Privacy Policy
How Data.co collects, uses, shares, retains and deletes personal data when you use data.co, the Data.co Marketplace, app.data.co, and the Data.co API and MCP server, and how you can exercise your privacy rights. Data processed inside a customer's own Data.co Control deployment is not covered here; that data stays with the customer.
Who we are and what this policy covers.
This Privacy Policy explains how Nead, LLC, an Arkansas limited liability company doing business as Data.co ("Data.co", "we", "us", "our") processes personal data in connection with the following services (together, the "Services"): the data.co website, including the blog; the Data.co Marketplace at data.co/marketplace and the graphics at data.co/graphics, including graphic embeds displayed on other websites; the app.data.co account portal, where customers manage accounts, organizations, API keys and billing; and the Data.co public REST API and MCP server.
Our postal address is Nead, LLC, 1425 Broadway Suite 22689, Seattle, WA 98112, United States.
"Personal data" means any information relating to an identified or identifiable individual. It includes what some US state laws call "personal information".
Data.co as controller. We are the controller (or "business" under US state laws) for personal data we collect for our own purposes: website visitors, people who contact us or request a demo, account holders and users of app.data.co, billing contacts, people who receive our communications, and API and MCP usage records we keep for metering, security and billing.
Data.co as processor. When a customer organization uses app.data.co or engages us for support or managed services, some personal data is processed on that customer's behalf, for example the names and roles of the customer's users and the organization's audit events. For that data the customer is the controller and we act as its processor (or "service provider") under our Data Processing Addendum. If your organization gave you access to app.data.co, direct requests about that data to your organization; if you contact us, we will forward your request to it.
Data.co Control is out of scope. Data.co Control is software that customers run in their own infrastructure. Prompts, documents, embeddings, records and audit logs processed by a customer's deployment are controlled by that customer and are not sent to Data.co. Customers may opt in to operational telemetry limited to deployment version, license status and health; air-gapped deployments send none. Questions about data in a Data.co Control deployment should go to the organization that operates it.
This policy does not cover third-party websites, including sites that display a Data.co graphic embed, or the privacy practices of Marketplace data providers acting as independent businesses.
Categories of personal data and where they come from.
We collect only what we need for the purposes in section 3. We do not ask for special categories of personal data (such as health, biometric or political data) through the Services, and you should not send them to us.
| Category | What it includes | Source |
|---|---|---|
| Inquiry and lead data | Name, work email, company, job title, phone number, message, and answers to form questions (for example topic, industry, deployment preference, expected users, data types) | You, when you submit a form on data.co (contact, demo, assessment, data provider, Marketplace contact, API waitlist, dataset notification) |
| Form context data | The page URL where you submitted a form, the referring URL, UTM campaign parameters, your IP address and browser user agent | Your browser, automatically when you submit a form |
| Correspondence | Emails and messages you send us, our replies, and any attachments | You and our staff |
| Account data | Name, email address, hashed password, two-factor authentication and passkey credentials, organization membership and role, account settings | You, or the administrator of your organization who invites you |
| Session and security data | Session identifiers, sign-in times, IP address, browser user agent, and security and audit events such as sign-ins, key creation and permission changes | Your use of app.data.co |
| API and MCP usage data | API key identifier, endpoint or tool called, dataset accessed, request identifier, timestamps, response status, request volume and IP address | Your applications and agents calling the API or MCP server |
| Billing data | Billing contact name and email, company name, billing address, tax identifiers, plan, invoices, payment status, and payment method details such as card brand and last four digits | You and our payment processor. We do not store full card numbers. |
| Support data | The content of support requests, the account they relate to, and diagnostic details you choose to share | You |
| Website log data | IP address, request URL, referrer, browser user agent, timestamps and response codes, including requests for graphic embeds | Your browser, automatically, via our servers and our CDN |
| Opt-in deployment telemetry | Deployment version, license status and health signals. No customer content. | A customer's Data.co Control deployment, only if the customer enables it |
| Public court records in Marketplace datasets | Names and other details of individuals that appear in published court opinions and case metadata | Public court records compiled by Marketplace data providers (see section 15) |
Why we process personal data, and on what legal basis.
