Privacy Policy

This Privacy Policy explains how Obtainer ("we", "us") collects, uses, and protects information when you visit our website or use our DSAR software. We aim to be plain and honest about what we do with data, which matters in a product built around handling personal data. Obtainer helps privacy, legal, and ops teams intake a data subject access request, discover the personal data they hold, draft a response, and track the deadline. Obtainer helps you comply; it is not legal advice, and you stay in control of what is disclosed.

Information we collect

When you create an account we collect your email address and a verification code we send to confirm it. If you contact us, we collect your name, email, and message. We also collect standard technical information such as your IP address, browser type, and the page that referred you, along with any UTM parameters in the link you arrived from.

Data you process through the service

When you use Obtainer to fulfill a data subject access request, you may process personal data about your own data subjects across the systems you connect. You are the controller of that data and we act as a processor on your behalf, using it solely to discover records, compile the manifest, draft the response, and provide the service under your instructions. Nothing is disclosed automatically: your team reviews, redacts, and approves before anything ships. Any sample requests, records, source systems, counts, and drafts shown on this site are illustrative only and do not represent a real discovery run or a connected system.

How we use information

• To create and secure your account and confirm your email.
• To provide the DSAR software, including discovery, drafting, deadline tracking, and the human redaction and approval gate, under your instructions.
• To respond to your messages and provide support.
• To understand how the site is used and improve it.

How we share information

We do not sell your personal information. We share information only with service providers who help us operate the site and platform (for example, email delivery, AI and infrastructure providers, and analytics), under contracts that require them to protect it, or where required by law. Higher tiers offer a Data Processing Agreement and support for Standard Contractual Clauses where applicable.

Data retention

We keep account and contact information for as long as your account is active or as needed to provide the service, then delete or anonymize it. You can ask us to delete your information at any time. You control the retention of the data you process through the service, subject to your own legal obligations.

Security

We describe our security as the posture we build to, not as a certification we are claiming to hold today. That posture includes encryption in transit and at rest, access controls, secure delivery of a completed response to the requester rather than raw email attachments, and data-residency options on higher tiers. If a specific control or region matters for your program, ask us before you rely on it.

Helps you comply, not legal advice

Obtainer automates the mechanics of a DSAR: intake, discovery, drafting, and deadline tracking. It is not legal advice. The legal judgments, such as which exemptions apply, what a valid identity check requires, whether a request can be refused, and your retention obligations, stay with your team. Nothing on this site or in the product guarantees compliance or a particular outcome, and you remain responsible for the disclosure decisions you make. All figures are in US dollars.

Your choices

You can access, correct, or delete your information, and you can opt out of non-essential email at any time. To make a request, email [email protected].

Contact

Questions about this policy? Email us at [email protected].