Privacy Policy

1. Who is responsible for your data

• Your account and use of the Service. For information about your own account and how you use the Service, OnlyCommon acts as the data controller.
• The lists you upload. When you upload account lists to run a match, you (or your organization) decide what data to upload and why. For that data you act as the controller, and OnlyCommon acts as a processor that handles the data on your behalf and under your instructions, as described in our Terms of Service and any applicable data processing terms.

2. Information we collect

Information you provide when you create and use an account

• Your name, work email address, and a password.
• Your organization or workspace name and related settings.
• Communications you send us (for example, support requests).

The account lists you upload

To run a match, you upload lists of business accounts. These may include company information (such as company names, websites or domains, country, and business identifiers) and, depending on your use, business contact details for the people who own those accounts within your organization or your partner's organization.

You are responsible for ensuring you have the right to upload and process this information. We process it only to provide the matching service to you and your chosen partner, and we apply strict limits on how it is shared (see Section 4).

Information we collect automatically

• Basic technical and usage information needed to operate and secure the Service, such as limited log information and the approximate origin of a request.
• A small number of cookies or similar technologies that are necessary to keep you signed in and to operate core features. We do not use the Service to build advertising profiles.

3. How we use information

We use information to:

• Provide, operate, and maintain the Service, including running matches and producing reports.
• Create and secure your account, verify your email address, and authenticate you.
• Communicate with you, including sending service messages such as email verification, password resets, invitations, and notifications that a report or introduction is ready.
• Process payments and manage subscriptions and line balances.
• Protect the Service and our users, prevent abuse, and maintain security and integrity.
• Comply with legal obligations and enforce our agreements.

4. How information is shared

With your partner — only the overlap. The core privacy principle of the Service is that only the accounts that appear on both parties' lists are revealed to the other party. Accounts that do not match are never disclosed to your partner, and your full list is never shared. Where you choose a match type that includes account owners, the relevant contact details for matching accounts may be shared with the matched party so the right people can connect.

With service providers. We use a small number of trusted third-party providers to operate the Service — for example, to host the Service, deliver email, and process payments. These providers act on our behalf, are bound by confidentiality and data-protection obligations, and may only use the information to provide their services to us. We can provide a current list of the categories of providers on request.

For legal and safety reasons. We may disclose information where required by law, to comply with legal process, to enforce our terms, or to protect the rights, property, or safety of OnlyCommon, our users, or others.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. How long we keep information

We keep information only as long as needed for the purposes described in this Policy.

• Files you upload are deleted shortly after they have been processed for a match.
• Match reports are available for a limited period after they are produced, after which they are deleted.
• Account information is kept while your account is active and for a reasonable period afterward, unless a longer period is required by law.

You can ask us to delete your account and associated information as described in Section 8.

6. How we protect information

We use appropriate organizational and technical safeguards designed to protect information, including encryption of data in transit and at rest, access controls, and logging of significant actions. No method of transmission or storage is completely secure, but we work to protect your information and to limit access to it to those who need it to operate the Service.

7. International transfers

OnlyCommon may process and store information in countries other than the one in which you are located. Where we transfer personal data across borders, we take steps designed to ensure it remains protected and that transfers comply with applicable law, including using appropriate safeguards where required.

8. Your rights and choices

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, update, or delete it, to object to or restrict certain processing, to data portability, and to withdraw consent where processing is based on consent. If you are in the European Economic Area, the United Kingdom, or a similar jurisdiction, these rights arise under applicable data protection law; if you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, correct, and to not be discriminated against for exercising your rights.

To exercise any of these rights, contact us at contact@onlycommon.com. You may also have the right to lodge a complaint with your local data protection authority.

Note that for data you uploaded as a controller (the account lists), requests from individuals are generally directed to the organization that uploaded the data; we will assist that organization as its processor.

9. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, such as by posting the updated Policy with a new effective date. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.