If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, the GDPR, UK GDPR or Swiss Federal Act on Data Protection requires a legal basis for each purpose. Where we rely on legitimate interests, we have weighed those interests against your rights, and you may object at any time (section 11).
| Purpose | Data used | Legal basis (EEA / UK / Switzerland) |
|---|---|---|
| Responding to inquiries, demo and assessment requests, and provider applications | Inquiry and lead data, form context data, correspondence | Steps taken at your request before entering into a contract; otherwise our legitimate interest in responding to business inquiries |
| Managing business relationships in our CRM, including follow-up on inquiries | Inquiry and lead data, form context data, correspondence | Legitimate interest in managing sales and partner relationships |
| Creating and operating accounts, organizations and API keys | Account data, session and security data | Performance of a contract |
| Providing the API, MCP server and Marketplace, including metering usage against plan limits | API and MCP usage data, account data | Performance of a contract |
| Billing, invoicing, collections and tax records | Billing data, account data, usage data | Performance of a contract; compliance with legal obligations (tax and accounting) |
| Securing the Services: authentication, rate limiting, spam and abuse prevention, fraud detection, incident investigation | Session and security data, usage data, website log data, form context data | Legitimate interest in protecting the Services, our users and data providers; compliance with legal obligations where security is legally required |
| Providing support | Support data, account data, correspondence | Performance of a contract; legitimate interest in helping non-customers who contact us |
| Sending service communications (security alerts, billing notices, policy changes) | Account data, billing data | Performance of a contract; legitimate interest in keeping customers informed |
| Sending product updates and marketing emails | Name, email address, company | Consent where the law requires it; otherwise legitimate interest in direct marketing to business contacts. You can opt out at any time. |
| Operating, maintaining and improving the website and Services | Website log data, aggregated usage data | Legitimate interest in running and improving our Services |
| Licensing and supporting Data.co Control deployments that opt in to telemetry | Opt-in deployment telemetry | Performance of a contract |
| Distributing Marketplace datasets that contain public court records | Public court records | Legitimate interest in providing access to public legal information, and the public interest in open courts |
| Complying with law, responding to lawful requests, and establishing or defending legal claims | Any category, as needed | Compliance with legal obligations; legitimate interest in protecting our rights |
| Corporate transactions such as a merger, financing or sale of assets | Any category, as needed | Legitimate interest in carrying out the transaction, subject to confidentiality |
Hosting, form handling, automation and AI.
Hosting. The data.co website, Marketplace and app.data.co run on servers we operate at Hetzner Online GmbH data centers in Germany, Finland and the United States. Traffic passes through Cloudflare for DNS, content delivery and DDoS protection. Our CRM and our blog content management system (Payload CMS) are self-hosted on infrastructure we operate; they are not run by third parties.
Form submissions. When you submit a form on data.co, our server validates it, applies spam checks (a hidden honeypot field, a minimum fill time, and a per-IP rate limit), and then does two things: it emails the submission to a small group of Data.co staff through Twilio SendGrid, and it records the submission in our self-hosted CRM so we can respond and keep track of the conversation. Your IP address is used for rate limiting and abuse prevention and is not added to your CRM record.
Graphic embeds. Websites can embed Data.co graphics. The embed is served from data.co inside an iframe on the third-party site. It sets no cookies and does not track you across sites. When your browser loads an embed, our servers and CDN receive standard request data (IP address, user agent, the embedding page as referrer) as website log data.
Automated processing. We use automated tools for spam filtering, rate limiting, usage metering and security monitoring. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. If an automated control blocks a request or a form submission, you can contact us and a person will review it.
AI and model training. We do not use customer content, API or MCP inputs, or the content of your messages to train AI models. Data.co Control runs models inside the customer's own infrastructure. If we introduce phone or chat support that uses an AI assistant, we will describe that processing in this policy before it begins.
No sale or sharing for advertising. We do not sell personal data, and we do not share personal data for cross-context behavioral advertising or targeted advertising.
