Privacy Policy

Effective Date: June 1, 2026 · Last Updated: June 1, 2026

1. Introduction

This Privacy Policy explains how CorpRoster ("CorpRoster", "we", "us", or "our") collects, uses, discloses, and protects information when you access or use our website at corproster.com and any related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use the Service.

We are committed to protecting your privacy and handling your personal information transparently and in compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA).

2. Information We Collect

We collect the following categories of information:

2.1 Information You Provide Directly

Account Information. When you register as a partner (a "Partner") or a buyer (a "Buyer"), we collect:

• Full name
• Email address
• Password (stored in hashed form; we never see your plain-text password)
• Company name and basic company details (Partners)
• Optional profile information you choose to provide (job title, phone number, profile photo, etc.)

Partner Listing Content. Partners may submit additional information for their public company profile, including but not limited to: company description, taglines, service categories, industries served, locations, team size, founding year, hourly rates, portfolio items, client logos, certifications, and social links.

Reviews and Communications. Information contained in reviews you submit, messages you send through our contact forms, support tickets, lead inquiries, and other communications with us or other users.

Payment Information (Partners on paid plans). If you subscribe to a paid plan, our payment processor Stripe, Inc. collects your payment details directly. CorpRoster does not store full credit or debit card numbers. We may store limited information such as the last four digits of your card, the card brand, expiration date, billing name, billing address, and transaction history for accounting, fraud-prevention, and refund purposes.

2.2 Information Collected Automatically

When you access the Service, we automatically collect:

• Device and Browser Data: IP address, browser type and version, operating system, device type, screen resolution, language preferences, and time zone.
• Usage Data: Pages viewed, time spent on pages, click paths, referring URLs, search queries entered on the Service, and interactions with widgets and listings.
• Log Data: Server logs containing access timestamps, HTTP request headers, response codes, and error reports.
• Cookies and Similar Technologies: Session cookies for authentication, preference cookies, and analytics cookies. See Section 8 for details.

2.3 Information from Third Parties

We may receive information about you from:

• Stripe (payment confirmations, transaction status)
• Email engagement providers (delivery, bounce, and open data for transactional emails)
• Public sources (publicly available business information about Partner companies, where applicable)

3. How We Use Your Information

We use the information we collect to:

1. Provide and operate the Service — create and manage accounts, publish Partner listings, process Buyer inquiries, display reviews, and deliver the core functionality of corproster.com.
2. Process payments — facilitate subscription billing through Stripe and issue refunds.
3. Communicate with you — send transactional emails (account verification, password resets, billing notices, lead notifications, review notifications, support replies, security alerts, and similar service messages).
4. Improve and personalize the Service — analyze usage patterns, troubleshoot technical issues, develop new features, and tailor the user experience.
5. Maintain trust and integrity — verify accounts, moderate reviews, detect and prevent fraud, abuse, spam, or violations of our Terms of Service.
6. Comply with legal obligations — respond to lawful requests from authorities, enforce our agreements, and exercise legal rights.
7. Analytics and performance — measure traffic, understand which features are used, and improve performance using third-party analytics tools (see Section 8).

We do not sell your personal information to third parties. We do not use your information for third-party advertising or behavioral targeting outside the Service.

4. Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data under one or more of the following legal bases:

• Contract — to provide the Service you have requested or are about to request.
• Legitimate Interests — to operate, secure, and improve the Service, prevent fraud, and communicate with users about their accounts, provided these interests are not overridden by your rights.
• Consent — for optional features such as marketing communications or non-essential cookies. You may withdraw consent at any time.
• Legal Obligation — to comply with applicable laws, regulations, court orders, or governmental requests.

5. How We Share Information

We do not sell personal information. We share information only in the following limited circumstances:

5.1 Service Providers (Sub-processors)

We share information with trusted third parties who process data on our behalf, strictly to provide the Service:

Each provider operates under its own privacy policy. We require contractual safeguards (such as Data Processing Agreements where applicable) to ensure your data is handled appropriately.

