Privacy Notice

Last updated: November 4, 2026Version 3

This Privacy Notice explains how Teneo Labs Inc. ("Teneo", "we", "us") handles personal data in connection with the Teneo Live Web Data API, the dashboard and the website at livewebdata.com (the "Services").

The Services are offered to businesses only. This notice covers people who sign up for or use an account on behalf of a business, people who contact us, visitors to our website, and people whose personal data appears on public web pages we retrieve. Section 3a explains what we do with data about people who share their internet connection as participants in the Teneo Network (Network Participants). The privacy policy they accepted when joining the network covers everything else about them. Capitalized terms not defined here have the meaning given in our Terms of Service.

Questions and requests: [email protected]

1. Who is responsible

Teneo Labs Inc., 16192 Coastal Highway, Lewes, Delaware 19958, USA, is the controller for the personal data described in this notice. When we retrieve pages on a customer's instruction (Section 3), the customer is the controller and we act as its processor.

EU representative under Art. 27 GDPR: Euverify Limited, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23 AT2P, Ireland, [email protected]
UK representative under Art. 27 UK GDPR: Euverify Ltd, 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom, [email protected]

People in the EEA or the UK can also contact our representatives or submit requests through their secure portal.

2. Personal data we collect

2.1 Data you give us

Account data: name, email address and password (stored only as a hash).
Business and verification data: legal company name, company type, country, company website, company LinkedIn page, intended use case, expected volume and your description of the use case. For enhanced verification, also information about the company's legal existence, beneficial owners and authorized representatives, and documents you provide.
Billing data: billing contact and address. Card details go directly to our payment processor, Stripe. We receive only a payment reference, the payment status and amount, and limited card details such as brand and last four digits.
USDC payment data: if you pay through x402, the wallet addresses you link and use, and transaction details. Blockchain transactions are public and permanent, and we cannot change or delete them.
Communications: what you send us when you contact sales or support, report abuse or respond to our requests.

2.2 Data we collect automatically

API usage data: requests and their parameters, including the URLs you submit, country codes, channel (API, MCP or dashboard), request IDs, timestamps, status, errors, Credits used and latency, linked to your account and API Key.
Device and log data: IP address, approximate location derived from it, browser and device type, operating system, pages viewed and timestamps when you use our website or dashboard.
Sign-up attribution: when you sign up, we store with your account the referral and campaign parameters in the address of the sign-up page (such as ref, utm_source or utm_campaign), which of our websites and which link on it led you there, the page you landed on and the time. These details travel only in the link: we do not keep them in a cookie or other storage on your device. We use them to know which website or campaign led to the sign-up. Our legal basis is our legitimate interest in knowing which websites and campaigns bring us customers (Art. 6(1)(f) GDPR). We keep them as long as the account exists.
Cookies: we use only cookies and local storage that are strictly necessary to provide the website and dashboard, for example to keep you signed in and to secure the Services.

2.3 Data from others

Public sources we check ourselves, such as sanctions lists and company registers.
Stripe: payment and subscription status.
Public business information, such as your website or professional profiles, used to verify your business.

3. Personal data on pages we retrieve

Public web pages that customers ask us to retrieve can contain personal data published by others.

Retrieval for customers. We retrieve, convert and deliver pages on the customer's instruction. For this, the customer is the controller and we act as its processor under our Data Processing Addendum. Questions about how a customer uses a page should go to that customer.
Our request logs. URLs that customers submit can contain personal data, such as a name in a web address. We keep them in our request logs as controller, based on our legitimate interests in billing, security, abuse handling and legal compliance, for the period in Section 7.
Limits. We do not use retrieved pages to build profiles of individuals. We do not use Inputs or Output to train, fine-tune or evaluate artificial intelligence models, or give them to anyone else for that purpose.
Objections. Website operators can ask us at [email protected] to block their website. People whose data appears on a page can contact us at [email protected]. We assess each request and may block a page from future retrieval.

3a. Network Participants

We receive the connection data we need to route requests through Network Participants' devices, such as availability, country, connection type and IP address. We use it to route requests, measure the traffic each connection serves for rewards, secure the Services and handle abuse reports. We keep it in our request logs for up to 12 months. We do not give customers Network Participants' IP addresses. We route requests through these devices only over encrypted connections, so the devices cannot read the content of requests or pages. Websites contacted through a Network Participant's device see that device's IP address. Our legal basis is our legitimate interest in running and securing the Services.