Strictly necessary cookies only.
The data.co website does not use analytics cookies, advertising cookies, tracking pixels or third-party social media trackers. Fonts and images on data.co are served from our own servers.
app.data.co uses strictly necessary cookies to keep you signed in, protect against cross-site request forgery, and remember security settings for your session. These cookies are required for the service to work and are set only when you sign in. Under EU and UK ePrivacy rules they do not require consent.
Cloudflare may set strictly necessary security cookies to distinguish legitimate visitors from automated attacks.
Graphic embeds displayed on other websites set no cookies.
If we decide to use analytics or any other non-essential cookies or similar technologies, we will update this policy first and, where the law requires, ask for your consent through a cookie banner or similar control before setting them. You will be able to withdraw that consent at any time.
You can block or delete cookies in your browser settings. If you block strictly necessary cookies, you will not be able to sign in to app.data.co.
Who receives personal data.
We share personal data only as described here. Our current subprocessors are listed on the subprocessors page.
| Recipient | What they receive | Why |
|---|---|---|
| Data.co personnel | Only the data needed for their role | To respond to you, provide support, operate and secure the Services. Access is limited and logged. |
| Hetzner Online GmbH (hosting) | All categories stored on our servers | Infrastructure hosting in Germany, Finland and the United States |
| Twilio SendGrid (email) | Form submissions, names, email addresses and message content | Delivering form notifications to our staff and sending transactional email |
| Cloudflare (DNS, CDN, DDoS protection) | IP addresses and request metadata | Delivering and protecting the website and Services |
| Stripe (payments, when paid plans launch) | Billing contact and payment data | Processing payments. Stripe handles card data directly; we do not receive full card numbers. |
| Your organization | Your account activity and audit events within that organization | Organization owners and administrators can see members, roles and audit events in app.data.co |
| Marketplace data providers | Only what is needed to handle a licensing question, rights claim, or a privacy request you ask us to forward | Providers license datasets to you directly. We do not share your usage data with providers for their marketing. |
| Professional advisers | As needed | Lawyers, accountants and auditors bound by confidentiality |
| Authorities and courts | As required | When required by law, subpoena or court order, or to protect rights, safety and security. We review requests and push back on those that are overbroad. |
| Acquirers or successors | As needed | In a merger, financing, acquisition or sale of assets, subject to this policy |
How we protect data that crosses borders.
Data.co operates internationally. Personal data may be stored in the EEA (Germany and Finland) and in the United States, and processed by subprocessors in the United States or on Cloudflare's global network.
When we transfer personal data from the EEA to a country that the European Commission has not found to provide adequate protection, we use the European Commission's Standard Contractual Clauses (SCCs), or rely on the recipient's certification under the EU-U.S. Data Privacy Framework where it applies.
For transfers from the United Kingdom we use the UK International Data Transfer Addendum to the SCCs (or the UK International Data Transfer Agreement), or the UK Extension to the Data Privacy Framework where it applies. For transfers from Switzerland we use the SCCs with the amendments required by Swiss law, or the Swiss-U.S. Data Privacy Framework where it applies.
Where required, we assess the laws of the destination country and apply supplementary measures such as encryption in transit and at rest. You may request a copy of the relevant safeguards through our contact page; we may redact commercial terms.
How long we keep personal data.
We keep personal data only as long as needed for the purpose it was collected for, then delete it or de-identify it so it can no longer be linked to you. These periods are our retention schedule. We may keep data longer where a law requires it, to resolve a dispute, or under a legal hold, and only for as long as that need lasts.
