Privacy policy

Datap is operated by 21 Holdings Limited, registered in England and Wales (company number 10815109). Registered office: 167–169 Great Portland Street, London, England, W1W 5PF. Write to this address, marked “Datap — legal/privacy”, or use private support in Settings. You do not need an account to write to us.

This policy applies to visitors, account holders, buyers, sellers, people contacting us and people whose information may appear in hosted datasets. Identify the relevant account, dataset or order when contacting us, if known. Please do not send passwords, full card details or more personal data than needed to identify the issue.

Platform information: Datap is a controller for information it uses to operate accounts, manage transactions and support, secure the platform, comply with law and run its own communications. We decide the purposes of those activities and answer requests about them.

Dataset contents: where a seller decides the collection, purpose, permitted disclosures and retention, and Datap hosts and delivers only on its documented instructions, the seller is the controller and Datap acts as its processor. Where the seller is itself an authorised processor, Datap can act as a subprocessor under the seller’s authority. The seller must identify the relevant controller and have authority for the arrangement. Buyers normally become independent controllers for their own uses, or act for their own controller.

Roles depend on what each party actually does. Being the payment merchant does not itself decide GDPR status. Contract labels do not remove duties the law places on Datap, a seller or a buyer. Our seller data-processing agreement sets out the limits on seller-instructed processing.

Account and workspace information includes email address, authentication and verification records, organisation membership, roles, public alias/avatar, settings, API/OAuth authorisations and support messages. Sellers also provide business identity, address, country, payment-account references, listing details, licences and processing instructions.

Transaction information includes billing name/address and country, quotes and filters, approved amounts and limits, licence/instruction versions, invoices, subscriptions, delivered usage, ownership/access records, payment and refund references, disputes, and saved-card metadata such as brand, expiry and last four digits. Stripe collects full payment credentials through its payment interfaces; Datap does not store full card numbers or security codes.

Technical information can include IP address, request time, device/browser details, authentication events, security logs, job failures and API usage. Public submissions include listing text, seller-approved preview fields, requests and reviews. Avoid including confidential information in public submissions.

We receive information directly from you and your authorised agents; from workspace administrators inviting you; from sellers supplying listings and datasets; and from Stripe and infrastructure providers reporting payments, verification, delivery or security events. A seller dataset may originate from public websites or licensed/private sources. The seller’s listing and privacy information must explain its actual sources and categories. Datap does not claim one common source or legal basis for every dataset.

Providing the service: account access, quotes, delivery, billing administration, service notices and support are necessary to perform our agreement with an individual user. Where the customer is a business and you act as its representative, we rely on our legitimate interests in providing and administering that business relationship.

Security and reliability: detecting fraud or abuse, enforcing permissions, investigating incidents, troubleshooting and improving the service rely on legitimate interests in keeping the platform safe and functional. We consider the impact on individuals and use proportionate information. This does not authorise unrelated use of seller dataset contents.

Legal records: tax/accounting records, lawful regulatory requests and other mandatory records rely on legal obligations. Establishing or defending claims and maintaining necessary purchase evidence also serves our legitimate interests, subject to retention limits.

Public participation: publishing the listing, request, alias or review you choose to submit is part of providing that feature. Moderation relies on legitimate interests in maintaining accurate, safe public content. Required merchant disclosures support transparent transactions and applicable legal duties.

Optional communications: where consent is required for marketing or optional tracking, we will ask separately and allow withdrawal. Purchase approval and acceptance of terms are not marketing consent. We do not use seller dataset contents for our own marketing, cross-seller profiling or model training.

Required account, transaction and verification details are necessary for the relevant feature; without them we may be unable to provide it. Optional public content and optional communications can be declined. We do not treat browsing this policy as consent.

Authorised workspace members can see information allowed by their role. Sellers receive the buyer and transaction information needed for their contract, accounting, refunds and legal duties. Buyers receive necessary seller business disclosures. Public aliases do not hide the seller’s contracting identity from purchasers.

We use Cloudflare for website delivery, network security, private object storage and email; Supabase for authentication and application/database storage; and Fly.io for dataset processing and background jobs. They process the information necessary for those services. The dataset subprocessor list and functions are in the processing agreement.

