Beta version

Ownerhound privacy policy

Last updated: [date]

Ownerhound ("we", "us") is run by Cole Stepanik (until Ownerhound LLC, a Massachusetts limited liability company, is formed). Our mailing address is [postal address]. You can reach us at hello@ownerhound.com.

This policy covers ownerhound.com (the website), the Ownerhound workspace (the app that teams use to research and contact businesses, whether to sell services or to approach owners about buying), and the Ownerhound waitlist and survey. It says what we collect, why, who sees it, how long we keep it, and what choices you have.

The short version

• We collect what we need to run the service and no more.
• Teams that use Ownerhound upload their own lists of businesses. That data belongs to the team. We never mix one team's lists, notes, or contacts into another team's.
• We never sell personal information and we never use it for advertising.
• We do not collect Social Security numbers, driver's license numbers, dates of birth, financial account numbers, or health information, and the workspace tells teams not to enter them.

1. Who this applies to

1. Visitors who browse ownerhound.com.
2. Survey takers and waitlist sign-ups.
3. Account holders: people who sign in to the workspace, whether as a team Admin or a Caller.
4. People listed in a team's data: business owners, managers, and employees whose business contact details a team has uploaded or that Ownerhound found in public records for that team. You may never have heard of us, so section 7 explains how this works and how to opt out.

2. What we collect

From visitors. Basic technical data: your IP address, browser type, pages viewed, and the date and time, in server logs kept for security and to fix errors. We use analytics only if they are cookieless [confirm before launch]. We use only the cookies or similar browser storage needed to keep you signed in and to remember basic settings. We do not use advertising cookies, tracking pixels, or session replay.

From survey takers. Your answers to the survey questions. The survey is anonymous unless you tick "Contact me about early access," and only then do we ask for your email address. Please do not put confidential information about companies, deals, or investors in your answers.

From waitlist sign-ups. Your email address and, if you give them, your name, firm, and role.

From account holders.

• Your name, email address, and profile photo from Google when you sign in with Google, or your email address if you use an emailed sign-in link. We never see your Google password.
• Your team, your role (Admin or Caller), and the invitations you send or accept.
• What you do in the workspace: calls and follow-ups you log, notes, tags, templates, goals, and settings, and a record of who changed what (an audit log).
• If you connect a Google Sheet or Gmail, the data from the sheet you pick, or the email draft you create. See "Google user data" below.
• Billing details when fees begin. A payment processor [name] handles card numbers. We never store full card numbers.

Business contact data that teams upload or that we look up for them. Company names, addresses, office phone numbers, the owner's name, and where available the owner's phone and email, plus call outcomes and notes the team writes, the scripts and templates the team uses, and records of consent and opt-outs (who, when, which number, and how). If a team uploads its own National Do Not Call Registry file, we use it only to mark matching numbers on that team's list, and we delete the file after matching. We also check public records for each team's list: state business and license databases (for example Texas, Colorado, and Tennessee open data and licensing sites), and the business's own website. We store the extracted facts, the source link, and the date checked. We do not save copies of web pages, and we do not collect data from people-search sites, social networks, or anything behind a login.

What we never collect on purpose. Social Security numbers, driver's license or ID numbers, dates of birth, financial account numbers, health information, court or credit records, or personal social media. If a source returns one of these, we drop it when we read the record.

3. Why we use it

• To run the workspace: sign you in, keep each team's data separate, show your queue and call cards, and keep an audit log.
• To check public records and company websites for a team's list, and to show the team how sure we are of each match. A wrong match is worse than a blank, so we leave a field empty when we are not sure.
• To help teams follow calling and texting rules, such as marking numbers on a Do Not Call list, blocking calls outside allowed hours, and keeping a do-not-contact list.
• To protect the service: prevent abuse, find and fix bugs, back up data, and meet legal duties.
• To contact you about your account, security, billing, and changes to the service, and about early access if you asked.
• To improve Ownerhound using anonymous or combined statistics, such as how many teams use a feature. We do not train AI models on a team's lists, notes, or owner contacts. [Confirm with the engine design before launch.]

