disclosures.dev is an API service operated by Carrotly Pte. Ltd. (UEN 202212557Z), 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 ("we"). It serves public corporate-disclosure data to authenticated API clients. This policy covers the personal data the service itself handles — which is deliberately minimal — and your rights over it under the GDPR (EU/EEA), the CCPA (California), and the PDPA (Singapore).
What we collect
- API credentials: a SHA-256 hash of your API key, a tenant identifier you or we chose, and a plan name. We never store the key itself.
- Usage records: per-request logs of tenant, tool called, duration, weighted cost, and outcome — used for operations, fair-use enforcement, and (if applicable) billing.
- Standard server logs: IP addresses and request metadata retained by our hosting provider (Vercel) for a limited period for security and debugging.
- Contact details you give us directly (for example an email address when requesting an API key).
We set no cookies, run no analytics scripts, and have no user accounts. Company data returned by the API is public regulatory information about legal entities, drawn live from official registers; where filings name individuals (directors, officers, major shareholders), that information originates from and remains attributable to the official public register that published it.
What we do not do
- No sale or sharing of personal information (CCPA §1798.140) — with anyone, for any purpose.
- No advertising, tracking, or profiling.
- No retention of query content beyond the operational logs above.
Legal basis and retention
We process the data above to perform our contract with you (GDPR Art. 6(1)(b)) and for our legitimate interest in operating a secure, fairly-used service (Art. 6(1)(f)). Key records live for the life of the key plus a short audit window; usage and server logs are retained on rolling windows measured in weeks, not years.
Where data lives
The service runs on Vercel (hosting, logs, document delivery) with a Redis instance operated by us for credentials, rate limiting, and caching of public reference data. Upstream data requests go directly to the official registers listed on the coverage page; your API key is never forwarded to them.
Your rights
Depending on your jurisdiction you may have rights of access, correction, deletion, portability, restriction, and objection (GDPR Arts. 15–21; CCPA §§1798.100–.125; PDPA Parts 4–6). The service holds so little about you that most requests reduce to "delete my key and its usage history" — which we honor. Write to privacy@carrotly-ai.com; we respond within the statutory window for your regime. You may also lodge a complaint with your supervisory authority.
Changes
Material changes update the date at the top of this page; check it when you revisit.
This document is a template completed in good faith and does not constitute legal advice; have counsel review it for your circumstances.