— Privacy policy

Privacy Policy

Last updated · May 19, 2026

DunsRoot ("we," "us," "our") respects your privacy and takes data minimization seriously. This Privacy Policy explains what we collect, why, and how quickly we get rid of it.

1. What we collect

To deliver the programs you purchase, we collect:

• Business identifiers: entity name, EIN, business address, DUNS number (if existing), state of formation.
• Contact information: your first and last name, email, mobile phone, role at the business.
• Personal identifiers (limited): date of birth, in cases where a vendor or bureau requires it for identity verification of the entity's principal. We never collect or store consumer-credit identifiers like SSN.
• Payment information: we never see your full card number. Stripe (or your chosen crypto rail) processes payment directly and shares a non-reversible token plus the amount paid with us.
• Order metadata: the program you purchased, fulfillment status, vendor placement history.

2. How we store sensitive information

Any limited personal identifier we collect is encrypted at rest using AES-256-GCM with a key derived from a server-side secret never written to the database. A database leak alone cannot decrypt protected fields — both the ciphertext and the server-side secret would have to be compromised together.

3. Data deletion — our commitment

All program-specific data is deleted after fulfillment is complete. Within 90 days of the final deliverable being marked complete, we permanently delete the dated personal identifiers and contact phone number. We retain only the minimum required for legal and tax purposes: order number, business entity name, EIN, amount paid, and email address (for audit and refund purposes — never for marketing).

4. What we never do

• We never sell, rent, or share your information with third parties for marketing.
• We never pull or access your consumer-credit file (FICO, VantageScore, or any of the consumer-credit bureaus).
• We never share your information with anyone except as strictly required to fulfill your order (e.g., placing a vendor account opens an account at that vendor, with the information the vendor requires).

5. Service providers

We use a small number of vetted service providers: Stripe (payments), a transactional email provider (receipts), our crypto-payment infrastructure, and the business-credit data partners (D&B, Experian Business, Equifax Business) required by each program's deliverables. Each is bound by a data processing agreement.

6. Your rights

You may request deletion of all your personal information at any time, even before the 90-day automatic-deletion window. We honor requests within 7 days unless we are legally required to retain a specific item (e.g., a tax record). Text 916-318-9623 with the email you used to order.

7. Cookies and analytics

We use functional cookies only (cart state, login session). We do not use third-party advertising cookies, behavioral tracking, or cross-site identifiers. We do not have a Facebook pixel or a Google Ads remarketing tag.

8. Children

Our Services are intended for U.S. business entities operated by adults 18 and older. We do not knowingly collect information from anyone under 18.

9. Changes

We may update this Privacy Policy from time to time. The version posted here is the controlling version. Material changes are announced via a banner on the homepage for at least 14 days before taking effect.

10. Contact

Text us at 916-318-9623 for any privacy question.