Privacy Policy.

Daero AI, LLC (“Daero”, “we”), a Florida limited liability company, runs the Daero app at app.daeroai.com and this website. Contact: max@daeroai.com.

This policy covers two groups: our customers and the people who use the app, and the professionals who appear in search results. For both, Daero decides why and how the information is used.

• Account: your name and verified email, held by WorkOS, our sign-in provider. If you edit your name in My profile, it is saved with WorkOS, and Daero keeps no copy.
• Workspace: the workspace name you choose, your role in it, and your plan. The workspace name is also shown on Stripe receipts.
• Billing: Stripe takes and stores your payment details. Daero sees only the card brand, the last four digits, the expiry date and the billing email, plus your plan, invoices and token balance.
• Your work in Daero: your requests as you wrote and confirmed them, project titles and summaries, the people each search returned, your shortlists, keep and pass decisions and notes, and what each search cost in tokens. Some drafts and preferences are also kept in your own browser.
• Email preferences: whether you want the “search ready” and “tokens running low” emails.
• Support messages: what you write in the Support form is emailed to Daero with your name, email and workspace, so we can reply. It is not stored in Daero’s database.
• Technical data: request logs kept by our hosting provider for security and troubleshooting, and the cookies listed below.
• Past access requests: before sign-up opened, this website’s early-access form stored the name, work email, organization, optional details and browser user-agent of people who sent it.

We use this information to provide the service and your searches, take payment, send the emails described below, answer support requests, keep Daero secure, and understand and fix problems. We do not sell personal information, show advertising, or use analytics or advertising trackers.

A Daero search looks for professionals who match a customer’s request, using public information only. For each person a search returns, Daero may hold:

• their name, role, organization and location as public sources give them;
• short quotes from public pages that support why they may fit, with the page’s link and date;
• work contact routes printed for that person, from six sources only:
  • their employer’s own website: a work email or contact page printed next to their name;
  • their employer’s own website: a work phone printed next to their name, or the organization’s main line or switchboard;
  • their own LinkedIn profile: a link to it, when a search finds it. The link can be saved with the person’s record. Daero does not sign in to LinkedIn or directly scrape it. Our search providers may return publicly indexed text and links from LinkedIn pages. Daero may quote that text as evidence and show a link to the person’s LinkedIn profile;
  • their published research: the author’s own address printed on a paper in PubMed, when it matches their name or organization;
  • ClinicalTrials.gov: a contact phone printed beside their name on a clinical-trial listing, in health and science searches;
  • the US NPI registry: the practice phone listed for a US clinician, which reaches the practice rather than the person, looked up only in health and science searches.

Where it comes from: pages found through web search, and the public data services listed under “Public sources a search asks” below. What Daero refuses, whether through web search, search providers or the public data services below: people-search, background-check, contact-finder and lead-database sites (for example ZoomInfo, Apollo, RocketReach and Spokeo), leaked data, political donations, and licence and register lookups. Contact details never come from those sites. There are three exceptions, all official registers, used only to confirm a professional’s role:

• New York Department of State real estate licences, in real estate searches about New York: Daero sends the person’s name, and keeps their licence type, the brokerage they are licensed with, their county and the licence’s expiry year. It never reads the business address.
• The US NPI registry, in health and science searches: Daero sends a clinician’s first and last name, and their US state when known. It keeps their NPI number, registered specialty, licence state, practice city and state, the date the NPI was issued, and the practice phone described above.
• GLEIF, the global register of legal entity identifiers, in finance searches: Daero sends only the organization’s name, and keeps its identifier, legal name, registered city and ultimate parent company. GLEIF records name organizations, not people.

Daero also uses two official records that name people:

• UK Companies House, in UK business searches: Daero sends the person’s full name, or the name of their company, to Companies House’s official service to find companies where they are an officer. Some UK searches also start from Companies House, listing the current directors of companies that match the request. For those companies Daero reads the company’s public profile, its officer list and its register of people with significant control. It keeps only: the company, the role, the appointment and resignation dates, the town and country recorded for the appointment, the company’s industry codes and year of incorporation, and, where the register lists the person as having significant control, the reason it records. It keeps appointments at the person’s own organization when that is known. It never keeps home addresses or dates of birth.
• CMS Open Payments, the US federal record of payments from drug and device companies to clinicians, in health and science searches: once the NPI registry has matched a clinician, Daero sends only their NPI number. It keeps a short summary for each of the two latest years of general payments recorded for them (the total, the number of companies and the largest payers) with a link to their public Open Payments page. It does not keep the individual payment records. The summary is shown on the person’s card as evidence, for example for a request that asks for clinicians who speak or consult for industry.

Daero never guesses or builds an email address and never keeps a personal mailbox. If two people in the same results share a personal email or phone, it is removed from both. Daero removes phone numbers and emails from quoted text, and keeps at most four contact routes per person. The contact details shown on a person’s card are also included when a customer downloads their shortlist. Why: to help a customer find professionals with relevant experience for a legitimate business purpose, such as hiring, expert calls or research. Our legal basis under the GDPR and UK GDPR is legitimate interests. We limit what is collected to work information that the person or their organization made public, and we honour objections. Because Daero holds only public work information, we tell people about it through this policy rather than by contacting each person, and anyone can ask what we hold about them. Requests about your information: You can request access, correction or deletion of your personal information, or object to our use of it, by emailing max@daeroai.com. Please include your name and the organization you work for. You can also include your own LinkedIn profile link, which helps us match you if you change employer. Before we act, we confirm that the request comes from you, or from someone authorised to act for you. A profile link on its own is not proof. Once a deletion request is confirmed, we delete what Daero holds about you:

• you are removed from our customers’ search results, including searches still running;
• you are removed from shortlists;
• you are removed from our older stored results;
• we take your name out of other people’s quoted sources.