| Category | Retention period | Notes |
|---|---|---|
| Account data | Life of the account, plus 30 days after closure | The 30 days allow recovery from accidental closure. After that, account data is deleted. |
| Backups | Roll off within 35 days | Deleted data disappears from backups as they expire. Backups are encrypted and not used for any other purpose. |
| Inquiry and lead data, correspondence (including CRM records) | 3 years after our last interaction with you | Deleted sooner on request, except a suppression entry if you opted out (section 9) |
| API and MCP request logs | 13 months | Allows year-over-year metering, billing reconciliation and abuse investigation |
| Security logs, website and server logs, Data.co audit logs | 1 year | Longer only if needed for an active security investigation |
| Customer organization audit logs in app.data.co | Per the customer's retention setting | Controlled by the organization as controller under our Data Processing Addendum |
| Billing records (invoices, payment records, tax records) | 7 years | Required for tax and accounting purposes |
| Support tickets | 3 years after the ticket is closed | Used to resolve recurring issues and for quality review |
| Marketing suppression list | As long as needed to honor your opt-out | Contains only your email address and the date and scope of the opt-out |
How to have your personal data deleted.
You can ask us to delete personal data we hold about you at any time, wherever you live. This section explains how deletion works in practice, what we delete, what we must keep, and how long it takes.
- 1
Make the request
Use the contact form at data.co/contact, choose the topic "Security" or "Other", and say that you are making a deletion request. Include the email address the data is associated with and, if relevant, the name of your organization. Once account self-service is available in app.data.co, you can also send a request from the email address associated with your account, or delete your account yourself from your account settings.
- 2
We verify your identity
To protect you from someone else deleting or obtaining your data, we confirm the request comes from you. Usually we email the address the data is associated with and ask you to confirm. For account data, we may ask you to confirm from within app.data.co. We ask only for information we need to verify you and use it only for verification.
- 3
We acknowledge within 7 days
We confirm receipt and tell you what we will delete and anything we must keep, with the reason.
- 4
We delete within 30 days
We complete the deletion within 30 days of receiving a verified request. Where the law allows an extension (for example, for complex or numerous requests), we will tell you within the first 30 days, explain why, and complete the request within the extended period the law permits.
- 5
We pass the request on
We delete the data from our production systems, our self-hosted CRM and our email systems, and instruct subprocessors that hold a copy to delete it, in line with their own deletion processes.
- 6
We confirm completion
We send you a confirmation when deletion is complete, listing anything retained and why.
What is deleted, what is kept, and why.
What we delete. On a verified request we delete your inquiry and lead records, correspondence, CRM entries, support tickets, and, if you have an account, your profile, credentials, sessions, API keys and personal settings. API keys are revoked immediately so they cannot be used again.
Account self-service. Once self-service account deletion is available in app.data.co, you can delete your own account from your account settings. Organization owners can remove members from their organization and delete the organization and its data. When an organization is deleted, its data is deleted within 30 days and expires from backups within a further 35 days. If you are a member of an organization, the organization (not you) controls its records about your activity there, such as audit events; we will direct your request to the organization and assist it.
What we may keep, and why. We may keep limited personal data where we have a legal reason to: billing and tax records for 7 years; records needed to establish, exercise or defend legal claims or that are subject to a legal hold; security records needed to prevent fraud, abuse or repeated violations of our Acceptable Use Policy; and a suppression entry so we do not contact you again. We keep only what is necessary, restrict access to it, and delete it when the reason ends.
Backups. Deleted data is not restored to live systems. It remains in encrypted backups only until those backups expire, within 35 days, and is not accessed in the meantime except to restore systems after an incident, in which case we re-apply your deletion.
De-identified and aggregated data. We may keep aggregated or de-identified data, such as total request counts per dataset, that cannot reasonably be linked to you. We do not attempt to re-identify it.
Removal from marketing and the CRM. You can ask to be removed from our CRM and all mailing lists. We delete your record and add your email address to a suppression list, which is the only way to make sure a future list import or form submission does not re-add you to marketing. The suppression list holds only your email address and the date and scope of the opt-out, and we never use it for any other purpose.
Public court records. Personal data that appears in public court records distributed through the Marketplace is handled under section 15.
Your GDPR and UK GDPR rights.
