Privacy Policy

Effective October 11, 2026. This policy explains what 0-Doubt collects when you use 0-Doubt at 0doubt.ai, why, who can see it, how long we keep it, and what you can do about it.

1. Who we are

0-Doubt is a neutral research marketplace for IT and security products. Buyers evaluate vendors, vendors maintain their own profiles, resellers and analysts contribute coverage. For questions about this policy or your personal information, email [email protected]. For contract or legal questions, email [email protected].

2. What we collect

Account information. When you sign up we collect your email address, the domain of that address, and the account type you chose (Buyer, Vendor, Reseller or Analyst). If you set a password we store only a salted scrypt hash of it, never the password itself. If you sign in with Google, Microsoft or LinkedIn we receive the provider's stable user identifier and, where the provider gives it, your email address and whether the provider has verified it. For Microsoft we also receive your organization's tenant identifier. We store the identifier and the email address you signed in with. We do not store the provider access token, and we do not store your name from the provider.

Work email verification. Where an account is tied to a company, we ask you to confirm a work address through a link we send to that address. Only a completed confirmation counts as verification.

Content you create. This includes buyer projects, shortlists, evaluation criteria, weights, scores and decisions, questionnaire answers, private notes on vendors, saved searches, favorites, vendor watches, reviews you write, votes you cast on feedback, referrals you send, and documents you upload. Vendor, reseller and analyst accounts create profile, product, reference, coverage and document content.

Activity records. We record requests made to pages and the API: the time, method, path, response status, duration, IP address, browser user agent, and your account identifier if you are signed in. We also record security events such as sign-ins, failed sign-ins, sign-outs, sign-ups and rate-limit blocks, with a short reason code. We never record a password in these records.

Usage summaries. We keep one summary row per account per day on which the account was active, with a count of activity and of distinct features used. We also record a small number of named product actions, such as creating a project or sending an RFP, with the account type and company at that time.

Email engagement. For messages that are not security messages, our email provider reports whether a message was delivered, bounced, opened or clicked. Security messages, such as password resets and sign-in links, are sent with open and click tracking turned off.

Public information. To build vendor profiles we collect publicly available information about vendors and their products from vendor websites, public registries and filings, public code repositories, public DNS records, and news sources. This is mostly information about companies. It can include names and job titles of executives that appear on public pages.

3. How we use it

To run your account, sign you in, and keep you signed in for seven days after each sign-in.
To provide the features you use, including saved evaluations, notifications and email you ask for.
To protect the service: rate limits on sign-in and sign-up, detection of abuse, and an audit trail of changes made to content.
To publish neutral vendor profiles and comparisons. Personal information is not used to rank vendors.
To measure how the product is used, so we can fix and improve it.
To send you service email, and notification or digest email you have not turned off.
To meet legal obligations and respond to valid legal requests.

We do not use your information for targeted advertising, and we do not load advertising or third-party tracking scripts on the site.

4. What we do not do

We do not sell personal information. We do not license it to data brokers or other third parties, and we do not build exports or data products designed to make a secondary market in personal information possible. Buyer identity is private by default: a buyer's company is disclosed to a specific vendor only when the buyer chooses to reveal it, and the buyer can withdraw that reveal at any time.

5. Who can see your information

You and the people you invite. Projects can be shared with team members you add. Documents you upload are private to you unless you share them.
Vendors, when you reveal yourself. A vendor sees your company's domain, your organization name and the account contact on that reveal, and nothing else. Vendors never see your scores or decisions. Revealing is always a deliberate action for one vendor at a time.
Other buyers and visitors. Buyer reviews show only the buyer's company domain, never the reviewer's name or email address.
Our staff. Platform administrators can see account records to operate the service. An administrator can sign in as another user (impersonate) to investigate a problem, for up to one hour, and changes made during that session are recorded in the audit log with the administrator's identity.
Service providers. We use Cloudflare for network delivery and security in front of the site, and Resend to deliver email, through its API or SMTP. We host the application and its database ourselves. These providers process information only to provide their service to us.
Automated research. Some vendor research tasks use automated AI models to read vendor materials and propose profile content. Those tasks work on vendor and public information, and content produced this way is labeled as AI-generated on the site.
Legal reasons. We may disclose information when required by law, a court order or a valid government request, or to protect the rights and safety of people using the service.
Business transfers. If we are involved in a merger, acquisition or sale of assets, personal information may transfer to the new owner under the same commitments as this policy. We would tell you first.

6. How long we keep it

These are the periods in effect today. Retention periods for activity records can be changed by the operator within a fixed range, and we will update this page if the defaults change.

Account and content records: kept while your account is open.
Closed accounts: see section 7. Closing is a soft delete, so records that other content depends on are kept.
Raw activity records (requests and security events): deleted after 14 days.
Per-event product usage records: deleted after 400 days.
Daily account activity summaries and aggregated usage counts: kept so that long-term reporting stays accurate.
Audit log of changes to content, including the administrator identity where it applies: kept without a fixed end date, because it is the record that shows who changed what.
Saved evaluations that are not signed in: deleted 90 days after they were last opened.
Email records (the message we sent and the delivery events for it): kept to help us investigate delivery problems and for our own records.
Sign-in and OAuth cookies: see the Cookie Policy for lifetimes.

7. Your choices and rights

Access and correction. You can view and edit most of your profile and content from your account pages. For a copy of the personal information we hold about you, or to correct something you cannot edit yourself, email [email protected].
Email choices. You can mute individual notification types, and each notification and digest email has an unsubscribe link. Security email, such as password resets and sign-in links, cannot be turned off because the account depends on it.
Closing your account. You can close your account from your account settings. Closing signs you out everywhere and deactivates the account. Some records are kept as described in section 6.
Deletion. To ask us to delete your personal information, email [email protected]from the address on your account. We delete or anonymize personal information that we are not required to keep, and we tell you what we could not delete and why, for example audit-log entries that other records depend on.
Regional rights. Depending on where you live, including under the EU and UK General Data Protection Regulation and California law, you may have further rights to access, correct, delete, restrict or object to processing, and to receive a copy of your data. Email [email protected] to use them. We will respond within the time the applicable law requires, and we will not treat you differently for using a right.

8. Security

We use HTTPS, store passwords as salted hashes, store API and administrator tokens only as hashes, sign session tokens, check permissions on the server for every request, and rate-limit sign-in and other sensitive actions. Session tokens are invalidated when you change your password or sign out everywhere. No system is perfectly secure, so please use a strong, unique password and tell us promptly at [email protected] if you think your account has been misused. If we learn of a security incident affecting your personal information, we will notify you and the relevant authorities as the law requires.

9. Children

0-Doubt is a business service and is not directed at anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, email [email protected]and we will delete it.

10. Where your information is processed

0-Doubt is operated from the United States. If you use the service from another country, your information is transferred to and processed in the United States and in the other places where our service providers operate.

11. Changes to this policy

We may update this policy. We will change the effective date at the top of the page. If a change is material, we will tell registered users by email before it takes effect. Continued use of the service after a change means you have read the updated policy.

12. Contact

Privacy questions and requests: [email protected]. Legal questions: [email protected]. See also our Terms of Service and Cookie Policy.