This policy describes how LocalSpect ("LocalSpect", "we", "us") protects your account and the data in the Service. It lists the controls in place today, and we update it as we add more.
The short version
- Encrypted in transit. All traffic to LocalSpect uses TLS.
- Your workspace is yours. Only its members can open its markets, lists and results.
- We never see your card. Payments run on Stripe's checkout page.
- Breaches get reported. Within 72 hours for data you put into LocalSpect, and as the law requires for everything else.
- Found a problem? Tell us at [email protected].
1. Hosting and network
- Our servers sit behind Cloudflare, which filters attacks before they reach us.
- All traffic between your browser and LocalSpect is encrypted with TLS.
- Our database isn't reachable from the internet. Only our own services can connect to it.
2. Accounts and logins
- Passwords are hashed with bcrypt and never stored in plain text.
- After five wrong passwords, further login attempts are paused for a short time.
- New accounts confirm their email address before they can use the app.
- You can sign in with Google instead of a password.
- Password reset links expire after 60 minutes.
- Login cookies can't be read by scripts on the page. Our cookie policy lists each one.
3. Workspaces and access
- Markets, lists, agents and results belong to a workspace. The app checks that you're a member before it shows or changes them.
- Teammates join a workspace only by invitation, as an admin or a member.
- Only the workspace owner can manage billing.
- On our side, access to production systems is limited to the people who run the service.
4. Payments
You pay on Stripe's checkout page. Card details go straight to Stripe and never touch our servers. Stripe is certified to PCI DSS Level 1, the highest level for card payments.
5. AI providers
Our AI providers process requests only to answer them, and they don't train their models on your data.
6. Security incidents
If a breach affects personal data you put into LocalSpect, we tell you without undue delay and no later than 72 hours after we become aware of it, as our data processing agreement says. For other personal data, we tell you and the authorities as the law requires. No system is perfectly secure.
7. Reporting a vulnerability
If you think you've found a security problem in LocalSpect, email [email protected] with the steps to reproduce it. Please don't access other people's data beyond what you need to show the problem, and give us reasonable time to fix it before you tell anyone else.
8. Changes to this policy
When we change this policy, we update the effective date at the top.
9. Contact
LocalSpect, a Wyoming company. Security: [email protected]. Privacy: [email protected].