Form5500Lookup, a product of Harper AI, Inc., respects your privacy. This policy explains what we collect about you, the visitor or subscriber — separate from the public business records we publish, which are covered by our Data & Sourcing policy.
What we collect
- Account & billing — your email when you sign in or subscribe; payment is handled by Stripe (we never see full card numbers).
- Usage & analytics — pages viewed, searches run, and standard device/log data, via PostHog. We use identified analytics only after you sign in; we do not record your screen or session.
- Communications — emails we send you (sign-in links, receipts, renewal alerts, and emails about employers you watch) and delivery events (delivered, bounced) via Resend.
How we use it
- To provide the service, authenticate you, and process your subscription.
- To send transactional email you asked for and, if you opt in, renewal alerts and emails about employers you watch.
- To measure and improve the product, and to secure it against abuse.
Who we share it with
We share personal information only with service providers that help us run Form5500Lookup, each acting on our behalf: Stripe (payments), Resend (email delivery), PostHog (analytics), Google Cloud (hosting and database), and Google Cloud Storage (the files we build for Data Feed licensees and the links used to download them). We do not sell your account data to third parties for their own marketing.
Analytics, cold outreach & the CCPA “sale/share”
Two activities may count as a “sale” or “sharing” of personal information under the CCPA/CPRA even though no money changes hands for your data:
- Using analytics/advertising cookies that pass identifiers to third parties.
- Our business-to-business outreach: we contact benefits producers using business contact information compiled from public records and licensing data. If you are a producer and don’t want to be contacted, you can opt out at any time.
You can exercise your right to opt out on our Do Not Sell or Share My Personal Information page. We also honor the Global Privacy Control (GPC) browser signal automatically. On every visit where your browser sends GPC, we disable third-party analytics capture. When a request that carries the signal also identifies you by email — requesting a sign-in link, or subscribing while signed in — we record a durable opt-out that permanently excludes that address from the outreach described above.
Retention
We keep personal information only as long as we need it.
- Your account, saved searches and watched employers are kept while your account is open. We delete them within 30 days of a verified deletion request.
- Billing records are held by our payment processor, Stripe, under Stripe’s own retention policies. Card details never reach us.
- Orders and your credit ledger. An order for a credit pack, and the record of credits granted and spent, are kept while your account is open and for as long as we need them to answer a billing question or a chargeback. They are the receipt for what you bought, so they outlive a deletion request only where the law requires us to keep a financial record.
- Match runs. A list you match — the rows you supplied and the records we returned — is kept for 12 months so you can download it again, then deleted automatically. You can delete a run yourself at any time.
- Data Feed deliveries. The record of which file was delivered to which licensee, and when a download link was issued and used, is kept for as long as the licence is active and for 12 months after, as the evidence of delivery. The files themselves are removed from storage after 70 days.
- Sign-in links expire after 24 hours. A signed-in session stays active for up to 90 days without use.
- Connected apps. Access for an assistant you connect expires after one hour and renews automatically, for up to 90 days without use. We store these credentials only in scrambled (hashed) form, and delete the records of disconnected or expired connections 30 days later.
- Security records used to prevent abuse, which include IP addresses, are deleted after one day. Server logs are kept for 30 days.
- Product analytics are kept for 30 days.
- Email preferences. If you unsubscribe or opt out, we keep that choice so we can keep honoring it.
Your rights
Depending on where you live (including under the CCPA/CPRA and similar state laws), you can request to know, access, correct, or delete the personal information we hold about you, and to opt out of sale/sharing — without discrimination for exercising these rights. To make a request, email [email protected] or use the Do Not Sell or Share page. We may need to verify your identity before acting.
Contact
Privacy questions or requests: [email protected].