Privacy Policy

1. Scope, Operational Status & Data Principles

At Distrarc (“we”, “us”, or “our”), we take data privacy and security seriously. This Privacy Policy outlines our technical safeguards, data processing practices, and privacy commitments for founders and teams using our platform (“Customers”) and visitors to our website.

Under general international privacy principles:

• Data Controller / Data Fiduciary: Distrarc (operated by Suneer Mantri, Indore, Madhya Pradesh, India) acts as a data controller for the direct registration information, billing records, and authentication tokens of our registered founders and waitlist applicants.
• Data Processor: For customer product descriptions, search parameters, public contact evidence, drafted messages, and email outreach records, Distrarc operates as a technical data processor acting strictly upon your instructions. When you send outreach email, you are the controller of the personal data of the people you contact.

2. Information We Actually Collect

A. Account and Founder Information

When you create an account, accept an invitation, or configure your product, we collect:

• Identification & Credentials: Email address, optional display name, and securely hashed passwords (scrypt algorithm with unique cryptographic salts). We never store raw passwords.
• Session Identifiers: Randomly generated 32-byte cryptographic session tokens stored in secure, HttpOnly, SameSite cookies (distro_session).
• Onboarding & Run Tokens: Transient tokens stored in secure cookies (distrarc_onboarding_intent and distrarc_run) to securely link your website to single-use verification and preserve your in-progress free opportunity report.
• Waitlist Details: Email address, submission timestamp, marketing attribution (landing path, referrer, and UTM parameters), and optional public product URL. These details support owner review of beta fit; submitting them does not automatically qualify a request.

Website analytics (PostHog): We use PostHog to measure visits to our public pages. Without your consent it receives page views only (address without query strings, referrer, browser, device, approximate location from IP) and sets no cookie and stores no identifier. If you click Accept it also uses a cookie and local storage identifier, autocaptures clicks without element text, and records sessions with all form fields masked. We send no email address, name or form input value, and nothing from the signed-in product. Browsers that send Global Privacy Control or Do Not Track stay in the page-view-only mode, and withdrawing consent stops cookies and recording and deletes the PostHog cookies we can reach. Legal basis: your consent for cookies, autocapture and recording; our legitimate interest in basic page counts.

Website analytics (Google Analytics, only if enabled and with consent): If you click Accept in our cookie banner, we load Google Analytics 4 from Google LLC to measure visits to our website. It is off until you accept and we use Google Consent Mode with all storage denied by default. We send the page address without query strings (only the top-level section for workspace, sign-in, and invitation pages), page title, referrer, browser, device, and language, and Google derives approximate location from your IP address. Google Analytics 4 does not log or store IP addresses. We send no email address, name, or account identifier, and we keep advertising features and Google signals off. Google sets the _ga cookies for up to two years. Event-level data is retained in our Google Analytics property for the period configured there, never more than 14 months. Withdraw consent at any time in the cookie settings on our Cookie Policy page; we then stop Google Analytics and delete its cookies we can reach. Your choice is stored in the first-party distrarc_consent cookie for one year. Browsers that send Global Privacy Control or Do Not Track are treated as declined. Legal basis: your consent.

On our public landing page, first-party counters record page loads and CTA clicks with source tags (UTM parameters) and the referring origin. These counters use no analytics cookies, visitor identifier, full referring URL, email address, or stored IP address. We honor Do Not Track and Global Privacy Control. Page-load counts are not unique-visitor counts.

B. Customer Product and Opportunity Data

First-opportunity onboarding: We store your public website origin, verification email, consent timestamp, and a private opportunity report. Anonymous submission does not fetch your website or start research. Email verification creates access to this report only. Messages concern verification and your own report; no messages are sent to prospects. When transactional sending is explicitly enabled, Resend delivers verification and report notifications; we record provider acceptance separately from confirmed delivery, handle delivery failures, and suppress bounced or complained-about addresses. Verification codes expire after 15 minutes, website tokens after 30 minutes, and report sessions after 30 days. Expired verification records are removed by the retention task. You can remove your report from its page; this cancels its pending jobs and removes its product data without deleting any existing full-access account.

To identify relevant buyers and draft fitting replies, we process:

• Product URL & Public Web Snapshot: Public marketing copy, navigation headings, and pricing models extracted from your public website via our crawler.
• Audience & Problem Definitions: The problems your software solves, buyer personas, and qualification criteria you review and approve.