If the GDPR, UK GDPR or Swiss data protection law applies to our processing of your personal data, you have the following rights. Some rights apply only in certain circumstances, and we will explain if an exception applies to your request.
| Right | What it means | How to exercise it |
|---|---|---|
| Access | Confirmation of whether we process your personal data, a copy of it, and information about how we use it, who receives it, how long we keep it and where it came from | Contact form; account holders can also view their profile in app.data.co |
| Rectification | Correction of inaccurate data and completion of incomplete data | Edit your profile in app.data.co, or use the contact form |
| Erasure | Deletion of your personal data where, for example, it is no longer needed, you withdraw consent, or you successfully object | See section 9 |
| Restriction | Limiting our use of your data while a dispute about accuracy or an objection is resolved, or where you need it kept for a legal claim | Contact form |
| Data portability | Receiving data you provided to us in a structured, commonly used, machine-readable format (we use JSON or CSV), or having it sent to another controller where technically feasible | Contact form |
| Objection | Objecting to processing based on legitimate interests, on grounds relating to your situation. We will stop unless we have compelling legitimate grounds or need the data for legal claims. | Contact form |
| Objection to direct marketing | Stopping marketing at any time. This right is absolute: we will stop. | Unsubscribe link in any marketing email, or the contact form |
| Withdraw consent | Where we rely on consent, withdrawing it at any time. Withdrawal does not affect processing that took place before. | Unsubscribe link or contact form |
| Automated decisions | Not being subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions. | Contact form, if you believe an automated control affected you |
| Complaint | Lodging a complaint with a data protection supervisory authority, in particular in the EEA member state where you live or work or where the alleged infringement took place. In the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. | Directly with the authority. We would appreciate the chance to address your concern first. |
California and other US state privacy rights.
Residents of California and of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas and Oregon, have rights over their personal data. Which rights apply depends on your state and on whether the law applies to Data.co. We honor the requests described below for residents of any US state.
| Right | What it means |
|---|---|
| Right to know / access | Request the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties we disclose it to. Sections 2, 3 and 6 describe these for the preceding 12 months. |
| Right to delete | Request deletion of personal information we collected from you, subject to the exceptions the law allows (see section 9). |
| Right to correct | Request correction of inaccurate personal information. |
| Right to portability | Receive your personal information in a portable, readily usable format. |
| Right to opt out of sale, sharing and targeted advertising | We do not sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising, and have not done so in the preceding 12 months. Because of this, we do not offer an opt-out link. We would honor a Global Privacy Control signal as a valid opt-out if we ever did. |
| Right to opt out of profiling | We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. |
| Right to limit use of sensitive personal information | We do not collect sensitive personal information except account credentials (passwords and passkeys), which we use only to authenticate you and protect your account. We do not use sensitive personal information to infer characteristics about you. |
| Right to non-discrimination | We will not deny you service, charge you a different price, or provide a different level of service because you exercised a privacy right. |
| Authorized agents | You may use an authorized agent to make a request. We will ask the agent for written permission signed by you, and may ask you to verify your identity directly, unless the agent holds a valid power of attorney. |
| Appeals | If we decline your request, you may appeal (section 12). If you are a resident of Virginia, Colorado, Connecticut, Texas, Oregon or another state that provides for appeals and you disagree with the outcome of your appeal, you may contact your state attorney general. |
How to make a request, step by step.
The same process applies to every right in sections 10 and 11, including deletion. Making a request is free. We may charge a reasonable fee or decline a request only where the law allows, for example for manifestly unfounded or excessive requests, and we will explain why.
- 1
1. Submit your request
Use the contact form at data.co/contact, choose the topic "Security" or "Other", and describe the right you want to exercise. Account holders may also write from the email address associated with their app.data.co account once available. Tell us which email address, account or organization the request relates to.
- 2
2. Verification
We verify your identity by confirming control of the email address associated with your data, or by sign-in to app.data.co for account data. For requests involving more sensitive information, we may ask for additional information that matches what we already hold. If we cannot verify you, we will tell you why and what else we need.
- 3
3. Acknowledgment
We acknowledge your request within 7 days and tell you if we need anything else.
