Privacy Policy

Not legal advice — review notice

This page is provided in good faith to explain how RecallRadar handles personal data. It is a plain-language privacy notice, not legal advice, and is maintained to reflect our current practices. If anything here is unclear or appears inconsistent with how the service actually works, the description of our actual practices and applicable law prevails, and you can contact us at data@apex-db.org to ask. We will update this notice as the service and our data practices evolve; the "last updated" date below always reflects the current version.

Who we are (the controller)

RecallRadar is a product operated by Daystrom OÜ ("Daystrom", "we", "us"), a Osaühing (Estonian private limited company) registered in the Estonian Commercial Register (e-äriregister) under registry code 17537299, VAT EE102999776, with its registered office at Tornimäe tn 5, Kesklinn district, Tallinn, 10145 Harju County, Estonia. Daystrom OÜ is the data controller responsible for the personal data described in this notice. We are established in the European Union, and we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Estonian data-protection law.

For any privacy question, request, or complaint, contact us at data@apex-db.org. We have not appointed a statutory Data Protection Officer, as we are not required to; privacy requests are handled by the Daystrom team at that address. If you are contacting us about personal data that appears inside the dataset we publish (rather than about your own account), please see the separate section "Personal data contained in the dataset we sell" below.

Scope of this notice

This notice covers two distinct kinds of personal data, and it is important not to confuse them:

1. Customer and visitor data — personal data about you when you visit this website, create an account, buy a snapshot or an API/MCP subscription, or call our API. This is the subject of the sections immediately following.

2. Dataset subject data — personal data that may be contained within the Consumer Product Safety Notice Database, API and Download that RecallRadar compiles and sells, where the data describes third parties (for example, named individuals appearing in a public registry record). This is governed by its own dedicated section, "Personal data contained in the dataset we sell", because our legal basis, the source of the data, and your rights differ.

This notice does not cover websites, products, or services operated by third parties (including our sub-processors and the public source registries), which have their own privacy policies.

What customer personal data we collect, why, and on what legal basis

We collect only what we need to provide and protect the service. The categories below set out, for each kind of data, the purpose and the GDPR Article 6 legal basis.

Account email address. Collected when you create an account and used for passwordless "magic-link" sign-in, to associate your account with your purchases and API tokens, and to send service and transactional messages (for example, sign-in links, receipts, subscription-expiry and renewal notices, and important changes to the service or this notice). Legal basis: performance of a contract with you, or steps taken at your request before entering a contract (GDPR Art 6(1)(b)). Where we send a non-essential service-related email that is not strictly necessary to the contract, our basis is our legitimate interest in keeping you informed (Art 6(1)(f)), and you can opt out of such non-essential messages.

API tokens (stored only as a SHA-256 hash). When you provision an API or MCP token we store only a cryptographic hash of it, never the token itself in readable form, together with metadata such as its label, creation date, and scope. We use this to authenticate your API requests and to let you manage and revoke your tokens. Legal basis: performance of the contract (Art 6(1)(b)) and our legitimate interest in securing the service (Art 6(1)(f)).

Payment and billing metadata. When you buy a snapshot or a subscription, payment is processed by our payment providers (see sub-processors below). Card details and full payment credentials are collected and held by the payment provider, not by us; we do not store your card number. We do retain billing metadata — for example, a payment-provider customer or transaction reference, the product purchased, the amount and currency, the date, and the information required to issue a VAT-compliant invoice (which, for business customers, can include a business name, address, and VAT identification number). Legal basis: performance of the contract (Art 6(1)(b)); and, for retaining invoices and accounting records, compliance with our legal obligations under tax and accounting law (Art 6(1)(c)).

