subject requests: privacy@marketprior.com
• Security reports: security@marketprior.com
• Everything else: hello@marketprior.com
• Controller: MarketPrior, Inc., Delaware, United States. You may also complain to your local data-protection authority.