Privacy policy
Effective date: 10 August 2026.
What this covers
This is the only privacy policy for Inveo. It applies to everything we run: the website and articles at inveo.io, the carrier and broker directory, the knowledge base, and the signed-in application at app.inveo.io. There is one company behind all of them and one policy, so you do not have to work out which document governs which page.
What we collect
Without an account: standard server logs, meaning IP address, pages requested, and timestamps. We use these for security and capacity, not to build a profile of you.
With an account: your email address, your name if you provide one, and usage records such as lookups, searches, watchlist entries, and exports. These are kept per organisation.
If you contact us: whatever you put in the form or the email, kept so we can answer you and keep a record of the conversation.
Cookies
Signing in sets an authentication cookie scoped to inveo.io and its subdomains. It has to be readable across them, because being signed in on the application also changes what you see on a public company page. Clearing it signs you out.
If you leave a comment on an article, you may choose to save your name and email in a cookie so you do not retype them. That is your choice and it lasts a year.
Analytics, and association with your account
When analytics tracking is enabled, a cookie records which pages you visit on inveo.io. If you later create an account, browsing history recorded by that cookie from before you signed up is associated with your account identity. That includes which company pages you viewed and when.
We use this to understand what visitors need and to decide what to build next. You can decline the tracking cookie in the consent banner, and declining does not limit your use of the site in any way. We are telling you this plainly because retroactive association is the part people are not usually told about.
Company records are not personal data
The directory republishes public regulatory records about businesses. Names, addresses, and phone numbers that appear in those records were published by the issuing agency as business records, and we republish them as we received them, with the date we retrieved them.
If a fact in a public record is wrong, the correction belongs with the agency that issued it. If we matched a record to the wrong company, that is our error and we fix it when it is reported.
Who we share data with
We use Supabase for the database and authentication, Cloudflare for hosting and content delivery, Resend for transactional email, and HubSpot for customer relationship management and, when enabled, analytics. Each one processes data only to provide its service to us.
We do not sell personal data, and we do not share it for anyone else’s advertising.
Embedded content from other sites
Articles may embed content such as videos or images from other websites. Embedded content behaves as though you had visited that other site directly, and that site can set its own cookies and track your interaction with it. We do not control what they collect.
How long we keep it
Account data is kept while the account exists. Cancelling a paid plan keeps the account on the free tier rather than deleting it. Server logs are kept only as long as they are useful for security and capacity work. You can ask us to delete your account and personal data by email, and we will complete it within 30 days.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to erase it. Write to the address below and we will act on it. The only things we will not delete are records we are required to keep for legal or security reasons, and we will tell you if that applies.
Public regulatory records about a business are not personal data about you, so a deletion request does not remove a company from the directory. See the section above on where those records come from.
Transactional email, meaning sign-in links and the alerts you configured yourself, goes to account holders. Marketing email, where we send it, carries an unsubscribe link and our postal address, and stops when you unsubscribe.
Changes to this policy
If we change this policy we will change the effective date at the top. If a change materially affects what we collect or who we share it with, we will say so rather than quietly reissuing the page.
Contact
Privacy requests and questions: william@inveo.io. A postal address is available on request while the public business address is being finalised.
See also Terms of service and Data sources and methodology.