Privacy policy
Quick answer, updated
This policy covers this website, the buyer index and the offer request form, as of October 18, 2026. AC0 AI, S.L.U. is the controller. We collect business contact and company details, never your company’s data, and share them only with buyers you approve for each introduction.
Who is responsible
AC0 AI, S.L.U. (Calle Maestranza 25, planta 1, 29016 Málaga, Spain) is the controller for personal data collected through this website, published in the buyer index and collected through the form at /get-offers. Send every privacy question or request to hello@datalicensingindex.com.
What we collect
| Category | What it includes |
|---|---|
| Contact details | Your name, work email and role (owner, CEO, founder, board member or adviser) |
| Company details | Company name, website, country of headquarters, headcount now and at peak, years operating, and status (operating, winding down, shut down, or in bankruptcy or an assignment for the benefit of creditors) |
| What the company has | Systems it uses, the main language of its data, known blockers, timeline and payout preference |
| Deal context | Buyers you are already talking to, and any offer terms you choose to paste after confirming you are allowed to share them |
| Consent records | Your answers to the two consent checkboxes and to the permission checkbox for offer terms, with the time you submitted |
| Technical data | A salted hash of your IP address, not the address itself, and your browser’s user agent string, stored with your submission to spot abuse and duplicates |
| Emails | What you write to us, and what we write back |
We never collect your company’s data. We do not ask for, and do not want, exports, samples, files from your systems, passwords or admin access. If you send any of these anyway, we delete them and tell you.
Why we use it, and the legal basis
| Purpose | Legal basis under the GDPR |
|---|---|
| Reply to your request and contact you about it | Your consent, given with the required contact checkbox (Art. 6(1)(a)) |
| Introduce you to a buyer you approve | Your consent, given with the sharing checkbox and confirmed again, separately for each buyer, before we make that introduction (Art. 6(1)(a)). We keep a dated record of each approval, for example in our email thread with you |
| Follow up after an introduction to learn whether a license was signed and paid | Our legitimate interest in knowing whether an introduction worked and, if we ever have a referral agreement with that buyer, whether a fee is owed to us (Art. 6(1)(f)) |
| Protect the form from spam and abuse | Our legitimate interest in keeping the service secure (Art. 6(1)(f)) |
| Count page views on this site | Our legitimate interest in knowing which pages are used (Art. 6(1)(f)) |
| Publish aggregate figures about offer terms | Our legitimate interest in publishing market data, limited to figures built from at least three offers that never name a company or show a single offer (Art. 6(1)(f)) |
| Keep accounting records if a buyer pays us a fee linked to your introduction | Legal obligation (Art. 6(1)(c)) |
You can withdraw consent at any time by emailing hello@datalicensingindex.com. Withdrawal stops all future contact and introductions. It does not affect the lawfulness of processing before the withdrawal (Art. 7(3)). If we have already introduced you to a buyer, we will ask that buyer to delete what we sent.
We never sell your details, add you to a marketing list, share your submission with a buyer you have not approved, or use your submission to train AI models.
Who we share it with
Buyers you approve. Before each introduction we tell you which buyer, what we will send and whether that buyer pays us. We send only what you approve. We never pass offer terms from one buyer to another unless you tell us to. Once a buyer has your details, it handles them as a separate controller under its own privacy policy.
Service providers. These companies process data on our behalf under data processing agreements:
| Provider | What it does for us | How transfers outside the EEA are covered |
|---|---|---|
| Vercel Inc., United States | Hosts the website, runs the form and counts page views | The Vercel Data Processing Addendum incorporates the EU Standard Contractual Clauses (Commission Decision 2021/914). The Vercel Privacy Notice states that Vercel complies with the EU-U.S. Data Privacy Framework. |
| Neon, a Databricks company, United States | Stores form submissions in a Postgres database | Neon’s Product Specific Schedule is an agreement with Databricks, Inc., the parent company of Neon. The Databricks Data Processing Addendum incorporates the EU Standard Contractual Clauses (Commission Decision 2021/914). |
| Resend (Plus Five Five, Inc.), United States | Sends us an email notice with your answers when you submit | The Resend Data Processing Addendum incorporates the EU Standard Contractual Clauses (Commission Decision 2021/914) and states that Resend complies with the EU-U.S. Data Privacy Framework. |
| Google (Google Workspace), United States | Hosts the mailbox where we receive your submission notice and exchange email with you | The Google Cloud Data Processing Addendum provides for the EU Standard Contractual Clauses (SCCs) for transfers. |
| Porkbun LLC, United States | Forwards email sent to hello@datalicensingindex.com to our mailbox | Porkbun’s privacy policy says it uses appropriate safeguards for transfers, such as the Standard Contractual Clauses. |
Authorities, when the law requires it.
