How we handle your data

Only the systems you pick, and only through their own exports. You download each product's admin export to your machine; your coding agent (Claude Code, Codex or Cursor) reads those files and nothing else. Nothing reads your tools through an API, and we never get your passwords or a login to them.

For a valuation, that's a small sample, and only two things from it reach us: aggregate figures (sizes, date ranges, field statistics) and an anonymized excerpt of about 80 records. The full sample, anonymized on your machine, stays there until you choose to send it from your dataset page.

If you license your data, you share only what the agreement covers, and you can leave out any system, folder or kind of record.

Before you approve, the only thing that reaches us is counts and date ranges. Then a Goldspring review tool runs on your machine. It removes personal details from the sample there, opens a dashboard in your browser showing exactly what would be sent and which fields were masked, and lets you mask more. Nothing is sent until you approve in that dashboard. The tool itself sends nothing: once you approve, your agent uploads the anonymized excerpt with a one-time link.

Anonymization happens on your device, by a tool you can read, before anything reaches us. Names, email addresses, phone numbers, street addresses, ID and account numbers, and any passwords, API keys or tokens that slipped in are removed. Personal IDs become consistent pseudonyms, so records still link up. The same code runs again on our side to re-scan what arrived.

No automated method is perfect, so the tool tests itself on every sample and the dashboard shows exactly what it found. If a system holds something you can't risk sharing in any form, leave it out. We'd rather value less.

Every dataset gets a privacy receipt signed with our published key. It records what the review tool removed on your device (counts by type, the fields it masked, and the fields you added), the anonymizer version and the regression checks it passed for that release, the fingerprint of exactly what we received, and our re-scan of what arrived and of everything we wrote about your data. It says plainly where each step ran.

Anyone can check a receipt's signature, so it can't be quietly edited later.

Until the full dataset is sent we hold only the anonymised excerpt and the figures. The full dataset is sent with the upload tool after your call, once we approve it, and the tool anonymises it on your machine first. Everything you send is encrypted at rest with its own key (AES-256-GCM), and every read checks it hasn't changed since upload.

Just want the number? We delete your sample 7 days after your final valuation, and never later than 60 days after upload. If you opt in to selling, we keep it while you're opted in and delete it whenever you ask, or after 12 months without activity.

Until the full dataset is sent, our models and reviewers read the sizes and the anonymized excerpt, which is all we have. Once you send the full dataset, they read the anonymized records inside it. We never receive a raw copy: everything you send was anonymized on your machine. Each pack is stored encrypted, and if anyone on our team opens one, it's logged and shows up on your dashboard.

Buyers never see records, samples or excerpts before a deal. If you opt in, they see an anonymized listing you approve word for word, and you approve every buyer and every term.

You sign the evaluation agreement in the app through DocuSign before your coding agent looks at anything, and nothing is collected until it is signed. It mostly binds us: evaluation only, no model training, no resale, nothing shown to buyers without your consent. You can download the signed copy from your dashboard. Selling is a separate agreement you choose to sign.

Only share data your company has the right to share. Some customer, employee and vendor contracts limit how data can be used, so check them, or ask us and we'll go through it with you.

Health records need extra terms before anything is shared. If your data includes them, your agent will stop and ask.