Data Retention Policy

This policy explains what HeyAlbert keeps, for how long and why, and how deletion works. It applies together with our Privacy Policy and Terms of Service. HeyAlbert covers the United States only.

1. Public-source profile data about individuals

What: facts about adults compiled from public sources, such as SEC filings, nonprofit filings, company and university pages and reputable news, each linked to its source. We never show children, street addresses or personal contact details.

Why: to provide the service described in our Terms of Service.

How long: a fact stays in a profile while its public source supports it. Profiles are refreshed on a schedule: SEC filings and news weekly, political contribution records and nonprofit filings monthly, and property values quarterly as new records are loaded. A fact that its source no longer supports is corrected or removed. The change log keeps the history of each record for as long as the profile exists, so edits can be reviewed and reverted.

Corrections and removal: anyone can ask what we hold about them, ask for a correction or ask for removal through our review and removal form or by email. We may ask you to confirm your identity first. Once a removal request is verified, we take the information out of the subscriber-facing profile within 10 business days, and in any case within the time applicable law requires, and we reply to tell you what was done.

Suppression list: so that removed information is not added back by a later refresh, we keep a minimal suppression record (your name, city and what was removed) for as long as we operate the service. It is used only to keep that information out of HeyAlbert.

2. Customer account data

What: what you give us when you contact us, start a trial or subscribe, such as your name, work email, organization and use case, plus billing records and support correspondence. Payments are processed by Stripe; we never store your credit card information.

How long: for as long as your account is active and as needed for legal, tax and accounting purposes. After an account closes, we delete account profile data within 90 days. Invoices and billing records are kept for 7 years for tax and accounting purposes. Support correspondence is kept for 2 years after the account closes.

3. Usage and access logs

What: records of activity in the HeyAlbert web app and through authorized HeyAlbert connectors and API keys: who signed in or used a key, when, which searches, dossiers, tools and exports were used, and the filters applied. Every editorial change is also logged with who made it, when, what changed and the source.

Why: security, support, enforcing plan limits and fair-use caps, and detecting misuse, as described under Monitoring and audit in our terms.

How long: 24 months from the activity, then deleted. Editorial change-log entries follow the profile they belong to (see section 1). Standard server logs kept by our hosting provider for this website, such as IP address, browser type and pages requested, are kept for up to 30 days.

4. API and connector keys

Each personal API key or connector sign-in belongs to one named user. We store keys only in hashed form, not the key itself. A key can be revoked at any time by you or by us, and a revoked key stops working at once. The hashed record of a revoked or expired key is kept with the access logs for 24 months, so past activity can still be audited, and then deleted.

5. Exports and CRM transfers

Exports and CRM transfers count toward your plan's limits (on the annual plan, 100 records a month and 1,200 a year, with CRM exports to Salesforce or Zoho limited to 1,200 records a year). Once data leaves HeyAlbert in an export or CRM transfer, keeping it secure and deleting it is your responsibility, under our Fair use and acceptable use terms and data licensing. When your subscription ends, you must promptly delete data obtained from the service. We keep a log of each export, with the user and filters used, as described in section 3.

6. Backups

We keep backups to recover from errors and outages. Backups roll over automatically, and each backup is overwritten or deleted within 35 days. Information deleted from our live systems may remain in a backup until it rolls off. Backups are used only for recovery, and if one is ever restored, removals and the suppression list are applied again before the data is used.

7. Deletion on request and account closure

Customers can ask us to delete their account data at any time by emailing us. We delete it within 30 days of a verified request, except records we must keep for legal, tax or accounting purposes, logs we keep for security and misuse detection for the periods above, and anything under a legal hold. When an account closes, the periods in sections 2 to 4 apply. For people who appear in HeyAlbert, removal works as described in section 1.

8. Legal holds

If we are required to keep information because of a legal obligation, litigation, a government request or an investigation, we suspend the deletion of the affected information until the hold ends, and then apply the periods in this policy.

9. Contact and requests

For questions about this policy, or to make a request, email albert@heyalbert.site with the subject "Data request", or use our review and removal form. Our Privacy Policy explains how we handle personal information more generally. We may update this policy and will post changes on this page.