Privacy policy
Last updated: 2026-10-23. Covers the API, the MCP server, data files and this site.
In short
- Our datasets are about organisations, not people. No names, emails or phone numbers of private persons are collected, stored, sold or returned by the API or the MCP server.
- Your account is a work email and a company domain. We keep usage counts to run quotas and billing, and nothing we do not need for that.
- No cookies, analytics or ad trackers on this site. No marketing email without your separate consent.
- The controller is the company named in our legal notice. Privacy questions and requests: hello@arcadiumdata.io.
Personal data in our datasets: none, by design
Arcadium Data publishes facts about businesses and public bodies: job advertisements and the counts derived from them, public procurement notices, store and product facts, ratings and review counts. How each dataset is collected is on its sources and method page.
- Contact fields (recruiter, buyer contact, reviewer) are not read from the source, or are dropped before anything is stored.
- Free text (job titles, tender titles) goes through a filter that removes emails and phone numbers, at collection and again on the way out.
- A business whose name reads like a private person's name (for example a sole trader trading under their own name, or a store named after its owner) is left out and counted as withheld.
- Review data is limited to ratings, counts and trends; reviewer names are never stored or returned.
If you find a record that is about you, write to hello@arcadiumdata.io with the URL or the record. We remove it from the files, the API, the MCP tools and the data pages within 24 hours and keep it out of later exports.
What we keep when you use the API, the MCP server or Competitor Watch
| What | Why (legal basis) | How long |
|---|---|---|
| Account: the work email and company domain you sign up with, the version of the terms you accepted and when | To run the account you asked for: sign-in links, keys, billing and service notices (contract, GDPR Art. 6(1)(b)) | While the account is open; deleted within 30 days of closing it |
| API keys: a SHA-256 hash of each key and its first 12 characters (for support), plan, expiry, revocation | To check a key on every call. We cannot read your key back; it is shown once, when it is made | While the key exists; revoked keys are deleted with the account |
| Usage: per key, per day and per API route, the number of calls, rows returned and errors | Plan quotas and billing (contract, Art. 6(1)(b)) | While the account is open; deleted with the account (invoiced totals stay on the invoice) |
| What you ask us to track: watchlist company domains, Competitor Watch domains and the digest weekday | To deliver the watchlist changes and the weekly digest you set up (Art. 6(1)(b)) | Until you delete the list or the account |
| Billing: Stripe customer and subscription ids, plan, billing interval and subscription status | Contract and tax law (Art. 6(1)(b) and (c)). Card details go to Stripe directly and never reach us | Invoices: as long as accounting law requires (10 years in Bulgaria) |
| MCP server call log: time, tool name, channel tag (for example "registry"), status, duration and charged USD | To see which tools and listings are used and to fix errors (legitimate interest, Art. 6(1)(f)) | 13 months. It holds no IP address, no token or key, and no tool inputs or answers |
| Your IP address, in memory only, for rate limits (API without a key, MCP server, sign-up form) | To protect the service from abuse (legitimate interest, Art. 6(1)(f)) | Up to one day; never written to disk |
| Emails you send us | To answer you (Art. 6(1)(b) or (f)) | 12 months after our last contact, unless you become a customer |
The MCP server can be used without any account. If you send an Apify token for the live tools, it is used for that request only and never stored or logged; the rate-limit counter is keyed by a short one-way hash of it. Live tool runs happen on your own Apify account under Apify's privacy policy.
Who processes it for us
- Payments, subscriptions and invoices: Stripe.
- Email (sign-in links, billing notices, digests): Google Workspace.
- Hosting of the API, the MCP server and the database: the provider listed in our legal notice. This site is static and served by a content delivery network.
- Live MCP tools only: Apify, on your own Apify account.
Some processors may handle data outside the EU under the European Commission's standard contractual clauses or an adequacy decision. We do not sell or rent account data, and we do not use it to train models.
Your rights
You can ask for access to your data, correction, deletion, restriction or objection, and a copy to take with you. Closing your account deletes it within 30 days, except invoices we must keep. You can complain to the Commission for Personal Data Protection (cpdp.bg) or the data protection authority where you live.
The service is for businesses and is not directed at children. We will post changes to this policy here with a new date; material changes to account data use are also emailed to account holders.