Privacy

The point of this product is to compare a list you have — a conference attendee export, a prospect list, a stack of photographed cards — against the companies and contacts in your own HubSpot portal. That means the personal data of people who have no relationship with us: your contacts, and attendees who have never heard of The Palioca Group.

On that data you are the controller and we are your processor. We hold it because you asked us to do something specific with it, we use it for nothing else, and we delete it on the schedule below without being asked. Concretely, and these are commitments rather than intentions:

• We do not sell it, rent it, or share it with anyone except the processors listed below, each of which is doing one job for us.
• We do not use it to train models. Card Capture sends photographs to Anthropic’s vision API under commercial terms that exclude training on API inputs.
• We do not retain it beyond the windows in the retention table — the two caches expire by themselves, and match results are deleted at 90 days.
• We do not combine one customer’s data with another’s. Every record in this product is keyed to the account and the HubSpot portal it came from.
• We do not build our own dataset out of it. Nothing about an organisation or a person learned from your list is carried into anyone else’s run.

You need the right to give us the list in the first place — that is your side of it, and it is in the terms.

To decide whether “Valley Health Ctr” on your list is the “Valley Health Center, Inc.” in your CRM, the matching engine sometimes checks public registries. What it sends is worth being precise about:

• An organisation name, and sometimes a US state, to the CMS NPI Registry, the ProPublica Nonprofit Explorer, Wikidata, and — where configured — HRSA’s health center API.
• A request to the organisation’s own website, to see whether a domain resolves and where it redirects. That tells the site a visit happened; it sends it nothing.

No individual’s name, email address or phone number is sent to any of them. Enrichment works on organisations only. The sole third party that ever receives personal data from this product is Anthropic, and only the contents of a photograph you uploaded to Card Capture.

Your email address and name

To create and identify your account, and to contact you about it.

Held by Clerk, our authentication provider. This application stores only Clerk’s opaque user id, never your password.

Your subscription status

To know which record tier your account includes and whether it is active.

Card details are entered on Stripe’s own pages and never reach this application. We store a Stripe customer id, a subscription id, a status, the tier, and an expiry date for a beta grant.

Your HubSpot connection

To read the companies and contacts a run matches against, and to write only the changes you have confirmed.

An OAuth access and refresh token in our database, with your portal id and name. It is yours. Disconnecting deletes it.

A record of each run you start

So you can reopen results after closing the tab, re-download a CSV, or re-trigger an import later.

Our database. This record contains the matched rows themselves, so it contains real personal data — see the retention table below.

The review decisions you make

So a row you have already judged stays judged when you come back to it.

Our database, keyed to your portal and the run.

A log of every export and import

Which account, which run, whether it was a download or a HubSpot import, and when — so a file that turns up where it should not can be traced.

Our database. The log holds no row content, only counts and timestamps.

Card Capture usage, if you use it

To enforce and display your card allowance, and to know what a run cost us.

Our database: photo and card counts, which model ran, token counts and a dollar figure. No lead content and no photograph.

Messages you send us

The feedback button on every tool page.

Our database, with your email and the page you were on.

Error reports when something breaks

So a failure that affects real people gets found and fixed.

Sentry. The only identifier sent is your Clerk user id — never your email or name — and cookies, headers, query strings and request bodies are stripped before the report leaves. See the note below on why that scrubbing is hand-written.

When you connect HubSpot we receive an access token and a refresh token for your portal. The refresh token is long-lived and exchanges for new access tokens, which makes it a working key to your CRM. We hold exactly one per connection, we use it only for the reads a run needs and the writes you have confirmed, and disconnecting deletes it immediately — that is a row deleted, not a flag flipped.

This is also why our error reporting is more careful than the default. In September 2026 a real production error report was found carrying a full browser cookie header, including session credentials. We discovered that the error-reporting library’s own filter stripped the short-lived session token and forwarded the long-lived refresh one, so we wrote the scrubbing ourselves rather than trusting the setting: cookies, headers, query strings and request bodies are all removed before a report leaves this application. We mention it because the fix is the kind of thing you would otherwise have to take on faith.

A list you upload, while a background job runs

Deleted automatically 2 hours after the job starts. It is a cache with a hard expiry, not a store.

Your HubSpot companies and contacts, cached to avoid re-pulling your whole portal

Deleted automatically after 4 hours. You can also refresh it manually at any time.

Match results, including the matched rows

Deleted after 90 days. You can delete any individual run yourself, sooner.

Card Capture photographs

Never written down at all. They are held in memory for the length of the request that reads them and discarded when it ends.

Your account, subscription and HubSpot connection

As long as the account lasts. Disconnecting HubSpot deletes the tokens immediately; deleting the account removes the rest.

Export and import log entries, feedback, and Card Capture cost records

Kept — they are counts, timestamps and messages rather than contact data. Feedback is deleted on request.

These are our processors. Each does one job, and none of them receives your data for their own purposes.

Clerk.

Authentication and account identity

Stripe.

Payments, on its own hosted pages

Neon.

The Postgres database this application reads and writes

Upstash.

Short-lived Redis caches — see the retention table

Inngest.

Running long jobs in the background

Anthropic.

Reading the photographs in Card Capture, if you use it

Vercel.

Hosting and delivery

Sentry.

Error reporting

HubSpot.

Your own CRM, which you connect and can disconnect

Before adding a processor we establish what it would hold, obtain its current compliance evidence, and update this list. If a new one would touch the contact data you upload, you will see it here before it does.

We do not sell your data or anyone’s, share it with advertisers, or use it to train models. We do not build a profile of you across other sites, because we have no presence on other sites. We do not email you marketing you did not ask for — there is no marketing email system in this product at all.

You may be in this product because a customer of ours compared a list against their CRM. We did not collect your details and we hold them only on that customer’s behalf, so the honest answer is that they control them and we cannot speak for what they do with their own CRM.

Write to ethan@paliocagroup.com anyway. We will tell you whether anything of yours is still inside our systems, delete whatever is ours to delete, and put you in touch with the customer who holds the rest. We will do that whether or not a law requires it of us.

Ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it — by writing to ethan@paliocagroup.com. There is no form and no process to navigate; a plain email reaches a person. We will delete what is ours and tell you what Stripe must retain for its own tax and accounting obligations.

Account deletion is a request to us today rather than a button in the product. That is a gap we would rather state than paper over, and it is on the list to fix. Disconnecting HubSpot, which deletes the tokens, you can already do yourself from the account menu.

Depending on where you live you may have specific statutory rights — under the California Consumer Privacy Act, the GDPR, or another regime. We will honour a request under any of them whether or not the law technically applies to us.

A right you cannot exercise is not a right. If this page, or the request process, or anything we send back is difficult for you to read or use, say so and we will provide it in a format that works. See accessibility in the terms for what we do and do not test.

If either document changes materially — a new obligation, a narrower permission, a different processor, or a change to how we limit liability — we will email account holders at least 14 days before it takes effect, and the effective date above will move. Cosmetic edits and clarifications do not move that date. Ask us for the text that was in force on any given day and we will send it.

October 16, 2026.

First published. Describes what is held about the account holder, what happens to the contact and attendee data they upload, the retention windows actually implemented in code, every processor including the vision model used by Card Capture, and the organization-only data sent to public registries during enrichment.

See also the terms of use.