C. Lead Discovery and Public Contact Evidence

Distrarc searches strictly public online discussions to find people who are already asking for what your product provides. We collect:

• Public Forum Discussions: Public posts and comments from Hacker News, Reddit, GitHub, Stack Exchange sites, Bluesky, YouTube, and the open web. We strictly never link pseudonymous Reddit usernames to real identities, and Reddit leads never receive email outreach.
• Public Contact Finding: We only follow contact links that authors publish themselves:
  • Hacker News: the author's public profile “about” field (email or website).
  • GitHub: the user's public profile email and blog/website field (never commit emails).
  • Author-linked websites: public contact and team pages crawled strictly (up to 5 pages, respecting robots.txt, 1 request per second) for mailto links, schema.org email markup, visible staff contact addresses, and publicly listed staff names and professional job titles extracted solely to address communications to the relevant role.
  • Local businesses: OpenStreetMap contact tags and Wikidata official company entries.
• Candidate Address Generation & Verification Separation: For corporate domain contacts, candidate addresses may be generated based on publicly observed corporate naming conventions. Candidate generation is strictly separate from verification and sending: basic checks (DNS MX record validation, disposable domain exclusion, and global suppression checks) verify domain configuration only, not mailbox existence. Without a configured external mailbox verification provider, candidate verification status remains unknown. A candidate counts as verified only when the email verification service configured for the platform (MillionVerifier, ZeroBounce or Reoon, depending on configuration) returns a valid result. Where no verification service is configured, verification status remains unknown and all unverified candidate addresses remain blocked from sending. We perform no SMTP or port-25 handshake probing ourselves, and no unverified candidate address may ever enter the outreach sending queue.

D. Mailbox Provisioning and Outreach Governance

When you enable email outreach, we provide dedicated mailboxes to protect your primary domain reputation:

• Google Workspace via ResellerClub: Mailboxes are provisioned through ResellerClub on a secondary domain that you own (for example, a lookalike domain). We configure DNS records (TXT verification, MX, SPF, DKIM, and DMARC) to ensure full email authentication.
• Inbound Mail Reading for Replies and Opt-Outs: We connect to provisioned mailboxes using a Google service account with domain-wide delegation solely to poll inboxes (every 10 minutes) for incoming replies, bounce notices, and unsubscribe requests. We do not use mailbox data for any other purpose.
• Human Approval by Default: Every suggested reply and outreach email waits for your review and approval in your dashboard before it is sent. Distrarc does not send outreach email on its own unless a setting you have explicitly granted allows it.
• Unsubscribe & Global Suppression: Every outreach email includes a one-click unsubscribe link and the sender's postal address. An unsubscribe request, a hard bounce or a spam complaint immediately places the recipient address on a suppression list shared across Distrarc accounts. Suppressed addresses are not emailed again through Distrarc.

E. Infrastructure Security and Log Data

When you use the Platform or our APIs, we use your IP address for rate limiting, bot checks, and defense against brute-force and denial-of-service attacks. Rate-limit counters are keyed by an IP address or a hash of it and are reset when their time window ends. Our hosting provider's platform logs may also contain IP addresses and User-Agent headers, which are used to operate and secure the service.

3. How We Use Information

We process information strictly for the following purposes:

• Delivering Core Platform Services: Authenticating access, running scheduled searches, qualifying leads, and drafting contextual replies.
• Provisioning and Managing Mailboxes: Setting up Google Workspace inboxes on secondary domains and tracking delivery outcomes.
• Security & Abuse Prevention: Enforcing rate limits, preventing spam, detecting anomalies, and protecting customer credentials.
• Credit Governance: Measuring search and AI usage against your plan allowance so work pauses cleanly when credits are exhausted, without unexpected overage fees.
• Billing and tax records: Keeping the payment and invoice records that the law requires.

3A. Legal Bases (UK and EU GDPR)

Where UK GDPR or EU GDPR applies to our processing of your data, we rely on these bases:

• Contract: running your account, searches, drafts, approvals and billing.
• Legitimate interests: security, abuse prevention, rate limiting, and keeping suppression lists so that unsubscribed or bounced addresses are not contacted again. We weigh these interests against your rights.
• Consent: PostHog cookies and recording, and Google Analytics (only when you accept) and optional server-side telemetry (only when you turn it on).
• Legal obligation: keeping billing and tax records that the law requires us to keep.

Outreach to people outside your account is carried out on your instructions. You are responsible for the lawful basis for contacting them, as set out in our Terms of Service.

4. Third-Party Subprocessors

We use the service providers below to operate Distrarc. Each one receives only the data it needs for the service it provides. Optional providers are used only when they are configured or switched on:

5. Technical and Organizational Security Measures

Distrarc implements robust technical safeguards:

• Encryption in Transit: HTTPS (TLS) for all public web and API endpoints, with HTTP Strict Transport Security enabled.
• Encryption at Rest: AES-256-GCM authenticated encryption for application secrets and sealed envelopes for sensitive tokens.
• SSRF Defense: Strict socket-level connect filtering (guardedFetch) blocking all private IPv4/IPv6 ranges, cloud metadata services (169.254.169.254), and DNS rebinding attacks.
• Distributed Rate Limiting: Fixed-window distributed limits on authentication and crawler execution prevent credential stuffing and brute force attempts.
• Content Security Policy: Explicit-origin Content Security Policy with strict script and object isolation.

