WhoUsesThat

Privacy & cookies

Last updated September 21, 2026.

This notice describes information handled by WhoUsesThat when you browse the directory, create an account, contribute, manage a company, send an inquiry or use Premium. Company directory records and private account information have different visibility.

Information we collect and why

• Accounts: your name, email address, password hash, verification status, sign-in sessions and account security records. Google sign-in supplies your Google account identifier and basic identity information to authenticate or link your account. We do not request access to your Gmail messages.
• Contributions and company management: submitted company details, relationships, sources, descriptions, uploaded logos/images, claims, team invitations, corrections, flags and category suggestions. We use these to operate the directory, establish editing permissions, prevent abuse and review disputed records. Public profile and relationship content can be read and copied by visitors.
• Inquiries: your account name, email address and message are shared with authorized owners of the recipient company when you expressly agree to send the inquiry. These messages remain in the site's private inbox; a reply is not guaranteed. Do not include sensitive personal information or confidential business documents.
• Billing: company/subscription identifiers, plan, payment status, invoice-related status, trial dates and billing audit records. Stripe collects payment and billing details through its hosted pages. WhoUsesThat does not store your full card number or security code.
• Security and service operation: requests necessarily expose technical information such as IP addresses and browser information to the server and hosting provider. We use sessions, request validation, rate limits and audit records for security and reliability. Hosting and application logs may contain technical request information.

Natural-language search

When AI-assisted search is enabled, search questions that our built-in rules cannot interpret may be sent to TypeSafe together with relevant public company, product and category names. TypeSafe helps turn the question into directory filters; the results come from our recorded relationships. We do not include private account, billing or inquiry records in these requests. Do not include confidential information in a search. Keyword-only search bypasses TypeSafe. Interpreted answers may be cached for up to one hour; browser history and server request logs may also contain search URLs.

Optional analytics and company reports

With your analytics permission, our own analytics record views, map interactions, website/source clicks, page type, approximate referral channel, timestamps and the companies or relationships involved. A random browser identifier is stored in a cookie; its keyed hash supports approximate unique-browser counts. These counts describe browsers, not verified people. We do not save raw search text or raw referral URLs in these event records.

Authorized company members can see aggregate reports about their company. Premium adds longer ranges and exports. Reports do not reveal individual visitor names, email addresses or browsing histories. An inquiry is different: the recipient's authorized owners see the contact information and message you explicitly sent. Completing an inquiry is counted as an operational action even without optional analytics permission.

When enabled and you accept analytics, Google Analytics receives coarse page types and interaction categories. We do not intentionally send account identities, inquiry text, search text, company identifiers or actual record URLs as analytics fields. Google still receives browser/network information when its code loads and uses its own identifiers. See how Google uses information from partner sites and Google's privacy policy.

Cookies and your choices

• Essential cookies support sign-in, sessions and request security. Blocking them can prevent account features from working.
• wut_analytics_choice remembers your analytics choice for up to 180 days.
• wut_analytics_browser identifies a consented browser for up to 90 days. Rejecting analytics removes it.
• When Google Analytics is enabled with permission, its dedicated wut_ga* cookies are configured for up to 90 days without sliding expiry.

Use Analytics settings at the bottom of any page to accept, reject or withdraw optional analytics. Essential account functions remain available either way. The current analytics implementation honors detected Global Privacy Control and Do Not Track signals by preventing optional collection. Withdrawal stops future collection; it does not recall information already sent or automatically erase previously aggregated counts.

Service providers and other recipients

We use Hostinger for hosting, Resend for transactional email, Google for optional sign-in and analytics, and Stripe for hosted payment services. Information needed for those functions is processed by those providers. Authorized administrators access records to operate the site and handle support. We may also disclose information when required by law or necessary to investigate abuse, protect rights or secure the service. These services may process information outside your country.

External source links and company websites have their own privacy practices. Display advertising through Google AdSense is planned, but is not currently enabled. The advertising policy explains the planned placements; ad-specific disclosures and consent choices must be in place before ads begin.

Retention

The analytics cleanup is designed to remove processed raw events after 90 days, browser-presence records outside the most recent 90 calendar days, and aggregate daily counts older than 13 calendar months. Cleanup depends on successful scheduled processing; unprocessed events are retained until processed. Google account-level retention is configured separately and is not controlled by these database limits.

Account records, inquiries, public directory content, audit history, billing and trial records have separate operational retention and are not removed by analytics cleanup. We retain information needed to provide the service, maintain directory evidence, resolve disputes, prevent abuse and meet applicable obligations. There is no automatic account/inquiry deletion schedule in the current build. Expired Premium presentation is hidden while saved content is retained for restoration.

Access, corrections and deletion requests

Contact us to request access to, correction of or deletion of your personal information, or to raise a privacy concern. We may need to verify your identity and authority before responding. Depending on your location, applicable law may provide additional rights, including objection, restriction, portability or a complaint to a privacy regulator. Information needed for legal obligations, security or legitimate recordkeeping may need to be retained; we will explain relevant limitations. Public business facts and other people's contributions are considered separately from your private account.

This is a business directory, not a service directed to children. If you believe a child has provided personal information, contact us so we can investigate. We update this notice when relevant practices change and show the revision date above.

Questions or requests

WhoUsesThat is operated by Allen Taylor Watts, based in Texas, USA.

Email whousesthatcom@gmail.com. Include the relevant page link and enough information to understand your request. Never send passwords, verification codes, API keys or full payment-card details.