Privacy Policy

Rostely is a search tool over public records and source-published professional information, used by teams in the United States and Europe. It is not a bulk contact or audience resale product. This policy is written to meet the EU/UK General Data Protection Regulation (GDPR / UK GDPR) and US state privacy laws such as the CCPA/CPRA.

1. Who is responsible

Controller: CHEN Guan Huai, 67-3 Beihuan Road, Nan En Street, Yangjiang City, Guangdong, China. Privacy contact: privacy@rostely.com.

2. Catalog data we publish

Federal contract records (award identifiers, agency and office, NAICS/PSC, incumbent business name and UEI, dollar values, period of performance, set-aside, competition fields and subaward rollups) come from USAspending.gov prime award and subaward data. Opportunity titles, agencies, solicitation fields, jurisdiction, posted dates, and public point-of-contact names, emails, and phone numbers are copied from official SAM.gov or state/local procurement records when those fields are published. Award history comes from USAspending.gov. Journalism, podcast, and newsletter signals come from explicitly configured public RSS/Atom feeds. Journalist professional emails come only from explicitly configured public profile, masthead, contact, or author pages and retain source type, publication, and observed times; raw values are a Pro-gated workflow field rather than an anonymous export. Public capital signals come from SEC Form D filing data and keep the official filing URL. Angel Match records use public GP/angel profiles, Form ADV/IAPD history, public pension disclosures, and other explicitly verified sources; published professional contacts retain their source and evidence type. Each stored signal keeps its source URL. State/local sources remain subject to their own publication and retention rules. We do not scrape LinkedIn, personal Gmail, mobile-only directories, podcast/newsletter owner email fields, or private LP records.

3. Lawful basis

People listed in the catalog (public officials, journalists, investors): we process names, roles, organisations, and source-published professional contact details on the basis of our and our users' legitimate interests (GDPR Art. 6(1)(f)) in finding the right professional counterpart for procurement, press, and fundraising work. We limit this to information the person or their organisation already published in a professional capacity, keep the source URL, do not infer private data, and do not guess email addresses. You can ask us for more information about how we balanced these interests against yours. Where we collect data that was not obtained from you, this section and section 2 serve as the notice required by GDPR Art. 14.

Account holders: we process your email and session data to provide the service you request (Art. 6(1)(b)) and anti-abuse signals to keep the service secure (Art. 6(1)(f)). Optional analytics run only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

4. What we do not do

We do not sell the whole catalog as a CSV. We do not offer autodialers, SMS blasts, audience or investor exports, or email-guessing. Phone numbers are stored as they appear on the notice and are not a marketing channel we operate. We do not sell personal information.

5. Account and security data

If Magic Link is enabled, we store your email address, hashed session and sign-in tokens, the IP address that requested a sign-in link, and the browser user-agent of each session. To limit abuse we also keep short-lived request counters keyed by a pseudonymised identifier: your IP address (for IPv6, its /64 network prefix) passed through a keyed hash (HMAC-SHA-256) whose key is held only by the service. This is pseudonymised, not anonymous, data. Sign-in forms are checked by Cloudflare Turnstile; we use its pass/fail answer for that request and do not store it. Browser storage may remember UI preferences. Optional analytics run only after cookie consent. If you use alerts or the pipeline we store your saved search filters, alert frequency, which contracts each alert has already emailed, pipeline stages and notes, and your monthly export count. If you subscribe, our merchant of record processes your payment details; we receive only your subscription status, customer and subscription identifiers, plan, and renewal date, never card numbers.

6. Processors and international transfers

• Cloudflare, Inc.: hosting (Workers), database (D1), request rate limiting, and bot protection (Turnstile).
• Resend: delivery of sign-in and alert emails.
• Paddle.com Market Ltd: merchant of record for subscriptions (checkout, payment, tax and invoices) under its privacy notice.

These providers may process data in the United States. Where personal data is transferred from the EEA or UK, we rely on a recognised transfer mechanism, such as the EU-US Data Privacy Framework for certified providers or Standard Contractual Clauses in the provider's data processing terms. Contact us for details of the safeguard used for a specific provider.

7. Retention

Catalog rows stay as long as the underlying public record is useful for search, and are refreshed or archived when ingest runs. Sign-in links expire after 15 minutes and, together with the requesting IP address, are deleted by a daily cleanup job within about two days. Sessions expire after 30 days; expired or signed-out session records, including the user-agent, are deleted within about two days after that. Expired or revoked share links are deleted on the same schedule. Rate-limit counters are deleted once their window (at most one hour) has closed, normally within a day. Your account email and saved results are kept until you ask us to delete your account, which you can do at any time.

8. Your rights, including if you are listed in the catalog

Anyone, whether an account holder or a person who appears in the catalog (for example a journalist, investor, or official), can ask us for access to,correction or erasure of their data, restrictionof processing, or object to processing based on legitimate interests, including suppressing a published professional email from Rostely. Emailprivacy@rostely.com with the profile URL or the name and organisation shown. We may ask for reasonable proof that the request comes from you, and we answer within one month (GDPR) or 45 days (CCPA). Objections from listed people are honoured unless we have compelling legitimate grounds, for example a public official's role on an official government notice, which we keep but do not enrich.

You can also refuse non-essential cookies, sign out, or use thecontact page. If you are in the EEA or UK you have the right to lodge a complaint with your local data protection authority.