Privacy Policy.

1. Who we are

placement.solutions is a B2B legal-hiring data API. The service is operated by JMS Talent Acquisition LLC, a New York limited liability company ("placement.solutions", "we", "our", or "us"). Our service surface is api.placement.solutions and the customer dashboard at app.placement.solutions. Where this policy refers to "the service", it refers collectively to those properties and the underlying API endpoints documented at docs.placement.solutions.

For all privacy questions or rights requests, the data protection contact is hunter@placement.solutions. For commercial or contract questions, write to hunter@placement.solutions.

2. What data we collect

We collect only what is necessary to operate, secure, bill, and support the service. Specifically:

2.1 Account and billing data

• Identifiers you provide at signup or on an order form: company legal name, billing address, billing contact name, billing contact email, technical contact name, technical contact email.
• Tax identification numbers where required by law (for example W-9 or VAT numbers).
• Payment instrument metadata processed by Stripe. We do not store full card numbers on our infrastructure. We retain the last four digits, the card brand, and the Stripe customer and payment-method identifiers.

2.2 Service usage logs

• Authenticated API call metadata: timestamp, key prefix, route, response code, response size in bytes, latency, source IP, and user agent.
• Dashboard session metadata: login time, session length, dashboard pages viewed, IP, user agent.
• Webhook delivery logs: destination URL, payload size, response code, retry count.

2.3 Customer-provided data

• Configuration you save in the dashboard: webhook URLs, IP allowlists, role assignments, saved query filters, custom field mappings for CRM connectors.
• Support correspondence you send to us at hunter@placement.solutions or through the in-app chat, including any files you attach.

2.4 What we do not collect

We do not ingest your candidate database, your CRM contacts, or any third-party PII you control. The data our API returns is professional firm-and-role information we collect, license, and curate as our product. That index data is not customer-supplied; you do not become a controller of it by querying it.

3. Why we collect it

Each category above maps to a defined purpose:

• Authentication and authorization. We use account identifiers and key metadata to verify that requests come from your organization and from the seats your administrator has provisioned.
• Billing. We use billing data and usage counters to invoice or charge you under your subscribed tier.
• Usage analytics. We use call-level metadata to compute fair-use, debug rate-limit issues, surface adoption metrics in the dashboard, and improve the service. Aggregate usage counters never identify natural persons.
• Support. We use correspondence and session metadata to triage and resolve issues you raise.
• Security. We use IPs, user agents, and request patterns to detect credential stuffing, scraping of API responses by terminated keys, and other abuse.
• Legal compliance. We retain records as required to satisfy tax, audit, regulatory, and law-enforcement obligations applicable to a New York LLC operating in the United States.

4. Where data is stored

All customer-provided data, account data, and service logs are processed and stored in the continental United States. We do not replicate or back up customer data outside the United States.

Our production data infrastructure is operated by a defined set of subprocessors. The current list is published at subprocessors.html and includes only the parties named in section 6 below. We update the subprocessor list with thirty (30) days advance notice as described in our Data Processing Addendum (DPA §7).

5. How long we keep it

Default retention by category:

Category	Retention	Notes
Account and billing data	Active subscription + 12 months	Then permanent deletion, except where tax law requires longer retention of invoices (typically 7 years).
Usage logs (per-call metadata)	13 months rolling	Then automatic deletion. Aggregate counters survive in anonymized form.
Webhook delivery logs	30 days	For replay and debugging only.
Support correspondence	Active subscription + 12 months	Including attachments.
Backups	35 days rolling	Daily encrypted backup with point-in-time recovery within the 35-day window.

If you cancel your subscription, we delete account, configuration, support, and per-call log data within ninety (90) days of the effective cancellation date. Backups age out within the rolling 35-day window after that. Tax records survive for the period mandated by US federal and New York state law.

6. Who we share it with

We share customer data only with the following categories of recipient:

6.1 Subprocessors

Our complete subprocessor list is published at subprocessors.html. As of the effective date, our subprocessors are: Cloudflare (WAF and DNS), Fly.io (compute), Neon (Postgres), Upstash (Redis), Stripe (billing), Postmark (transactional email), Resend (marketing email), Sentry (error monitoring), Axiom (log storage), Mintlify (documentation hosting), and BetterStack (status page). Each subprocessor is bound by a written data processing agreement that obligates them to standards no less protective than those described in our DPA.

6.2 Law enforcement and legal process

We disclose customer data to law enforcement, regulators, or other third parties only when compelled by valid legal process directed at placement.solutions, and only the minimum data responsive to that process. Where not legally prohibited, we notify the affected customer before disclosing.

6.3 Corporate transactions

If we are acquired, merge with another entity, or sell substantially all assets of the placement.solutions service, customer data may be transferred to the acquirer, subject to the same privacy commitments. We will notify customers in writing at least thirty (30) days before any such transfer becomes effective.

We do not sell, rent, or trade customer data. We do not share customer data with advertisers or data brokers. Period.

7. Your rights

Depending on where you reside, you may have rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), or analogous state privacy laws. We honor the following rights for any customer regardless of jurisdiction:

• Right of access. You may request a copy of the personal data we hold about you.
• Right of rectification. You may correct inaccurate personal data through the dashboard or by contacting hunter@placement.solutions.
• Right of deletion. You may request deletion of your personal data, subject to the retention overrides described in section 5 (for example, tax law).
• Right of portability. You may request a machine-readable export of the configuration and account data you have provided to us.
• Right to object. You may object to processing based on legitimate interest by writing to hunter@placement.solutions.
• Right of restriction. You may ask us to restrict processing while a dispute is pending.

We will respond to verified rights requests within thirty (30) days. We do not charge a fee for the first rights request in any twelve-month period. If a request is manifestly unfounded or excessive (for example, repetitive identical requests), we may charge a reasonable administrative fee or decline to act, and we will explain why.

Customers in the European Economic Area or the United Kingdom have the right to lodge a complaint with their supervisory authority. Customers in California have the right to non-discrimination for exercising any privacy right.

8. Cookies

We use only functional and analytics cookies. Functional cookies hold session state for the dashboard. Analytics cookies are first-party and feed our internal usage dashboards. We do not use advertising cookies. We do not run third-party advertising or retargeting scripts on api.placement.solutions, app.placement.solutions, or any of our marketing pages.

9. Children

The service is not directed to anyone under sixteen (16). We do not knowingly collect personal data from anyone under sixteen. If you believe a person under sixteen has provided us personal data, contact hunter@placement.solutions and we will delete it.

10. AI training disclaimer

We do not train models on customer queries, customer-provided data, or the records the API returns to you. The models that power our index pipelines (entity resolution, deduplication, taxonomy classification) are trained separately on data we collect, license, or generate ourselves. Customer requests are not exposed to those training pipelines and are not used to fine-tune or improve any model that is shared across customers.

If we ever introduce optional features that use customer data for model improvement, we will require explicit, opt-in consent in your dashboard and we will document the change in this policy with at least thirty (30) days advance notice before activation.

11. Contact for privacy requests

For any rights request, complaint, or question about this policy: hunter@placement.solutions. Postal mail may be sent to JMS Talent Acquisition LLC, attn. Privacy, address available on request from hunter@placement.solutions for verified customers.

12. Effective date and change history

This policy is effective 2026-05-06 and replaces all prior versions. Material changes are posted at this URL with at least thirty (30) days advance notice. Non-material changes (clarifications, typo fixes) are posted immediately and noted in the change log below.