1. Who we are and what this policy covers
UncoveredList is operated by UncoveredList (“we,” “us”). This Privacy Policy explains how we collect, use, share and protect personal information in two contexts:
- Customers and visitors: people who visit our website, create an account, subscribe or contact us.
- Business records in our product: the public business-registration and permit information we compile from state sources.
2. Information we collect from customers and visitors
| Category | Examples | Source |
|---|---|---|
| Account & profile | Name, email, password (hashed by our auth provider), agency name | You |
| Preferences | States, territories, industries, minimum score, delivery emails | You |
| Billing | Plan, billing status, Stripe customer ID, card brand and last four digits (full card numbers are held by Stripe, not us) | You, via Stripe |
| Product activity | Leads you mark as contacted, quoted, won or do-not-contact; notes; exports; lookups used | Your use of the Service |
| Communications | Contact-form messages, support emails, email delivery events (delivered, bounced) | You; our email provider |
| Technical | IP address, browser type, device, pages requested, timestamps, security logs | Automatically, via our hosting provider |
Cookies. We use only essential cookies needed to keep you signed in and to secure the Service. We do not use advertising cookies or sell or share personal information for cross-context behavioral advertising. If we add analytics in the future, we will update this policy and, where required, ask for consent.
3. Business records in our product
Our product compiles information that state agencies publish in official open-data portals about newly registered businesses and sales-tax permits (see Data sources). We designed the product to be business-level: business name, entity type, filing or permit date, business location, state-reported industry code, and, where a state publishes one (currently Connecticut), a business email address. We add our own industry classification, score and suggested coverage lines.
What we deliberately leave out: officer, organizer, member, manager, filer and owner names; individual registered-agent names; and taxpayer names. We do not collect these into our product, even where a state publishes them. In Texas we exclude sole proprietors whose trade name is simply their own name.
Some business records may still relate to an identifiable person, for example a sole proprietorship whose business name includes a personal name, a home-based business address, or a business email. If you believe a record relates to you personally, you can ask us to correct or suppress it (see Section 8). We will review the request, suppress the record from future deliveries where appropriate, and instruct subscribers to delete it.
4. How we use information
- Provide, operate and secure the Service, including authentication, daily digests, the dashboard and exports;
- Process payments, trials, renewals and cancellations;
- Send transactional messages (receipts, trial reminders, digests, security and service notices);
- Respond to support requests, data corrections and privacy requests;
- Improve data quality, classification and scoring (using business-level records, not customer personal information);
- Send occasional product updates to customers, which you can opt out of at any time;
- Comply with law, enforce our terms and protect our rights and users.
5. How we share information
We do not sell customers' personal information. We share information only as follows:
- Service providers that process data on our behalf under contract: Vercel (hosting), Supabase (authentication and database), Stripe (payments), Resend (email delivery), Google Workspace (business email), AI model providers (we send only business-level records such as business name, entity type, city and industry code, never customer account data) and Google Maps Platform (website/phone lookups requested by Pro and Agency users).
- Subscribers receive business records as described in Section 3. That is the purpose of the Service.
- Your team: on Agency plans, the account owner and invited members share the contacted tracker.
- Legal and safety: to comply with law, legal process or lawful government requests, or to protect rights, safety and the integrity of the Service.
- Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this policy.
6. Retention
We keep account and billing records while your account is active and for up to 7 years afterward as needed for tax, accounting and legal purposes. Contact-form messages are kept for up to 2 years. Business records that no subscriber is tracking are generally deleted from our lead database after about 120 days. Suppression requests are retained so we can continue honoring them.
7. Security
We use industry-standard safeguards, including encryption in transit (HTTPS), hashed passwords managed by our authentication provider, row-level access controls in our database and least-privilege access to production systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as required by law.
8. Your choices and privacy rights
Depending on where you live (for example California, Colorado, Connecticut, Texas, Virginia and other U.S. states with comprehensive privacy laws), you may have rights to: know or access the personal information we hold about you; correct it; delete it; obtain a portable copy; and opt out of the sale of personal information, targeted advertising and certain profiling. We extend these rights to all U.S. users regardless of state.
- How to make a request: email or use our contact form (choose “Privacy / suppression request”). We will verify your request using information associated with your account or the record in question and respond within 45 days, or as otherwise required by law.
- Authorized agents: you may use an authorized agent, and we may ask for proof of authorization and verify your identity.
- Appeals: if we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line. We will respond within the time required by law and tell you how to contact your state attorney general if you are not satisfied.
- Global Privacy Control: we treat GPC browser signals as a request to opt out of sale/sharing for that browser. We do not sell or share personal information for targeted advertising in any case.
- Non-discrimination: we will not discriminate against you for exercising your rights.
- Email: every digest and marketing email includes a link to manage preferences or unsubscribe. Transactional and account messages may still be sent while you have an account.
9. Children
The Service is intended for business users and is not directed to children under 18. We do not knowingly collect personal information from children.
10. Where we process data
We are based in the United States and the Service is intended for U.S. businesses. Information is processed and stored in the United States by us and our service providers.
11. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new effective date and, if changes are material, notify customers by email or in the Service before they take effect.