What we keep after a deletion, and why: to stop you being found again in future searches, we keep a coded identifier made from your name, organization and, if you gave it, your profile link. It cannot be read back as your name. We keep it for as long as your removal is in force. We also keep a short record that the removal happened: the date, who carried it out, how we confirmed the request, and the number of items removed. This record contains no name, link or quote. We keep nothing else about you. What a deletion can’t reach: we cannot recall copies a customer has already downloaded or received by email. Our service providers’ logs and backups expire on their own schedules. We may not recognise you in a later search if your details have changed and you did not give us a profile link.

We use these service providers. Each processes data only to provide its service to Daero:

• WorkOS: sign-in and account records.
• Stripe: payments, subscriptions, invoices and receipts.
• Resend: sending Daero’s emails.
• Cloudflare: hosting the app and running searches.
• Neon: the app’s database.
• Vercel: hosting this website, and the stored early-access requests.
• OpenAI and Anthropic: AI models that read your request and the public pages a search finds. Daero asks OpenAI not to store what it sends.
• Exa: web search. Exa receives your request as you wrote it and search words written from it, and returns public pages.

Daero never adds your name or account details to a search. The words you write in a request are sent to our AI and search providers to run it, so leave out anything you don’t want them to see.

Public sources a search asks. To find and check people, a search also queries public data services. These are independent sources of public information, not our processors: each receives the query and handles it under its own terms. A query holds a person’s name with their organization, words from the customer’s request, or a place such as a US state or city. Daero does not add the customer’s name or account details to these queries. Search words are written from the request, so words a customer wrote, such as a company name, may appear in a query. Requests identify Daero with a contact email. Each source runs only when a request is about its field or place, and some run only once Daero has set up access to them.

• Research and health: PubMed (NCBI), Europe PMC, Crossref, OpenAlex, NIH RePORTER, NSF awards, dblp, ClinicalTrials.gov, the US NPI registry, CMS data (Open Payments, clinicians, Medicare Part B and Part D, hospitals) and openFDA.
• Companies and finance: SEC EDGAR, UK Companies House, GLEIF, FDIC BankFind and the FFIEC’s HMDA data.
• Government and industry: the Federal Register, Regulations.gov, USAspending, the US Lobbying Disclosure database, GovInfo, the EPA (ECHO, TRI and greenhouse gas reporting), the EIA and NHTSA.
• Property: NYC Open Data and the NYC Department of Buildings, and the open data portals of Chicago, Austin and New York State.
• General and media: Wikipedia, Wikidata, GDELT news, YouTube, MusicBrainz and Discogs.

We may share information if the law requires it, to protect Daero or others, or as part of a sale or merger of Daero, in which case this policy continues to apply.

Daero sends emails about your account and searches: a confirmation when your plan becomes active, a note when a search is ready, and a one-time warning when your tokens can’t cover another default-size search. You can turn off the search-ready and low-token emails in Settings. Sign-in emails come from WorkOS, and receipts and invoices come from Stripe; those can’t be turned off because they are part of the service. Daero does not send marketing email.

Daero uses only what it needs to work. There are no analytics or advertising cookies.

• wos-session: keeps you signed in (WorkOS).
• daero_sign_up_plan: remembers the plan you picked during sign-up, for one hour.
• daero_auth_retry: helps a sign-in that failed to retry once.
• Browser storage: your theme and sidebar setting, unsent drafts, search defaults and a cached copy of your workspace, kept in your own browser. This website stores only your theme choice.

• Account and workspace: while your account is open. After you cancel, we keep it until you ask us to delete it.
• Search results: kept with your project until you ask us to delete them, by emailing max@daeroai.com. A person in results who asks to be removed is deleted once we confirm the request, apart from the coded identifier and removal record described above. We will publish fixed retention periods here when automatic deletion is switched on.
• Removed projects: removing a project hides it but keeps its searches, so we can restore it if you ask. Email us to delete it for good.
• Billing records: as long as tax and accounting law requires.
• Support emails: in Daero’s inbox for as long as needed to help you.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. People in the UK, the EU and the EEA can also complain to their data protection authority, such as the UK Information Commissioner’s Office. Residents of some US states, including California, have similar rights, and we do not sell or share personal information for cross-context advertising. To use any of these rights, as a customer or as a person in search results, email max@daeroai.com. We will reply within one month and may need to confirm who you are.

Customers can delete their projects and shortlists by emailing us. Account deletion is not self-serve yet.

Daero is based in the United States, and our providers process data in the US and other countries. When we move personal information from the UK, the EU or the EEA, we rely on the European Commission’s Standard Contractual Clauses and the UK addendum in our providers’ data processing terms, or on their certification under the EU-US Data Privacy Framework and its UK extension.

We use access controls, encryption in transit, workspace-level data separation in the database, and providers with strong security programs. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

Daero is a business service and is not for anyone under 18. We do not knowingly collect information from children.

We will update this policy as Daero changes. If a change is material, we will tell customers by email or in the app before it takes effect. The date at the top shows the latest version.