4. Who sees your data

• Your team. Admins see everything their team stores. Callers see the team's shared data and their own private items.
• Other teams: never. Each team's data is kept apart by the database, not only by the app. The only thing shared across teams is a cache of public government records (for example a state license status), which has no team's notes or contacts in it. [Attorney: see note A below.]
• Our service providers (subprocessors), who process data only for us and under contract: hosting (Vercel), database and sign-in (Supabase, United States, US West region), and Google for sign-in. There is no analytics, payment, email delivery, or error monitoring service yet. We will update this list before adding a new one.
• AI services. If a feature sends text to an AI service, it will be one that does not train on it under our contract [provider]. We do not paste team data into public or free chatbots.
• Legal and safety. We may disclose data if the law requires it or to protect people's safety or our rights. We will tell the affected team first where the law allows.
• A sale of Ownerhound. If we merge or sell the business, data goes with it under this policy, and we will tell you first.
• We do not sell personal information and we do not share it for cross-context behavioral advertising.

5. How long we keep it

• Survey answers: up to 24 months, then deleted or reduced to counts. Waitlist emails: until you ask us to delete them, or 12 months without contact.
• Account data: while your account is open, and for 30 days after it closes.
• A team's data: while the team's account is open. After the team closes its account or we end it, the team has 30 days to export, and we then delete the data. Backups are overwritten within [35] days.
• Owner cell numbers and emails for companies a team marks dead, not selling, or bounced: deleted after 24 months.
• Do Not Call Registry files a team uploads: deleted after matching (we keep only a one-way scrambled form of matched numbers to keep them blocked).
• Records of consent, opt-outs, and call logs: 5 years, so teams can prove compliance, then deleted.
• Do Not Contact records: kept, with only the company name, phone number, and the flag, so the business is never called again.
• Public-record cache: purged after 30 days. Facts older than 12 months are re-checked before a team uses them.
• Server logs: [90] days.

6. Security

Data is encrypted in transit (HTTPS) and at rest. Access to each team's rows is restricted by team in the database, administrators sign in with [multi-factor authentication], we back up the database on a schedule [confirm the real schedule and that a restore has been tested before launch], and we keep an audit log. Secrets are stored in the host's protected settings, not in code. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires, and we will tell the affected team's Admin promptly.

7. If you are listed in a team's data

A team added you or your business, or we found your business's public details for the team. The team decides why and how it contacts you, and we process the data for the team. Ownerhound's own rules for teams ask them to call and email only in line with the law, to give their real name and firm, to include an opt-out, and to stop contacting anyone who says stop.

To ask a team to stop contacting you, just tell the caller or reply "no thanks". To ask us to delete your details, see what we hold, or correct a record, email hello@ownerhound.com with your name, business, and the phone number or email involved. We will remove or correct your details from the teams' data within 30 days [and add the phone number or email to a suppression list so no team can load it again, if the attorney approves, note B]. We will keep only what we need to honor your request.

8. Your choices and rights

• Account holders and visitors: you can ask to see, correct, export, or delete your personal information by emailing hello@ownerhound.com. You can close your account in Settings.
• Survey and waitlist: tell us which answers or which email are yours, and we will delete them.
• Emails from us: each marketing message has an unsubscribe link. We will still send account and security messages.
• US state privacy laws. Some states (for example California, Colorado, Connecticut, Texas, Virginia, and others) give residents rights to know, access, correct, delete, and opt out of the sale or sharing of personal information, and to appeal a refusal. Many of these laws do not apply to business contact information used in a business setting, or to companies of our size. [Attorney: confirm which apply at launch, note C.] We will honor these requests from any US resident anyway. To make one, email hello@ownerhound.com. We may need to confirm it is you. If we refuse, you may appeal by replying to our answer, and you may contact your state attorney general.
• Do Not Track and Global Privacy Control: we do not track visitors across sites, so there is nothing to opt out of; we treat a GPC signal as an opt-out request anyway.

9. Google user data

If you connect a Google account, Ownerhound's use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including its Limited Use requirements. We use Google data only to provide the features you turn on (for example, writing a Research tab to your own sheet or creating an email draft you review and send), we do not use it for advertising, and we do not let people read it except as you direct, for security, or as the law requires. You can disconnect at any time at myaccount.google.com/permissions. We ask only for the access each feature needs.

10. Where data is stored

Our providers store data in the United States (Supabase, US West region). Ownerhound is meant for use in the United States.

11. Children

Ownerhound is for adults. You must be 18 or older to create or use an account, and we ask you to confirm this when you sign up or accept an invitation. We do not knowingly collect information from anyone under 18, and we never knowingly collect it from a child under 13. If we learn that someone under 18 has an account, we will close it and delete their personal information. If you think a young person gave us information, email us and we will delete it.

12. Changes

When we change this policy we will update the date above. If a change is significant, we will email account holders or show a notice in the workspace before it takes effect.

13. Contact

Cole Stepanik, [postal address], hello@ownerhound.com.

Version beta-0c2375ea53.