Privacy Policy

Effective date: October 19, 2026

1. Introduction

OPENSOSDATA LLC ("we", "us", "our") operates opensosdata.com and the OpenSOSData API. This Privacy Policy explains what information we collect, how we use it, who we share it with, and how we protect it.

OpenSOSData is a developer-focused API that retrieves publicly available US business-entity records. We do not sell your personal data. We collect what we need to operate the service, bill you, secure your account, and measure how people find and use the service.

2. Information We Collect

Account information

• Email address (required for account creation and API key delivery)
• Name (optional)
• Password (stored only as a bcrypt hash; never in plaintext). If you sign in with Google, we do not receive or store a password.

Google sign-in information (if you use "Sign in with Google")

• Your Google account ID, email address, and display name, received from Google during authentication.

Usage data

• API calls made: entity searched, state, timestamp, response time, and whether the result came from cache
• Aggregate statistics (lookups today/month/all-time, cache hit rate)
• Product-analytics events: page views, which buttons/CTAs you click, and which version of certain features you were shown (see Section 6, PostHog)

Billing data

• Credit balance, top-up and purchase history, subscription status
• We do not store payment card numbers; card processing is handled by Stripe.

Advertising-attribution data

• If you arrive from a Google ad, we capture Google click identifiers (gclid, gbraid, or wbraid) and basic referral information (UTM parameters, referrer, landing page) to measure which ads lead to sign-ups and purchases (see Section 6, Google Ads).

Support-chat content

• Messages you type into our AI support chat (see Section 6, Anthropic).

Technical data

• IP addresses and user-agent strings (security, abuse detection, rate limiting, and to determine general location for the advertising measurement described in Section 6)
• HTTP request metadata logged by our infrastructure

Communications

• Emails you send to support@opensosdata.com

3. How We Use Your Information

• To provide and operate the API service
• To authenticate you and secure your account
• To calculate and display usage and billing
• To send transactional emails (API key delivery, verification codes, billing alerts, password resets)
• To send service announcements (downtime, price changes, terms updates)
• To detect and prevent abuse, fraud, and security incidents
• To understand how the service is used and improve it (product analytics)
• To measure the effectiveness of our advertising and attribute sign-ups and purchases to the ads that drove them

4. Advertising and Analytics

We want to be precise about what we do and do not do.

We DO:

• Use PostHog (a third-party product-analytics service) to understand how the site and app are used. PostHog receives your account email address and plan tier so we can analyze usage by account, along with page views and in-product events. We have disabled session recording and autocapture.
• Use Google Ads conversion tracking to measure which advertising campaigns lead to sign-ups and purchases. For users we determine to be located in the United States, we send Google your advertising click identifier (gclid/gbraid/wbraid), the conversion event, and its dollar value. We do not send Google your email, name, or other directly identifying information through this measurement.
• Set and use cookies and similar identifiers related to the above (see Section 8).

We DO NOT:

• Sell your personal data.
• Use the contents of your API lookups or your business-record searches to build advertising profiles about you.
• Serve third-party ads on our own website.

Customer Match (forward-looking): We may, in the future, share a hashed (irreversible) version of your email address with Google to help us reach similar potential customers through advertising. We will update this policy to confirm this is active before we begin, and will do so only for US-based users consistent with Section 6.

5. The Business Entity Data We Retrieve

The core service of OpenSOSData is retrieving publicly available business-entity information from US Secretary of State databases, including registered agents, principal addresses, formation dates, entity status, and officer names where publicly available.

This is public government information from official sources. We do not create this data or warrant its accuracy. If you believe data about a business or agent appears incorrectly in a state database, contact the relevant Secretary of State office directly.

6. Data Sharing - Service Providers and Sub-processors

We share data with service providers to operate the service. We share only what each provider needs for its function.

