Where your exports go, and who can touch them

• When we receive themOnly after the rights check, and only for the tools and date ranges you chose. We never connect to or write to your systems.
• Where they’re keptIn a restricted folder in our Google Workspace account (Google Drive), with 2-step verification on the account. Google encrypts stored files and connections in transit.
• Who can access themThe founder only. No one else, and no automated service, has access to raw exports.
• How long we keep themRaw exports are deleted within 30 days of you approving the de-identified dataset, or immediately if you ask. The de-identified dataset is kept while it is listed and deleted when you unlist it.
• What leaves our handsOnly the de-identified dataset, and only to a lab you have approved, under a written license. Raw exports are never delivered to anyone.

• HostingNetlify. Pages are static files served over HTTPS.
• Forms and the APIEstimate and data requests are stored by Netlify Forms and emailed to our Google Workspace inbox. The API files requests into the same place.
• TrackingWe use Plausible Analytics to count visits. It sets no cookies and collects no personal information; we see page counts and referrers in aggregate. No advertising cookies. Our hosting provider keeps standard server logs. The staff-only admin area sets a session cookie when a staff member signs in.

• NetlifyWebsite hosting, form submissions, the estimate API.
• Google WorkspaceEmail and the Drive folder where exports are kept during preparation.
• Plausible AnalyticsCookie-free visit counts for this website.

We hold no security certifications or third-party audits yet. If you need a questionnaire filled in for a vendor review, email micki@sellmydata.com and we’ll answer it.

Email micki@sellmydata.com to unlist and delete your data; we confirm by email when it’s done. If we ever learn that your exports were accessed by someone who shouldn’t have had them, we will tell you by email as soon as we know, with what we know.