IP address, request logs, and usage data. When you use the website or the API we automatically process technical data such as your IP address, request timestamps, the endpoints and resources requested, response status, approximate data volume, user-agent, and the token or account associated with the request. We use this to operate and secure the service: to authenticate requests, enforce rate limits and quotas, detect and prevent abuse, fraud, and attacks, debug and maintain reliability, meter usage for billing, and keep an audit trail. Legal basis: our legitimate interests in the security, integrity, and proper functioning of the service and in accurate billing (Art 6(1)(f)); and, for usage that directly underlies what you are charged, performance of the contract (Art 6(1)(b)).

Support correspondence. If you email us, we process the content of your message and your contact details to respond and to keep a record of the request. Legal basis: our legitimate interest in responding to and managing enquiries (Art 6(1)(f)), or performance of the contract where your request concerns an existing subscription (Art 6(1)(b)).

We do not deliberately collect special categories of personal data about you (such as health, biometric, or political data), and you should not send such data to us. We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you, and we do not sell your personal data.

Our legitimate interests, in brief

Where we rely on legitimate interests (Art 6(1)(f)) — principally for security, abuse and fraud prevention, service reliability, usage metering, and responding to enquiries — we have considered your interests and rights and concluded that this processing is necessary, that it is limited to what those purposes require, and that it is something you would reasonably expect from a service of this kind. You can ask us for more detail on this balancing assessment, and you have the right to object to processing based on legitimate interests (see "Your rights").

How long we keep customer data (retention)

We keep personal data only as long as necessary for the purpose it was collected for, after which we delete or anonymise it. In practice:

• Account data (email, hashed tokens, account settings) is kept for the life of your account and for a limited period afterwards so we can handle reactivation, disputes, and our own legal claims. If you close your account, we delete or anonymise account data within the period stated in the schedule below, except where we must keep specific records longer for the reasons below.

• Invoices, payment metadata, and accounting records are kept for the period required by Estonian and EU tax and accounting law (generally several years), regardless of account closure, to meet our legal obligations (Art 6(1)(c)).

• Security, request, and usage logs (including IP addresses) are kept for the shorter operational period stated in the schedule below for rate-limiting, abuse detection, billing reconciliation, and audit, and are then deleted or aggregated into non-identifying statistics.

• Support correspondence is kept for as long as needed to resolve your matter and for a reasonable period afterward.

The specific retention periods are set out in the schedule below and may be updated as our practices mature; the published durations are the controlling values.

Account data (email, hashed tokens, settings)

life of the account + 12 months after closure (reactivation, disputes, legal claims), then deleted or anonymised

Invoices, payments & accounting records

7 years from the end of the financial year in which the transaction was recorded (Estonian Accounting Act § 12; Taxation Act § 58)

Security, request & usage logs (incl. IP)

12 months, then deleted or aggregated into non-identifying statistics

Support correspondence

24 months

Who we share customer data with (sub-processors)

We do not sell your personal data and we do not share it with third parties for their own marketing. We rely on a small set of vetted service providers (sub-processors) that process personal data on our behalf, under contract and on our instructions, each only to the extent needed for its role. Each is bound by a data-processing agreement requiring appropriate security and confidentiality. Our current sub-processors, their roles, and their processing regions are listed in our sub-processor list:

• Vercel — website and API hosting, content delivery (CDN), Blob storage for snapshot downloads, cookieless aggregate audience measurement and, only after Analytics consent, bounded custom-event and performance measurement. Audience measurement receives query-free paths, origin-only referrers and coarse device/geography; Vercel derives a daily visitor hash from the request and resets/discards it within 24 hours. It runs unless you opt out and is disabled when the browser supplies Global Privacy Control or Do Not Track. Regions: United States and European Union.

• Neon — managed PostgreSQL database hosting where account data, hashed tokens, and billing metadata are stored. Regions: United States and European Union.

• Upstash — serverless Redis used for API abuse prevention and anonymous rate limiting. We transform a client IP into a pack-specific SHA-256-derived key before it reaches Upstash; the short-lived key and counters expire after the active rate-limit window. Upstash does not receive the raw client IP from this limiter. Region: United States.

• Resend — delivery of passwordless magic-link sign-in emails and transactional messages. Processes your email address and message metadata. Region: as stated in our sub-processor list.