A new owner. If the index is ever transferred, we will tell you before your details move, and you can ask us to delete them first.
How long we keep it
| Situation | How long |
|---|---|
| No introduction was made | Deleted 12 months after you submit, including the email copy in our inbox |
| An introduction was made | Kept for 24 months after the introduction, so we can follow up on the outcome, then deleted with the email copies |
| A buyer paid us a fee linked to your introduction | The records behind the invoice are accounting records. Spanish law requires us to keep them for six years from the last entry in our books (Código de Comercio, article 30). |
You can ask us to delete your details earlier at any time. We will, except for records we must keep by law.
Your rights
Under the GDPR you have the right to:
- see what we hold about you (Art. 15)
- correct it (Art. 16)
- have it deleted (Art. 17)
- restrict how we use it (Art. 18)
- receive it in a portable format (Art. 20)
- object to processing based on our legitimate interest (Art. 21)
- withdraw consent at any time (Art. 7(3))
Email hello@datalicensingindex.com. We answer within one month, as Art. 12(3) requires. We give the same rights to everyone who uses the form, wherever they live.
You can also complain to a supervisory authority (Art. 77). AC0 AI, S.L.U. is established in Spain, so our lead authority is the Spanish Data Protection Agency (AEPD). You can also complain to the authority where you live or work, such as the Swedish Authority for Privacy Protection (IMY).
People named in the index
Some rows name a company’s founders or executives, taken only from the company’s own pages or public registries, so readers can see who stands behind a buyer. Legal basis: our legitimate interest in publishing a verifiable market index (Art. 6(1)(f)). You can object, or ask us to correct or remove your name, at hello@datalicensingindex.com. We keep the company’s row but remove the name unless it is needed to identify the legal entity.
Cookies and technical data
This site sets no advertising or cross-site tracking cookies. Our host processes technical request data, such as IP address, browser type and the time of each request, to deliver the site and protect it from abuse.
When you follow a link from the index to a buyer’s website, the link passes through our own address (/go/) and we record which buyer, the page you came from and a salted hash of your IP address, not the address itself. We use it to count how many visitors each buyer gets from the index. Legal basis: our legitimate interest in knowing how the index is used (Art. 6(1)(f)).
We count page views with Vercel Web Analytics. It uses no third-party cookies. Vercel identifies a visit by a hash created from the request and discards it after 24 hours, and we see only aggregate figures such as page, referrer, country, browser and device type. Legal basis: our legitimate interest in knowing which pages are used (Art. 6(1)(f)).
Security
The site and the form run over HTTPS. Access to submissions is limited to the editor and the service providers listed above. We never accept company data, so there are no datasets of yours in our systems to expose.
Changes to this policy
When this policy changes, the date at the top changes and the change is logged on the changelog. If a change affects how we use details you already gave us, we will email you before it applies.
Sources
- 1.Regulation (EU) 2016/679 (GDPR), EUR-Lex Accessed .
- 2.Agencia Española de Protección de Datos (AEPD) Accessed .
- 3.Swedish Authority for Privacy Protection (IMY): file a GDPR complaint Accessed .
- 4.Código de Comercio, article 30 (BOE) Accessed .
- 5.Vercel Data Processing Addendum Accessed .
- 6.Vercel Privacy Notice Accessed .
- 7.Product Specific Schedule (Neon), last updated October 14, 2026 Accessed .
- 8.Databricks Data Processing Addendum Accessed .
- 9.Resend Data Processing Addendum Accessed .
- 10.Google Cloud Data Processing Addendum Accessed .
- 11.Porkbun Privacy Policy Accessed .
- 12.Vercel Web Analytics, privacy and compliance Accessed .