Security and your data

What we store

• Your account: your work email, your firm name if you give it, your metros, and the emails of teammates you invite.
• What you send through the site: the email you give for a CSV or for next Monday's list, booking details (name, email, firm, note, time zone) and wrong-record notes.
• How you use the site and the app: pages, clicks, your browser, your IP address, and the campaign or website that sent you.
• The emails we send you, and whether each one was delivered, opened or clicked.
• Billing: once paid plans open, your Stripe customer and subscription status. You will type your card on Stripe's own checkout page, so your card number goes to Stripe and never reaches us. Source: Stripe docs, How Checkout works (opens in a new tab)
• No passwords. You sign in with a one-time code sent to your email.

The company records in the lists are public government records. We add nothing private about those companies. See where the data comes from.

Where it is stored

• Convex

  Our database and backend: accounts, metros, team, exports, form entries, the email log and server events.

  Where: United States: AWS US East (N. Virginia), region aws-us-east-1. Source: Convex docs, Regions (opens in a new tab)

• Fly.io

  Runs the servers for this site and the app.

  Where: United States: Ashburn, Virginia (region iad). Source: Fly.io docs, Regions (opens in a new tab)

• PostHog Cloud EU

  Usage analytics and session recordings for the site and the app.

  Where: European Union: Frankfurt, Germany. Source: PostHog docs, Data storage (opens in a new tab)

• Resend

  Sends our email: sign-in codes, the weekly list, trial notices.

  Where: United States. Source: Resend, Security (opens in a new tab)

• Stripe

  Will take payments when paid plans open. You will type your card on Stripe's own checkout page, so your card number goes to Stripe, not to us.

  Where: Stripe's own systems, certified PCI Service Provider Level 1. Sources: Stripe docs, Security (opens in a new tab); Stripe docs, How Checkout works (opens in a new tab)

Session replay

• We record sessions on this site and in the app with PostHog session replay: what you see, click and type. It shows us where people get stuck.
• Sign-in code fields, card fields, password fields and anything we mark as private are masked in your browser, so that content never leaves your device. Source: PostHog docs, session replay privacy controls (opens in a new tab)
• Other fields are recorded, including an email or ZIP you type.
• Recordings are kept for 30 days, then deleted (our PostHog project setting).

How it is protected

• This site and the app are served over HTTPS only.
• Team-invite and trial-claim links are random and stored only as a hash, so a copy of our database can't be used to open them.
• Only newlyraised staff can open account records, to give support.
• We get an email alert when someone starts a trial, books a call or reports a record, so a person can follow up.

What we never do

• We don't sell or rent your data.
• We don't share it with advertisers or data brokers.
• We don't add your email to any list you didn't ask for.

Deleting your data

Email hello@newlyraised.com from the address you use with us and say what to delete. We delete your account, team list, export history and form entries, and have PostHog delete your recordings and events, within 30 days. Then we confirm by email.

The lists themselves are built from public government records, so deleting your account doesn't change them.

More detail, including your rights and how long we keep what: Privacy.

Report a security problem

Email hello@newlyraised.com with "Security" in the subject. A person reads it and answers. The same contact is in our security.txt.