Privacy · Itha

Company profiles are not personal data by design

Cards describe companies and what they sell. The format has no field for an individual: no named contacts, no job titles, no personal email addresses. The one contact channel a card carries is a role address the company published itself (sales@, a quote form, a switchboard number).

Where a published source names an individual, the generator is instructed not to carry it across. If one slips through, report it and it will be removed.

If you claim a profile

01Your email address, because it is the only identity the system has; there are no passwords.

02Which domains you hold, and which claim granted each one.

03Single-use sign-in tokens, stored as hashes and expiring in 30 minutes.

04Sessions, as an opaque id in an httpOnly cookie; signing out revokes the session server-side.

05Challenge tokens, stored as hashes only. The plaintext is shown once and never written down.

Request logs

Every profile view, JSON fetch and search query is logged. This is deliberate and it is a product: sellers get to see which buyer-agent questions their category attracts and whether they appeared in the answer.

01What is stored: the event type, the profile, the query, the user agent, the referer, and a classification of who asked (AI agent, AI crawler, search bot, browser).

02IP addresses are never stored. What is stored is an HMAC of the address salted with the current UTC date, which allows counting distinct visitors within a day and nothing across days.

03Search queries are stored verbatim, including the constraints. Do not put anything confidential in a search box.

Cookies

Two, both httpOnly and both functional: a session cookie for signed-in sellers, and a short-lived cookie that holds an open claim’s challenge token in the browser that started it. There is no advertising, no third-party analytics, and no tracking pixel anywhere in the app.

If we contacted you

We write to a small number of people at companies whose profiles we published, once, to tell them the profile exists and how to claim or remove it. If that was you, this section is the notice the law requires and it is live before the first message goes out.

01What we hold: your work email address, and where available your name and job title.

02Where it came from: a third-party business-contact service (Anymail Finder), not from you, and not from your company’s website.

03Why: to tell the company that a profile about it is published here, which is a legitimate interest in being able to correct or remove it. Nothing about you is published anywhere on this site.

04How long: until you unsubscribe or ask us to delete it, whichever comes first. Unsubscribing keeps your address on a suppression list — that is the only way to be sure we never write again.

05Who else sees it: nobody. It is not sold, shared, or used to build any profile of you.

Every message carries a one-click unsubscribe, and the link in it takes effect immediately. Unsubscribing stops the email; it does not remove your company’s profile, which is a separate request with its own path. To have your contact details deleted outright rather than suppressed, write to hello@itha.ai.

There is no tracking pixel in these messages and no open tracking of any kind. The links in them carry a single parameter so we can tell whether a message led to a company claiming its profile; that is the whole of it, and it is why we cannot tell whether anybody read one.

Retention

01Cards and registry records: for as long as the profile is published. Opting out tombstones the profile immediately.

02Event logs: retained to power seller analytics, for the period named below.

03Expired and superseded claims are kept as a record of who proved what and when.

Retention period for request logs: 12 MONTHS.

Requests

To remove a company profile, use the opt-out path. It is instant and needs no correspondence. For anything else, including a request about personal data, write to hello@itha.ai.