Payment providers and public payment networks. Stripe (Stripe, Inc. and Stripe Payments Europe, Ltd.) processes card checkout payments as an independent controller. Coinbase, Inc. (Coinbase Developer Platform) facilitates our Base x402/EVM machine-payment path and handles that payment data under its own privacy terms. Native MPP on Tempo is a separate rail and is not processed by Coinbase; its transaction data is submitted to the Tempo network and, like Base transaction data, becomes visible on a public blockchain. We receive protocol and billing metadata, not your card number, private key, seed phrase, or reusable payment-signing credential. Anonymous pay-per-call requests do not provide us with an email address or billing identity unless you separately contact us.

Analytics and advertising recipients (consent-gated). Analytics consent enables bounded Vercel custom events, Vercel Speed Insights and, where configured, GA4. Separate Advertising consent enables Google Ads conversion measurement where configured. Google receives no data before the relevant opt-in under Basic Consent Mode. We do not send Google prompts, form text, search text, returned records, raw URL queries or buyer email. You can change or withdraw any choice at any time on our cookies page.

We may also disclose personal data where we are legally required to (for example, in response to a valid legal request from a competent authority), to establish, exercise, or defend legal claims, or as part of a corporate transaction (such as a merger or asset sale), in which case we will require the recipient to honour this notice or give you advance notice as required by law. We keep our sub-processor list current; material additions will be reflected here, and the dated list governs.

International transfers

We and some of our sub-processors process personal data outside the European Economic Area (EEA), in particular in the United States (see our sub-processor list for which providers and regions apply). Where personal data is transferred outside the EEA to a country that the European Commission has not deemed to provide an adequate level of protection, we rely on the transfer mechanism stated in our transfer safeguards — primarily the European Commission's Standard Contractual Clauses (SCCs) incorporated into our agreements with those providers, together with supplementary technical and organisational measures (such as encryption in transit and access controls) where appropriate. You can request more information about the safeguards in place by contacting us at data@apex-db.org.

Your rights

If you are in the EEA (and, to a comparable extent, in the UK and many other jurisdictions), you have the following rights over your personal data, which you can exercise free of charge in most cases:

• Access — to obtain confirmation of whether we process your personal data and a copy of it.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have your data deleted where one of the grounds in the GDPR applies (this does not override records we must keep by law, such as invoices).
• Restriction — to have us limit how we use your data in certain circumstances.
• Portability — to receive certain data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection — to object, on grounds relating to your particular situation, to processing we carry out on the basis of legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests or need the data for legal claims. You may object to direct marketing at any time, with no need to give reasons.
• Withdraw consent — where we rely on your consent for a specific processing activity, you may withdraw it at any time, without affecting processing already carried out. Withdrawal of consent for non-essential messages or processing is governed by our consent-withdrawal terms.

To exercise any right, email data@apex-db.org. We may need to verify your identity before acting, and we will respond within the time limits set by the GDPR (generally within one month, extendable for complex requests).

Right to complain. If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — info@aki.ee — www.aki.ee. You may also complain to the supervisory authority in your own country of residence or work. We would, however, appreciate the chance to address your concern first.

Cookies and similar technologies

RecallRadar uses the necessary cookies and local storage required to operate and secure requested services — for example, authenticated sessions, essential preferences, form security and the record of your privacy choices.

Anonymous, cookie-free Vercel audience measurement counts query-free page visits unless you opt out and is disabled when the browser supplies Global Privacy Control or Do Not Track. Analytics consent separately enables bounded Vercel custom events, Vercel Speed Insights and, where configured, GA4. Advertising consent separately enables Google Ads conversion measurement where configured. Analytics and Advertising are off by default. Google uses Basic Consent Mode, so no Google code or request loads before the relevant opt-in. Measurement URLs are stripped of query strings, custom events use bounded categories, and we do not send prompts, search or form text, returned records, tokens, record IDs or buyer email. The banner offers Reject all, Manage choices and Accept all with equal prominence; you can change or withdraw any purpose on our cookies page. We do not use session replay or fingerprinting. The current authoritative description is maintained in our Cookie Statement.

