Information we collect

When you request access, we collect your name, email address, domain, email-verification status, Terms acceptance version and time, and account and key metadata. The active key record contains a hash and short prefix for identification. A temporary encrypted copy is held for email delivery; the full key is shown once and emailed to you.

For authenticated API calls, we store the query and response, request time, endpoint, status, duration, and usage information so you can inspect logs and we can enforce limits. We redact common email addresses and phone numbers before storing request details, but other personal information may remain in a query. Please avoid putting sensitive personal information in property searches.

For every search, from the API or the public playground, we also keep a parse record: the query with common email addresses and phone numbers redacted, its language, and the filters and unresolved phrases we returned. Parse records do not include your IP address. In the playground, a search is counted and stored when you run it. Previews shown while you type have a separate short-term limit per IP, are not counted toward the daily allowance, and are not stored.

For signup and the public playground, we keep short-lived, hashed IP-based counters to limit abuse. We also keep account block status, administrator reasons, and email-pattern block rules to prevent automated account creation and misuse. Contact messages include the details you submit. Cloudflare may also process network and security data when delivering the site or checking a Turnstile challenge.

How we use it

We use this information to verify your email, deliver keys and sign-in links, run the API, show account logs and usage, respond to messages, prevent abuse, and keep the service secure. We use parse records to measure and improve how well searches are interpreted, including building evaluation sets. We do not sell account details or use query text for advertising. We do not send marketing emails from this service.

Providers and transfers

Cloudflare hosts and protects the service and provides email delivery, Turnstile, and admin Access. Turnstile checks whether a form submission appears automated; see Cloudflare’s Turnstile Privacy Addendum. Email delivery also involves the recipient’s mail provider. Cloudflare’s network may process information in different countries.

Nabdaq interprets searches with its own parser, which runs on Cloudflare. If part of a search cannot be interpreted with confidence, the search text and the unresolved phrase may be sent to a language model on Cloudflare Workers AI to propose a refinement. Cloudflare states that it does not use Workers AI customer content to train AI models or to improve Cloudflare or third-party services without explicit consent; see Your Data and Workers AI. Searches made before 24 September 2026 were interpreted by Queryfill and remain subject to its retention settings. Do not include sensitive personal information in a search.

PostHog, hosted in the European Union, provides our product analytics. From the website, through nabdaq.dev, which forwards it, it receives how pages are used (pages viewed, clicks, form submissions and errors, and, where enabled, session recordings with typed text masked) and, when you are signed in, your account ID, name and email address, so we can see how the service is used and fix problems. For language-model refinements it receives only timing and usage counts, not the search text; see PostHog’s privacy policy.

Cookies and retention

A necessary nb_session cookie keeps you signed in for up to 30 days. Cloudflare may use necessary security and Access cookies, including an admin Access session of up to eight hours. PostHog stores an analytics identifier in a first-party cookie and in local storage for up to a year. We do not use advertising cookies. After you pass the bot check, the playground keeps a 30-minute verification token in the page’s memory, not in a cookie, so later searches do not need another check.

Account API request details are kept for up to 30 days. Parse records are kept for up to 30 days. Refinement requests, which include the search text, are kept for up to 7 days. Cached refinement results contain no search text and expire automatically. Abuse counters are removed after about 24 hours. Verification and sign-in links expire after 20 minutes. Encrypted key-email content is removed after successful delivery or an undelivered 24-hour expiry; delivery-job metadata is removed after about seven days. Account records and contact messages do not currently have automatic expiry. We retain them while needed to operate the service or respond to you, and review deletion requests subject to applicable obligations.

Your choices

You can inspect your request history in the dashboard and revoke or replace a key there. Use the contact form to ask about your data or request access, correction, or deletion. We may need to verify your identity before acting on a request. We may retain limited records where required for security or legal obligations.

Changes

We will update the date on this page when the policy changes. Material changes to data handling will be described here before they take effect.