5.2 Public Information

Partner profiles and approved reviews are intentionally public, including company names, descriptions, ratings, review content, and reviewer display names (or "Anonymous" if chosen). By submitting this content, you understand it will be visible to anyone on the internet and may be indexed by search engines.

5.3 Legal Requirements

We may disclose information if required by law, court order, subpoena, or other valid legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud or security issues.

5.4 Business Transfers

If CorpRoster is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify users of any such change and any choices they may have.

6. Data Retention

We retain your information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Active account data: retained as long as your account is active.
• Deleted account data: anonymized or deleted within 90 days of account deletion, except as noted below.
• Transactional records (invoices, payments): retained for up to 7 years to comply with financial and tax laws.
• Reviews: published reviews may remain publicly visible after account deletion (the reviewer's display name will be replaced with "Former user" if the account is deleted).
• Server logs: typically retained for 30 to 90 days.
• Email engagement data: retained for up to 12 months.

If you wish to request earlier deletion, see Section 7.

7. Your Rights

Depending on your location, you have the following rights regarding your personal information:

• Right to Access — request a copy of the personal data we hold about you.
• Right to Rectification — request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten") — request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing — request that we limit how we use your data.
• Right to Data Portability — receive your data in a structured, machine-readable format.
• Right to Object — object to processing based on legitimate interests.
• Right to Withdraw Consent — where processing is based on consent.
• Right to Lodge a Complaint — with your local data protection authority.

California Residents (CCPA / CPRA): You also have the right to know what personal information we collect, the right to delete personal information, and the right to non-discrimination for exercising your rights. CorpRoster does not sell or share personal information for targeted advertising purposes.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You may also manage most of your account data directly through your account settings.

8. Cookies and Tracking Technologies

CorpRoster uses cookies and similar technologies for:

• Strictly necessary cookies — required for the Service to function (e.g., authentication, session management, security). These cannot be disabled.
• Preference cookies — remember your settings and preferences.
• Analytics cookies — Google Analytics and Microsoft Clarity help us understand how the Service is used. These tools collect pseudonymized data such as device type, page views, and click behavior.

You can control cookies through your browser settings. Disabling certain cookies may impact your ability to use parts of the Service.

We do not currently use cookies for third-party advertising or cross-site behavioral tracking. If this changes, we will update this Privacy Policy and obtain appropriate consent.

9. International Data Transfers

CorpRoster operates globally. Your information may be transferred to and processed in countries other than the country in which you reside, including countries within the European Economic Area. Where required by law, we implement appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to protect your data in connection with such transfers.

10. Security

We take reasonable technical and organizational measures to protect your information, including:

• HTTPS encryption (TLS) for all data in transit.
• Password hashing using industry-standard algorithms.
• Access controls and authentication for administrative systems.
• Regular security reviews of our infrastructure.
• Segregated database environments with limited access.

No method of internet transmission or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.

11. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, children under the age of 16. If we become aware that we have collected information from a child under 16 without parental consent, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].

12. Third-Party Links

The Service may contain links to third-party websites, including Partner websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any third-party site you visit.

13. Geographic Restrictions

The Service is not intended for, and may not be accessed from, certain jurisdictions, including but not limited to Iran, Russia, Belarus, North Korea, Syria, Cuba, and any country or region subject to comprehensive U.S., U.K., or EU economic sanctions or embargoes. By using the Service, you represent that you are not located in, and are not a resident of, any such jurisdiction.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by law, provide additional notice (such as by email or a notice on the Service). Continued use of the Service after the effective date of the revised policy constitutes acceptance of the changes.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us at:

CorpRoster
Email: [email protected]

For data protection inquiries from the EU or UK, you may use the same contact details. We will endeavor to respond to all legitimate requests within 30 days.

This Privacy Policy is provided in English. In the event of any discrepancy between this document and any translation, the English version shall prevail.