Privacy Policy

Effective date: September 25, 2026 Last updated: September 25, 2026

This Privacy Policy explains how Andover Analytics Inc., doing business as Andover Analytics ("Andover", "we", "us"), collects, uses, shares, and protects personal information when you visit andoveranalytics.co or use the Andover Analytics service (the "Service").

Andover is a business-to-business analytics product. Most of the information we handle is business information about companies, devices, and marketplace prices, not personal information about individuals. This policy covers the personal information we do handle.

1. Information we collect

Information you give us directly.

• Account information: name, email address, password (stored only as a hash), and organization name.
• Business intake information: when you create an account or apply for a higher tier, we ask about your business. Depending on the tier, this can include company name, business website, phone number, your role, the manufacturers and device conditions you handle, monthly buying and selling volume, payment methods and terms, typical payment timing, and your primary sales channels. Applicants for buyer or seller network access may also upload a sample price list.
• Communications: messages you send us by email, through a contact or application form, or through support.

Information collected automatically.

• Usage information: pages viewed, features and tools used, filters and devices selected, actions taken in the sample lab, referring page, approximate timestamps, and the outcome of those actions.
• Device and connection information: IP address, browser type and version, operating system, screen size, language, and similar technical details.
• Cookies and similar technologies: see Section 6.

Information from third parties.

• Payment information: our payment processor tells us your subscription status, the last four digits and brand of your card, billing country, and whether a charge succeeded. We never receive or store your full card number or security code.
• Authentication: if you sign in through a third-party identity provider, we receive the basic profile information that provider shares.

What we do not collect. We do not knowingly collect Social Security numbers, government ID numbers, bank account numbers, precise geolocation, biometric information, health information, or information about children.

Marketplace data is not personal information about you. The pricing data at the core of the Service is collected from publicly available third-party marketplace listings and describes devices and prices, not you. Where a public listing happens to include a seller's display name or handle, we do not use it to build a profile of that person and we do not publish it as part of the Service.

2. How we use information

We use personal information to:

• create and maintain your account and authenticate you;
• provide the Service and the features and data your tier includes;
• process payments, manage subscriptions, and send billing notices and receipts;
• evaluate applications for higher access tiers, including verifying that an applicant is a legitimate business;
• respond to your questions and provide support;
• monitor, secure, debug, and improve the Service, including understanding which features are used and where people get stuck;
• detect, investigate, and prevent fraud, abuse, credential sharing, unauthorized data extraction, and violations of our Terms;
• send service messages about your account, changes to the Service, or changes to our terms;
• send marketing messages, where you have not opted out, about features and offerings you may find useful; and
• comply with law and enforce our agreements.

Legal bases (for individuals in the EEA or UK). We process personal information to perform our contract with you, to pursue our legitimate interests in operating and securing the Service, to comply with legal obligations, and with your consent where required.

3. How we share information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We share personal information only as follows:

• Service providers. We use vendors to run the Service, and they may process personal information only on our instructions and only to provide their service to us. They currently include our cloud application host, our database and authentication provider, our payment processor, our email provider, and our analytics tooling. A current list is available on request at hello@andoveranalytics.co.
• Legal and safety. We may disclose information where we believe in good faith it is required by law, subpoena, or legal process, or is necessary to protect the rights, property, or safety of Andover, our users, or the public, or to investigate suspected fraud or violations of our Terms.
• Business transfer. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will give notice before your personal information becomes subject to a materially different privacy policy.
• With your direction. Where you ask us to share something, for example by connecting a third-party tool.

Aggregated and de-identified information. We create aggregated, statistical, and de-identified information from marketplace data and from how the Service is used, and we may use and license that information for any lawful business purpose, including selling market data products to third parties. This information describes markets, devices, and prices in aggregate. It does not identify you or your organization, and we do not attempt to re-identify it or permit others to do so.

4. How long we keep information

We keep account information for as long as your account is active and then for as long as reasonably necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Billing and tax records are kept for the period required by law, typically seven years. Application and intake information for tiers you were not granted is kept for 18 months and then deleted or de-identified. Usage logs are kept for 18 months. Aggregated and de-identified information may be kept indefinitely.

You can ask us to delete your account and associated personal information as described in Section 7.

5. Security

We protect personal information with measures appropriate to its sensitivity, including encryption in transit, encryption at rest for data held by our database provider, hashed passwords, access controls that limit internal access to those who need it, and server-side enforcement of what each account is permitted to read.

No system is perfectly secure. We cannot guarantee the security of information transmitted to or from the Service, and you provide it at your own risk. If we learn of a breach affecting your personal information, we will notify you as required by applicable law.

6. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand how the Service is used.

• Strictly necessary: authentication, session management, and security. The Service does not work without these.
• Analytics: to measure traffic and understand which features are used. We use first-party analytics that we operate ourselves, which means this usage information stays in our own systems rather than being shared with an advertising network.

We do not use advertising cookies and we do not permit third parties to track you across other sites through the Service.

Most browsers let you refuse or delete cookies. Blocking strictly necessary cookies will break sign-in. Because there is no consensus standard for how to respond to browser "Do Not Track" signals, we do not currently respond to them, but we do honor the Global Privacy Control signal as an opt-out of any sale or sharing, which we do not do in any event.

7. Your rights and choices

Regardless of where you live, you may:

• access the personal information we hold about you;
• correct inaccurate information, much of which you can edit yourself in your account;
• delete your account and personal information, subject to information we must retain by law;
• export a copy of the personal information you provided to us;
• opt out of marketing email using the unsubscribe link in any marketing message, or by emailing us. You cannot opt out of transactional messages about your account, billing, or security while you have an account.

To exercise any of these, email hello@andoveranalytics.co from the address on your account, or write to us at the address in Section 11. We will verify your identity before acting and will respond within the time required by applicable law. We will not discriminate against you for exercising these rights.

California residents. Under the California Consumer Privacy Act as amended, you have the rights to know, delete, correct, and to opt out of sale or sharing, and to limit the use of sensitive personal information. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not collect sensitive personal information as that term is defined. The categories of personal information we collect, our purposes, and the categories of recipients are described in Sections 1 through 3. You may designate an authorized agent to make a request on your behalf, with proof of authorization.

Other U.S. states. Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others, have similar rights of access, correction, deletion, portability, and opt-out, and a right to appeal a denied request. To appeal, reply to our response or email hello@andoveranalytics.co with "Appeal" in the subject.

EEA and UK residents. You additionally have the right to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with your supervisory authority.

8. International transfers

We operate in the United States and our service providers store and process information in the United States and other countries. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards such as standard contractual clauses.

9. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact hello@andoveranalytics.co and we will delete it.

10. Changes to this policy

We may update this policy. We will post the updated version with a new effective date, and if the change is material we will give account holders notice by email or in-product notice before it takes effect.

11. Contact us

Andover Analytics Inc. 7511 N 116th St, Omaha, NE 68142 hello@andoveranalytics.co