Privacy Policy

This Privacy Policy describes how ClueSignal ("we", "us") collects, uses, shares, and protects information when you use our Service.

1. Information We Collect

• Account email address
• Lookup inputs you submit (phone numbers, email addresses, images, VINs)
• Payment processor and customer IDs (we do not store full card numbers)
• IP address
• Device, browser, and operating system data
• Marketing/attribution parameters (UTM, fbclid, gclid)
• Report results and lookup history

2. How We Use It

• To create, deliver, and store your reports
• To save your report history (120 days)
• To process payments and manage subscriptions
• To send account, transactional, and report emails
• To detect, prevent, and respond to abuse, fraud, or misuse
• To improve, secure, and develop the Service

3. Service Providers

We share data with vetted providers as needed to operate the Service:

• Supabase — database, authentication, file storage
• Stripe — payments and subscription billing
• Twilio — phone number metadata and carrier lookups
• AbstractAPI — phone/email validation
• People Data Labs — public profile enrichment
• Trestle — public records data
• LeakCheck (or equivalent breach data provider) — public breach exposure
• Google Vision — image analysis
• Apify — public web data collection
• Email provider (Resend, SendGrid, or Postmark) — transactional email delivery

4. Data Storage Locations

Your data is stored and processed in Canada and/or the United States. By using the Service, you consent to cross-border transfer where applicable.

5. Data Retention

Reports are retained for 120 days, after which they may be deleted. We may retain data longer if required by law, for fraud prevention, or to enforce our Terms. You may request deletion where allowed — see Opt-Out.

6. Your Rights

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion (subject to legal limits)
• Opt out of certain processing
• Unsubscribe from marketing emails at any time

Submit requests via the Opt-Out page.

Canada (PIPEDA)

If you are in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private-sector privacy laws (e.g., Quebec Law 25, BC PIPA, Alberta PIPA).

United States (CCPA/CPRA)

California residents have rights under the California Consumer Privacy Act / CPRA, including the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information. We do not sell personal information.

EU / UK (GDPR)

Where the GDPR or UK GDPR applies, you have rights of access, rectification, erasure, restriction, portability, and objection. Our legal bases include contract performance, legitimate interests, consent, and legal obligation.

7. Cookies & Tracking

We use cookies and similar technologies for authentication, session management, analytics, and marketing attribution. See our Cookie Policy.

8. Security

We use TLS encryption in transit, encrypted storage at rest, role-based access control, and regular security review. No system is 100% secure.

9. Children

The Service is not directed to anyone under 18, and we do not knowingly collect data from children.

10. Changes

We may update this Policy. Material changes will be communicated via email or in-product notice.

11. Contact

Privacy requests: privacy@cluesignal.com
General support: support@cluesignal.com