4. Why we use personal data and our legal bases

The legal bases below apply where the GDPR, the UK GDPR or Swiss data protection law applies.

Purpose	Data	Legal basis
Create and run accounts, authenticate users, provide the Services and support	Account, business, usage and device data, communications	Contract; legitimate interests (running our business)
Review sign-ups, verify businesses and use cases, decide on access	Business and verification data, screening results	Steps before a contract; legitimate interests (preventing misuse and protecting the Teneo Network); legal obligation where screening is required by law
Billing, payments and accounting	Billing, USDC payment, account and usage data	Contract; legal obligation (tax and accounting)
Security, fraud and abuse prevention, enforcing our Terms, protecting the Teneo Network and its participants	Usage, device, account, verification and payment data	Legitimate interests (security, preventing harm); legal obligation where applicable
Service messages about accounts, security, billing and legal matters	Account data	Contract; legitimate interests
Knowing which of our websites or campaigns led to a sign-up	Sign-up attribution	Legitimate interests (knowing which websites and campaigns bring us customers)
Improving the Services with aggregated usage statistics	Usage and device data, aggregated or pseudonymized where possible	Legitimate interests (improving our Services)
Product news to business contacts	Name, business email	Legitimate interests, or consent where required; you can opt out at any time
Compliance, lawful requests and legal claims	All categories as needed	Legal obligation; legitimate interests (protecting our rights)

Where we rely on legitimate interests, we have weighed them against your rights, and you may object at any time (Section 9).

We do not sell personal data or share it for cross-context behavioral advertising. Our team reviews every sign-up. We may suspend API Keys automatically after repeated requests to restricted categories, and our team reviews any such suspension on request at [email protected].

5. Who receives personal data

Service providers that support us, such as hosting, database, content delivery, email and payment providers (including Stripe for card payments), and professional advisers such as lawyers and accountants. They are bound by confidentiality and data protection duties.
The Teneo Network. Requests are relayed through Network Participants' devices over encrypted connections. The devices handle the host name and IP address of the website contacted, but cannot read the content of requests or pages, and do not receive your identity, account details or API Keys.
Target websites receive our requests like any web request and receive no account information.
Authorities and others where the law or a court order requires it, or where necessary to detect, prevent or investigate fraud, abuse, security incidents or breaches of our Terms, or to protect the rights and safety of Teneo, Network Participants, customers or others.
A buyer or successor in a merger, acquisition, financing, reorganization or sale of assets, subject to confidentiality.
Others at your instruction or with your consent.

We may share aggregated or de-identified information that does not identify you.

6. International transfers

We host the Services mainly in the European Union. We also process personal data in other countries, including Singapore and the United States, and our team and service providers may access it from other countries. Where we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents. You can ask for a copy at [email protected].

7. How long we keep data

Data	Retention
Account and business data	Life of the account plus up to 3 years, longer if needed for legal claims
Sign-up attribution	Life of the account
Verification and screening records	As required by law, otherwise up to 5 years after the relationship ends
Billing and tax records	As required by tax and accounting law, typically 7 years
API usage data and request logs	12 months, then deleted or aggregated, unless needed longer to investigate abuse or a security incident
Pages retrieved for customers	Deleted shortly after delivery
Sales and support communications	Up to 3 years after the last contact
Blockchain transactions	Permanent on the public blockchain; our own records as for billing data

8. Security

We protect personal data with technical and organizational measures, including encryption in transit, hashed passwords and API Keys, access controls and logging. No system is completely secure. Tell us immediately at [email protected] if you think your account or API Keys are compromised.

9. Your rights

Depending on where you live, you may have the right to access your personal data and receive a copy, correct it, delete it, restrict or object to its processing (including processing based on legitimate interests and direct marketing), receive it in a portable format, and withdraw consent at any time without affecting earlier processing. You may also complain to the data protection authority where you live or work, or in Switzerland to the Federal Data Protection and Information Commissioner.

U.S. state privacy rights. If you live in a U.S. state with a comprehensive privacy law, you may have rights to know, access, correct and delete personal data and to opt out of its sale, sharing or use for targeted advertising. We do not sell or share personal data as those laws define these terms. We will not discriminate against you for using your rights, and you may use an authorized agent where the law allows.

To use your rights, write to [email protected] or contact our EU or UK representative (Section 1). We may need to verify your identity. If you use the Services for a business, some requests may need to go through your organization's account owner. For personal data on pages we retrieved for a customer, we forward your request to that customer where we can identify it and help it respond.