• Authentication / sign-in (strictly-necessary) — Keeps you signed in after magic-link login so the account and dashboard work without re-authenticating each page.
• Session (strictly-necessary) — Short-lived identifier tying together the requests in a single visit; carries no marketing data.
• Security (CSRF / anti-abuse) (strictly-necessary) — Protects form and account actions against cross-site request forgery and abuse.
• Rate-limiting & abuse prevention (strictly-necessary) — Enforces fair-use limits and detects automated abuse of the site and sign-in flow.
• Essential preferences / UI state (strictly-necessary) — Short-lived non-tracking interface state needed for the site to behave as you requested.
• Privacy choice (strictly-necessary) — Stores db-consent-v3 for up to 183 days so the site can honour separate Audience measurement, Analytics and Advertising choices; it is not used to track browsing.
• Anonymous audience measurement (Vercel Web Analytics) (analytics) — Measures aggregate visits to query-free page paths with origin-only referrers and coarse device/geo. It sets no cookie or cross-site identifier; Vercel derives a visitor hash from the incoming request and discards/resets it within 24 hours. It runs unless you opt out and is disabled when the browser supplies Global Privacy Control or Do Not Track.
• Performance analytics (Vercel Speed Insights) (analytics) — Measures query-free route performance and Core Web Vitals for consenting visitors. Loaded only after Analytics consent.
• Analytics (Google Analytics) (analytics) — Where configured, measures query-free pages and bounded events for consenting visitors. GA4 may set _ga and _ga_<measurement-id> first-party cookies for up to 2 years. Loaded only after Analytics consent; Google Signals and ad-personalisation signals are disabled in our GA4 tag configuration.
• Advertising (Google Ads) (advertising) — Where configured, measures conversions from paid-search ads using bounded conversion and transaction metadata. Loaded only after separate Advertising consent. We do not send form content, prompts, result rows or buyer email to Google Ads.

Necessary storage for sign-in, security, requested forms and the privacy-choice record always runs. Anonymous, cookie-free Vercel audience measurement runs unless you opt out and respects Global Privacy Control and Do Not Track. Browser Analytics (bounded Vercel custom events, Speed Insights and, where configured, GA4) and Advertising (Google Ads, where configured) are separate, default-off choices. Google uses Basic Consent Mode, so no Google code or request is loaded before the relevant opt-in. The first layer offers Reject all, Manage choices and Accept all with equal prominence; the second layer exposes separate Audience measurement, Analytics and Advertising controls. You can change or withdraw any choice at any time on the cookies page. We do not use session replay or fingerprinting.

Security

We apply appropriate technical and organisational measures to protect personal data, including encryption of traffic in transit (HTTPS), storing API tokens only as SHA-256 hashes rather than in readable form, restricting access to production systems on a need-to-know basis, and relying on reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to detect and respond to incidents. If a personal-data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, affected individuals, in line with the GDPR.

Children

RecallRadar is a business-to-business and developer tool and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact data@apex-db.org and we will delete it.

Changes to this notice

We may update this privacy notice from time to time to reflect changes in our practices, our sub-processors, or the law. When we make material changes, we will update the "last updated" date shown on this page and, where appropriate, notify account holders by email. The current version, identified by 2026-07-28, is the one that applies; continued use of the service after an update means you are aware of the current notice. We encourage you to review this page periodically.

Contact

Questions, requests, or complaints about privacy — including any request to exercise your rights, or any concern about personal data appearing in the dataset — can be sent to data@apex-db.org, or by post to Daystrom OÜ, Tornimäe tn 5, Kesklinn district, Tallinn, 10145 Harju County, Estonia. Please tell us whether your request relates to your own account or to data in the dataset we publish, so we can route it correctly.