- 4
4. Response
We respond within 30 days for requests under the GDPR, UK GDPR and Swiss law (one month), extendable by up to two further months for complex or numerous requests, and within 45 days for US state law requests, extendable once by up to 45 further days where reasonably necessary. In every case we aim for 30 days and tell you about any extension, with reasons, before the original deadline.
- 5
5. Appeal
If we decline your request in whole or in part, we will explain why. You can appeal by replying to our decision or through the contact form with the subject "Privacy appeal". A person not involved in the original decision will review it, and we will respond in writing within 45 days (60 days in Colorado), explaining the outcome and the reasons.
How we protect personal data, and what we do if something goes wrong.
We use administrative, technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, hashed passwords and hashed API keys, support for two-factor authentication and passkeys, tenant isolation between customer organizations, least-privilege access for staff with multi-factor authentication, logging and monitoring of administrative actions, vulnerability management, and encrypted backups with tested restores. Our Data Processing Addendum (Annex II) and security page describe these measures in more detail.
No system is perfectly secure. You help protect your account by using a strong, unique password, enabling two-factor authentication or a passkey, and keeping API keys secret.
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as the GDPR and UK GDPR require. If the breach is likely to result in a high risk to you, or if a US state breach notification law requires it, we will notify you directly without undue delay, explaining what happened, the data involved, what we are doing, and what you can do. For data we process as a processor, we notify the affected customer as described in our Data Processing Addendum.
Marketing choices and other matters.
Marketing communications. We send product updates and marketing emails only to business contacts who have consented where the law requires consent, or who have an existing relationship with us where the law permits it. Every marketing email includes an unsubscribe link. You can also opt out through the contact form. We process opt-outs promptly and in any event within 10 business days, and add your address to our suppression list. Service communications, such as security alerts, billing notices and changes to our terms, are part of the service and are sent even if you opt out of marketing.
Children. The Services are designed for businesses and professionals. They are not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
Third-party links and sites. The Services link to third-party websites, including dataset providers' sites and source repositories. Their privacy practices are their own, and we encourage you to read their policies. If you view a Data.co graphic on another website, that website's own privacy policy governs everything on the page outside the embed.
Personal data that appears in court records.
Some Marketplace datasets, starting with legal datasets from LAW.co, an affiliated provider, contain public court records such as published court opinions and case metadata. These records may include the names of individuals who appear in court opinions (for example parties, witnesses, attorneys and judges) and other details published by courts.
This information is published by courts as part of the public record, and the provider compiles it under its own license. Data.co distributes it through the Marketplace. Where the GDPR or a similar law applies, we and the provider process this information on the basis of legitimate interests in providing access to public legal information, which serves the public interest in open courts, legal research and accountability.
Requesting review or suppression. If you appear in a court record in a Marketplace dataset and want it reviewed, corrected, or removed or suppressed, contact us through data.co/contact (topic "Other") and identify the dataset and record, for example by case name, citation or URL. We will acknowledge your request within 7 days and forward it to the dataset's provider, which maintains the underlying records. Where the law gives you a right to erasure, restriction or objection, or where a court has sealed or expunged the record, we will suppress the record from distribution through Data.co and ask the provider to correct or remove it at source. Where the law does not require removal, we will explain why, and you may appeal as described in section 12.
We cannot remove a record from the court's own files or from copies held by third parties. Court sealing and expungement are handled by the court that issued the record.
Licensees that download or store Marketplace datasets are responsible for their own compliance with privacy law when they use personal data contained in them, as described in our Dataset Licensing terms.
Updates to this policy, and how to reach us.
We update this policy when our practices change. We post the updated version on this page with a new "last updated" date. If a change materially affects how we use personal data we already hold, we will notify account holders by email or in app.data.co at least 30 days before it takes effect, and ask for consent where the law requires it.
Contact. Send any question, complaint or request about this policy or your personal data through the contact form at data.co/contact, choosing the topic "Security" or "Other". Once available, account holders can also write to us from the email address associated with their app.data.co account. We route privacy matters to the person responsible for privacy at Data.co.
Last updated: November 6, 2026.
Questions about these terms?
Contact us and we will route your question to the right person.