Stripe receives payment, billing, seller-verification and transaction information. It can act as an independent controller for activities such as regulated payment services, verification and fraud prevention, and may act in other roles for particular services. See Stripe’s privacy policy. We do not send dataset row contents to Stripe to process payments.

We may disclose necessary information to professional advisers, regulators, courts and law enforcement where legally required or justified, and to a successor in a business transfer with appropriate protections and notice where required. We do not sell platform account information to advertisers. Dataset disclosures to licensed buyers are the separate seller-directed activity described above.

Our primary application database and dataset compute are configured in Frankfurt. Private object storage is configured with a Western Europe location preference. This is not a promise that all data stays in the EU: Cloudflare operates a global network, and payment, email, support and infrastructure providers may process data in other countries, including the United States.

Where a restricted international transfer occurs, it must have a valid basis under the applicable UK or EU rules, such as a relevant adequacy decision or approved contractual safeguards with any required supplementary measures. A hosting-region setting alone is not a transfer safeguard. Contact us for the safeguards and transfer information relevant to your data, including a copy of applicable safeguards where available with necessary redactions.

Account information is held while needed to provide the account and resolve closure requests. After closure we remove or anonymise information no longer needed, while keeping records necessary for legal obligations, disputes, security and purchased rights. Financial and tax records follow applicable statutory recordkeeping periods; we do not delete them merely because a dataset is withdrawn.

Security logs, support records and approval evidence are retained according to their operational purpose, the seriousness and duration of an incident, legal limitation periods and any preservation duty. Public submissions remain while the feature and submission are active unless removal is requested or justified. These criteria, rather than an arbitrary common expiry, determine retention for each category.

Dataset retention follows recorded seller instructions and lawful obligations. Withdrawal blocks relevant new access while deletion jobs and storage cleanup run. Backups may retain restricted residual copies until their normal replacement cycle; they must not be used to restore deleted data into active service. Copies already downloaded by independent buyers are governed by those buyers’ obligations and cannot be remotely erased by Datap.

We use storage needed to sign in, select a workspace, maintain guest verification and complete authorised requests. Browser local storage can remember the last portal used and resumable upload state; session storage can hold a temporary approval reference. Authentication and approval credentials are sensitive: keep them private and sign out on shared devices. Blocking required storage can prevent these features working.

This release does not include advertising pixels or a marketing-analytics tracker in the application. Infrastructure may process request and security telemetry. Optional non-essential tracking, if introduced, requires its own notice and consent where applicable.

Automated checks enforce permissions, spending limits, payment status and dataset instructions, and may hold a payment or delivery. You can contact support for a review of a restriction. We do not use hosted dataset contents to make decisions about the people described in them. Buyers remain responsible for any profiling or automated decisions they carry out.

Depending on the law and processing involved, you can request access, correction, deletion, restriction or portability of personal information, and object to processing based on legitimate interests. You can object to direct marketing at any time and withdraw consent without affecting earlier lawful processing. Rights have conditions and exceptions, including legal recordkeeping.

Contact us using the details above. We may ask for proportionate identity or authority evidence to avoid disclosing information to the wrong person. We respond within the applicable legal time limits, normally one month for UK/EU rights requests, and explain any lawful extension or refusal.

If your information appears in a seller’s dataset, you do not have to buy it or create an account to raise a concern. Provide the listing reference and enough information to locate the relevant records. Where we act as processor, we pass the request securely to the relevant seller/controller and assist its response. We also assess any duties applying directly to Datap, including whether access must be restricted. A seller alias is not a reason to leave a request unanswered.

You may complain to the UK Information Commissioner’s Office, or your competent supervisory authority, including in the EEA. You do not have to contact us first to exercise that right. We welcome the opportunity to resolve concerns.

We use access controls, private storage, encrypted network connections and scoped credentials to protect information. No service can guarantee absolute security. Report suspected incidents through the contact details above. Our service is intended for adults; sellers must not submit children’s personal data through ordinary upload access.

We date each policy version and communicate material changes through the service or account contact details as appropriate. A new policy cannot by itself authorise a new purpose for a seller’s dataset or remove your statutory rights.