Providers that process account/personal data:

• DigitalOcean - our primary hosting and managed-database provider (United States). Our application and the database containing your account data run on DigitalOcean infrastructure.
• Stripe - payment processing. Receives your email, name, plan, tokenized payment method, transaction amounts, and account identifiers. Stripe's privacy policy governs card data.
• Resend - transactional email delivery. Receives your email address and name.
• Google (OAuth) - if you sign in with Google, Google authenticates you and provides us your Google ID, email, and name.
• Google (Ads / Data Manager) - advertising-conversion measurement as described in Section 4. Receives click identifiers and conversion values for US users; not your email or name.
• PostHog (PostHog Cloud, United States) - product analytics as described in Section 4. Receives your email and plan tier plus product-usage events.
• Anthropic - powers our AI support chat. When you use the chat, the text of your messages is sent to Anthropic's API to generate a response. We do not send Anthropic your email, name, or account details - only your message text. Do not include sensitive personal or confidential information in support chat.

Infrastructure and data-retrieval providers (no personal account data):

We also use third-party infrastructure, content-delivery, storage, and data-retrieval providers to operate the service and to fetch publicly available business records from government sources. These providers receive only operational and public-record data (such as government portal addresses and public business-entity information) and do not receive your personal account data.

Not currently active:

• AWS Marketplace - we have built, but not yet activated, the ability to offer OpenSOSData through AWS Marketplace. If and when we activate it, AWS will receive billing and usage data for customers who purchase through that channel, and we will update this policy.

We do not sell, rent, or share your personal data with data brokers or for third-party advertising beyond the measurement described in Section 4.

7. Data Retention

• Account data: retained while your account is active and for 2 years after closure for legal and audit purposes.
• Lookup logs: 2 years, for billing reconciliation and audit.
• Cached entity data: approximately 7 days, then overwritten on next lookup.
• Email logs: 90 days.
• Support-chat logs: retained for 30 days (includes the session, your IP, and message content).
• Advertising-attribution cookie (osd_acq): up to 1 year (see Section 8).

You may request deletion of your account and associated data at any time by emailing support@opensosdata.com.

8. Cookies and Similar Technologies

Essential (required to use the service):

• osd_user_token / osd_admin_token - httpOnly session cookies that keep you logged in.
• connect.sid - short-lived session cookie used during Google sign-in.
• osd_pending_search - a brief (approximately 5-minute) cookie holding a search while you complete sign-up.

Analytics and advertising:

• A PostHog analytics cookie (and related localStorage) to recognize return visits for product analytics.
• osd_acq - a first-party cookie (up to 1 year) storing advertising-attribution data (click ID, UTM parameters, referrer) so we can attribute a later sign-up to the ad that referred you.
• Google Ads cookies (e.g. _gcl_*) set by Google's tag to support conversion measurement.

Preferences (localStorage, not cookies, no personal data):

Theme, notification and tutorial preferences.

We do not use cookies to serve third-party advertising on our site. Because our analytics and Google Ads cookies currently load for all visitors (our US-only limit applies to the server-side conversion reporting described in Section 4, not to these client-side cookies), visitors outside the United States may have these cookies set. If you are outside the US and do not wish this, you may block cookies in your browser.

9. Security

• Passwords are hashed with bcrypt at 12 rounds. We never store plaintext passwords.
• API keys are generated using cryptographically secure random sources.
• All traffic between you and our service is encrypted via TLS 1.2 or higher.
• Server access is restricted to SSH key authentication. No password SSH.
• Database backups are encrypted at rest.
• We log all administrative actions for audit purposes.

10. Your Rights

Regardless of where you live, you may at any time:

• Request a copy of all personal data we hold about you
• Request correction of inaccurate personal data
• Request deletion of your account and associated data
• Opt out of non-transactional emails
• Withdraw consent for any optional data processing

To exercise any of these rights, email support@opensosdata.com. We will respond within 30 days.

11. Children

OpenSOSData is a B2B developer service not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will delete it promptly.

12. International Users

OPENSOSDATA LLC operates from Montana, USA, and our production infrastructure is located in the United States. By using the service from outside the United States, you consent to the transfer and processing of your data in the United States.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email to registered users at least 14 days before taking effect. The "Effective date" at the top of this document will reflect the date of the most recent revision.

14. Contact