Privacy Policy

Last Updated: July 10, 2026

1. WHO WE ARE

Goldilocks AI, Inc., a Delaware corporation (1111B S Governors Ave #42159, Dover, DE 19904, USA), is the data controller for the personal information described in this policy ("Goldilocks," "we," "us"). Our UK representative under Article 27 UK GDPR is Goldilocks AI Ltd, 124 City Road, London EC1V 2NX, United Kingdom. Our team operates from London; our service database is hosted in the United Kingdom and our application infrastructure runs in the United States, with transfers protected as described in Section 8.

Contact for all privacy matters: chris@goldi.ai.

This policy covers our people-search service (the "Service") and our websites. It does not cover our processing of employee or contractor data.

2. WHAT THE SERVICE IS AND WHERE PROFILE INFORMATION COMES FROM

Goldilocks provides a people-intelligence platform that helps business customers find and research professionals. We maintain profiles of professionals ("Profiles") built from three kinds of sources:

• Licensed data providers: reputable commercial providers who license professional and business data to us.
• Publicly available sources we research: our systems read public web pages such as news articles, company pages, customer testimonials, review sites, and other public professional content, and extract professional facts (for example a person's name, role, employer, or country) to match and enrich Profiles and to assess a person's authority on professional topics.
• Verification partners: services that verify whether business contact details are valid and deliverable.

We also generate derived data: AI-generated Profile summaries, assessments of a person's authority on a topic, research notes compiled from public sources, and verification results.

3. INFORMATION IN PROFILES

Profiles may include: name; current and past employers, job titles, and employment history; education history; skills; patents, publications, and awards; business contact details (business email addresses and phone numbers); links to public social and professional profiles; location (country and city); and the derived data described above. We do not intentionally collect special-category data (such as health, religion, or political opinions); our extraction systems are designed to discard such content if encountered, and we do not knowingly hold Profiles of children.

4. INFORMATION WE COLLECT FROM USERS OF OUR SERVICE AND WEBSITES

• Account Information: name, email, and contact details; authentication is handled by our authentication provider, which holds password credentials — we store only session tokens, never passwords.
• Submitted Data: content you provide when using the Service, such as search prompts, queries, and uploads, which may contain personal information.
• Billing Information: payment details processed by our payment processor.
• Communications: information you send us.
• Usage information: device and interaction data, including IP address, browser type, and pages viewed, collected via cookies and similar technologies (Section 13). IP addresses and similar identifiers are personal data and we treat them as such.

5. PURPOSES AND LAWFUL BASES

6. PROFILING AND AI

We use automated systems, including AI models, to organize, match, and summarize Profile information and to assess a person's relevance and authority on professional topics based on public information. These outputs are estimates that assist our customers' human research and decision-making. We do not make automated decisions about individuals that produce legal or similarly significant effects, and our customer terms prohibit our customers from using our data for solely automated significant decisions or for eligibility decisions (such as credit, insurance, housing, or employment eligibility).

7. HOW WE SHARE INFORMATION

• Our customers: the core Service provides Profiles to business customers for permitted professional purposes (expert research, B2B sales and marketing, recruitment sourcing, investment research, business intelligence, fraud prevention). Customers are independent controllers of what they receive and are contractually bound to privacy, outreach, and use restrictions, including honoring opt-outs.
• Service providers: vendors who process data on our behalf, including cloud infrastructure and database providers, AI model and AI tooling providers (currently Google and Anthropic), payment processing, and contact-verification services.
• Legal: where required by law or legal process, or to protect rights, safety, and security.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell Account Information or Submitted Data. Licensing Profile data to customers may constitute a "sale" under some US state laws; we do not "share" personal information for cross-context behavioral advertising. See Section 11.

8. INTERNATIONAL TRANSFERS

Our service database is hosted in the United Kingdom (Supabase); our application infrastructure runs on Google Cloud in the United States, and some service providers process data in the United States. Where personal information is transferred internationally, we use appropriate safeguards: the EU-US Data Privacy Framework and its UK Extension for certified providers, and the EU Standard Contractual Clauses with the UK Addendum, incorporated into our Data Processing Addendum (goldi.ai/dpa) and vendor agreements. Details are available on request.

9. RETENTION

We keep Profile data only while it remains relevant: Profiles are periodically re-verified, and any Profile not verified or refreshed within 36 months is deleted or anonymized. You may request removal at any time (Section 10); removed individuals are added to a suppression list so their data is not re-collected, and we retain that minimal suppression record indefinitely to keep the removal effective. Account data is kept for the life of the account plus any period required by law; when you delete your account, your prompts and query history are de-identified. Billing records are kept as required by tax law. Website analytics data is retained per Section 13.

10. YOUR RIGHTS (UK/EEA AND ELSEWHERE)

Depending on your location, you have rights to access, correct, delete, restrict, or object to our processing of your personal information, and to data portability. In particular:

• See or remove your Profile: request access, correction, or removal at goldi.ai/privacy-requests or by emailing chris@goldi.ai. We verify removal requests by confirming control of the associated email address; we do not ask for identity documents for Profile removal.
• Object: you may object to processing based on legitimate interests, including to direct marketing (absolute right).
• Sources: on request we will tell you the categories of sources for your data (licensed data providers; publicly available sources; verification partners).
• Complaints: you may complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority. We would appreciate the chance to address your concerns first at chris@goldi.ai.

We respond within one month (extendable as permitted by law).

11. US STATE PRIVACY RIGHTS

If you are a resident of California or another US state with a comprehensive privacy law:

• Categories: in the preceding 12 months we have collected and disclosed the categories of personal information described in Sections 3 and 4, from the sources in Section 2, for the purposes in Section 5, to the recipients in Section 7.
• "Sale"/"sharing": licensing Profile data to customers may be a "sale" under the CCPA; we do not "share" personal information for cross-context behavioral advertising. You may opt out at goldi.ai/privacy-requests or by emailing chris@goldi.ai. We do not knowingly sell the personal information of minors.
• Rights: you may request to know, access, correct, or delete your personal information, and you will not be discriminated against for exercising rights. Authorized agents may submit requests with proof of authorization.
• Sensitive personal information: we do not use or disclose sensitive personal information for purposes requiring a right to limit.

12. SECURITY

We implement appropriate technical and organizational measures, including encrypted transmission and storage, access controls, least-privilege administration, tiered product access to contact data, and daily backups. No system is perfectly secure; we cannot guarantee absolute security.

13. COOKIES AND ANALYTICS

Our websites use cookies and similar technologies. Essential cookies support login, session management, and security. Analytics and performance cookies (for example PostHog and Vercel Analytics) help us understand usage: pages viewed, interactions, device and browser information, performance metrics, and traffic sources. Analytics involves technical identifiers such as IP addresses, which are personal data; data is aggregated where possible. Non-essential cookies run only with your consent via our consent banner (CookieYes); you can change or withdraw consent any time via the cookie settings link in the footer, and you can also control cookies in your browser. Analytics data is typically retained for 24 months and performance/error data for 12 months.

14. CHILDREN

The Service and our websites are not directed to anyone under 18, and we do not knowingly process children's data. Contact us if you believe we hold any.

15. CHANGES TO THIS POLICY

We may update this policy and will post the new version with an updated date, notifying you of significant changes by email or on the website.

16. CONTACT

Goldilocks AI, Inc., 1111B S Governors Ave #42159, Dover, DE 19904, USA
UK representative: Goldilocks AI Ltd, 124 City Road, London EC1V 2NX, United Kingdom
chris@goldi.ai