6. Data Retention and Erasure

We retain personal and operational data only for as long as necessary:

• Account Data: Retained for the duration of your active account. Successful self-service deletion erases credentials, sessions, and owned product data from the active application database in a single transaction. Keyed abuse counters, recipient suppressions, and the one-way hash that records a used free trial survive deletion so creating a new account cannot bypass safety controls or start a second trial.
• Billing and refunds: Cancel an active subscription before account deletion. We erase account-linked billing usage and checkout rows, but retain minimum payment-provider customer, subscription, and checkout references for accounting and refund reconciliation. These records contain no account password or report content. Payment-provider event identifiers are retained to prevent duplicate processing.
• Recipient safety and abuse controls: We retain keyed hashes of normalized recipient addresses for bounce, complaint, and unsubscribe suppression, including after account deletion. They cannot be used to send messages and are restricted to safety checks. Suppressions persist permanently until a reviewed correction or lawful removal; deletion alone does not opt an address back into delivery.
• Managed email and contact intelligence: Account deletion removes owned sender identities, domains, messages, leads, threads, and delivery-event context. Messages already accepted by an external mail provider cannot be recalled.
• Authentication Sessions: Expire automatically after 30 days and are deleted upon logout.
• Sign-up and free report data: Verification codes expire after 15 minutes and sign-up tokens after 30 minutes. Onboarding email records are deleted after 7 days. Expired sign-up records are removed by a scheduled cleanup task, which also removes unclaimed guest accounts once their session has expired. Free report sessions expire after 30 days.
• Security & Audit Logs: Account-associated application audit records retain action types and timestamps after identifying account references are cleared.
• External Platform Telemetry: The current exporter sends HMAC-pseudonymized identifiers and allowlisted event properties with GeoIP and person-profile processing disabled. Earlier versions could send raw internal user IDs and event properties when direct PostHog delivery was configured. We do not claim that all historical records were pseudonymized. The in-app deletion button does not automatically purge third-party historical records; data subjects can request deletion of external historical telemetry by contacting privacy@distrarc.com for processing through PostHog's deletion API using the relevant project and identifier, including legacy raw IDs and current HMAC pseudonyms.

7. Data Subject Rights & Self-Service Controls

We provide self-service technical tools to exercise your privacy rights:

• Right to Access & Portability: You can download a machine-readable JSON archive of your account, product, and lead data covered by our export tool via GET /api/user/export or in your account Settings.
• Right to Erasure / Deletion: You have the right to permanently erase your account and all associated product data. A self-service deletion mechanism with password re-authentication is provided in your account Settings.
• Right to Rectification: You can edit and update your name, product context, and search parameters directly in the platform.
• Withdrawing consent and objecting: You can withdraw analytics consent in the cookie settings and turn off telemetry in Settings at any time. To object to processing that relies on our legitimate interests, write to privacy@distrarc.com.
• If you were contacted by email: Use the unsubscribe link in the message. It stops further email from that sender and from every Distrarc account to your address. To ask what record Distrarc holds about you, write to privacy@distrarc.com. We may need to confirm who you are before we act.
• Complaints: You can complain to your local data protection authority, for example the Data Protection Board of India under the Digital Personal Data Protection Act, 2023, or the data protection authority in your country.
• Server-Side Analytics Opt-Out: External platform telemetry is off until you explicitly enable it in Settings. Enabling applies only to future events; re-enabling does not export events collected while telemetry was off. You can disable it at any time. A successful preference change or account deletion coordinates with previously authorized telemetry delivery before confirming completion. Lock waits and delivery requests are bounded. If the operation fails, retry; the previous preference remains in force. A failed preference read means the delivery status is unknown. Previously transmitted data requires a separate external deletion request.
• Cookies and analytics: Strictly necessary cookies are always on. PostHog and Google Analytics cookies are optional, off until you accept, and you can withdraw at any time in the cookie settings. Every cookie and storage item is listed in our Cookie Policy.

8. International Transfers and Data Location

Distrarc's application and primary production database run on Microsoft Azure in the Canada Central region. Some providers listed in Section 4 process data outside Canada. Google, Resend and, when enabled, PostHog process data in the United States. ResellerClub processes mailbox provisioning details in India and globally. Where personal data is transferred outside Canada, the United Kingdom, the European Economic Area or India, we rely on the providers' contractual safeguards for that transfer.

9. Children

Distrarc is a service for businesses and founders. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child's information was submitted to us, write to privacy@distrarc.com and we will delete it.

10. Contact & Privacy Inquiries

For privacy inquiries, data subject requests, or security notices, you can contact our privacy desk directly. Our postal address is listed on our Contact page.

We will post changes to this policy on this page with a new “Last updated” date. If a change is material, we will also tell account holders in the app.