Privacy Policy & Data Protection Commitments

1. Scope and Service Architecture

Hunter Data LLC ("Hunter Data," "Hunter," "we," "us," or "our") provides enterprise-grade entity resolution, sanctions screening, politically exposed person (PEP) detection, adverse media investigation, and counterparty risk analysis via the Hunter Gateway REST API and web user interfaces.

This policy applies to data submitted by subscribing financial institutions, banks, fintechs, government bodies, and commercial enterprises ("Subscriber") and their authorized administrative and screening users. For subscribers operating under a Master Services Agreement (MSA), Schedule B (Data Processing, Privacy, and Security Commitments) governs the processing of in-scope Customer Data.

2. Ownership and Processing of Customer Screening Data

We adhere to fundamental enterprise privacy principles:

• Zero Sale of Data: Hunter Data does not sell, rent, commercialize, broker, or trade personal data or customer screening queries.
• Zero Public AI Model Training: Customer screening payloads, entity names, transaction data, and investigation notes are never used to train, retrain, fine-tune, or reinforce shared, multi-tenant, or public foundation artificial intelligence models.
• Strict Purpose Limitation: Customer Data is processed solely to perform requested sanctions, PEP, regulatory enforcement, and adverse media matches, return match scores, maintain cryptographic audit trails, and deliver customer-directed screening exports.

3. Information We Collect

3.1 Institutional Account and Contact Information

During enrollment, procurement verification, and platform administration, we collect:

• Legal institution name, formation jurisdiction, and physical headquarters delivery address.
• Primary corporate contact email address, telephone number, and Accounts Payable (AP) billing email.
• Authorized signer full legal name, corporate title, and electronic onboarding assent records.
• Administrative usernames, cryptographic password hashes (bcrypt), and role-based access control assignments.

3.2 Screening Payloads and Subject Information

In the course of screening operations via Web UI, Drag-and-Drop batch processing, or REST APIs, Subscribers submit search records which may include individual or entity names, aliases, corporate registration numbers, tax identifiers, dates of birth, addresses, and transaction screening metadata.

3.3 Technical and Audit Telemetry

To maintain system security, detect unauthorized access, and satisfy institutional compliance audits, we generate immutable audit records capturing: Request ID, UTC timestamp, originating IP address, user identifier, match score, watchlist version, and applied matching configuration rules.

4. Security and Cryptographic Controls

Hunter maintains comprehensive administrative, physical, and technical safeguards proportionate to financial crime risk and institutional compliance standards:

• Transit Encryption: All data in transit across public networks is secured using modern TLS 1.3 (with TLS 1.2 fallback) utilizing strong forward-secrecy cipher suites.
• Rest Encryption: All persistent databases, search indexes, log repositories, and storage volumes are encrypted using AES-256 with managed cryptographic key rotation.
• Logical Tenant Isolation: Every tenant operates within logically segregated database namespaces and access-controlled schemas to prevent cross-tenant data leakage.
• Access Control: Administrative access enforces least-privilege principles, unique workforce identities, and mandatory multi-factor authentication (MFA) for privileged environments.
• Vulnerability Management: Continuous automated vulnerability scanning, independent penetration testing, and prompt remediation of critical exposures.

5. Approved Subprocessors and Infrastructure

Hunter Data utilizes vetted, enterprise-grade cloud service providers operating exclusively in United States data centers:

• Amazon Web Services (AWS) Inc.: Cloud hosting infrastructure, secure virtual private clouds (VPC), and AWS KMS encryption management (US-East Region).
• MongoDB Enterprise Atlas: Logical persistence, database indexing, and tamper-evident audit logging (US-East Region).
• PayPal, Inc.: PCI DSS Level 1 compliant payment processor for corporate payment and deposit authorization. (Full card details and payment credentials are handled directly by PayPal's secure infrastructure and never stored on Hunter Gateway servers).

6. Data Retention, Export, and Deletion Schedules

Customer Data is retained strictly in accordance with regulatory mandates and customer instructions:

• Statutory Recordkeeping: Completed screening payloads and audit records are retained for seven (7) years to satisfy Bank Secrecy Act (BSA), AML, and OFAC recordkeeping requirements.
• Temporary Processing Artifacts: Transient processing caches and memory queues are purged within ninety (90) days.
• Post-Termination Purge: Upon contract termination, Subscribers are provided a thirty (30) day export window to extract full screening logs and historical reports. Following the export window, all active customer records are purged from production systems within thirty (30) days. Backups expire within ninety (90) days.

7. Regulatory Cooperation and Supervision

Hunter Data understands that our institutional clients are regulated financial entities subject to oversight by agencies including FinCEN, the OCC, the Federal Reserve, the FDIC, the SEC, FINRA, and state banking authorities. Hunter cooperates fully with lawful supervisory requests and examinations concerning the Services without imposing conditions that conflict with regulatory authority.

8. Data Subject Rights & DSARs

When Hunter processes Customer Data on behalf of a Subscriber, the Subscriber acts as the data controller. Any Data Subject Access Requests (DSARs), correction inquiries, or deletion demands received by Hunter are referred directly to the applicable Subscriber within three (3) business days. Hunter provides reasonable technical assistance to Subscribers to satisfy verified consumer and data subject rights under applicable data protection laws (including CCPA/CPRA, GDPR, and UK GDPR).

9. Security Incident Notification

In the event of a confirmed Security Incident involving actual unauthorized access to or compromise of Subscriber Customer Data, Hunter will notify affected Subscribers without undue delay, and in any event within twenty-four (24) hours after confirmed awareness. Initial notification will include available facts, affected data categories, known containment steps, and an assigned incident commander contact.

10. Contact Information & Privacy Office

For questions, notices, or inquiries regarding this Privacy Policy or our data protection architecture, please contact our privacy and legal office: