Privacy Policy

Buyer Lookup is a Chrome extension and web app that helps Upwork freelancers understand the clients behind anonymous job posts. This policy explains what we collect, why, who we share it with, and the choices you have. We keep it short and plain.

What we collect

• Account information. When you sign in, our authentication provider (Clerk) stores your email address and name. We use this to identify your account, manage your credit balance, and send service email.
• Payment information. Purchases are processed by Stripe. We never see or store your card details — Stripe handles them directly. We keep a record of your purchases and credit balance.
• Upwork client & contract data. When you open an Upwork job and unlock or refresh a buyer, the extension reads the publicly visible client work history on that page — the buyer's contracts, the rates and amounts paid, dates, the public reviews on those contracts, and the names of the freelancers shown — and sends it to our backend to build the buyer dossier. This data is about business clients and their public hiring history, not about you. See “Shared contract corpus” below.
• Usage analytics. We record product events (e.g. a dossier was opened, a buyer was unlocked) tied to your account identifier, to understand usage and improve the product. We do not use autocapture or session recording, and we do not collect the content of pages you visit for analytics.
• Extension storage & session. The extension keeps a long-lived sign-in token and small onboarding flags in your browser's local storage. To create that token, it reads your existing Buyer Lookup session cookie on buyerlookup.app once after you sign in — it does not read cookies for any other site.

The browser permissions we use

• storage — keep you signed in and cache small UI state locally.
• cookies — read your own Buyer Lookup session on buyerlookup.app to mint your extension sign-in token.
• alarms — periodically refresh the unread-notification count on the toolbar icon.
• Host access — www.upwork.com (to read job/client data on pages you open) and buyerlookup.app (our own API). The extension runs only on Upwork job and search pages.

What we do not do

• We do not sell your personal data.
• We do not track your browsing outside Upwork job/search pages.
• We do not collect biometric or facial data, and we do not try to deanonymize private individuals — our subject is business buyers and their public hiring record.
• We do not store your passwords or payment card numbers.

How we use your data

• To provide the Service — authenticate you, manage credits, build and refresh buyer dossiers, and notify you about buyers you track.
• To improve the product, using aggregate usage analytics.
• To process payments and send service-related and digest email.
• To prevent abuse and enforce our Terms.

AI processing

To build a dossier we send the buyer's public contract and review text, and the buyer's public job history, to our AI provider (OpenAI), which summarizes reviews, categorizes work, and infers the likely company behind an anonymous buyer. This output is inferred and may be wrong — identity is a best-effort probabilistic guess, and summaries are estimates, not statements of fact. We do not send your personal account information to these providers for this purpose.

Shared contract corpus

The public client work-history that freelancers contribute powers a shared dossier that all users benefit from — that is the core of how the product works. This corpus is business-client data scraped from public Upwork pages and can include the names of freelancers a client hired and the public review text on those contracts. It is not your personal information; your contributions are attributed to your account only for integrity and abuse-prevention. We surface identity and contacts conservatively and withhold a company name when our confidence is low.

Identifying a client is enrichment, not disclosure

Elsewhere we describe the product as decoding or deanonymizing the client. Read plainly here: that is marketing shorthand for enrichment, the same operation any business-data provider performs when it completes a partial record from public sources.

An Upwork posting omits the company. We do not obtain the missing name from Upwork, from any private source, or from anywhere behind a login that is not the user's own. We compare what the posting shows with information already public elsewhere and infer the most likely match, with a confidence grade attached. A name we publish is therefore our conclusion about a business, not a record disclosed to us, and we withhold it when confidence is low.

We describe companies acting as buyers of professional services, which in most jurisdictions is business information rather than personal data. Sometimes the line does not hold: a client may be a sole trader or an individual, and then the company name is also their name. We treat that as personal data. If you are that person, write to [email protected] and we will remove the record. A person handles the request; we do not ask you to justify it and we do not charge for it. We will also add you to our exclusion list so that later passes do not re-derive the same record, and we will confirm to you when both are done.

Buyer tracking & notifications

When you unlock a buyer we also start tracking it for you, so we can tell you when that buyer posts a new job, gains new contracts, or when our confidence in its identity firms up. These alerts appear in the app and on the toolbar badge; email digests are opt-in and you can turn them off (or stop tracking a buyer) at any time in your settings.

Service providers

We share data with these processors solely to operate the Service:

• Clerk — authentication.
• Stripe — payments.
• OpenAI — generating dossier summaries and inferring buyer identity from public contract/review/job data.
• Apify — fetching a buyer's public Upwork data when it isn't already on file.
• The Companies API — company firmographics for identification.
• PostHog — product analytics.
• Resend — transactional and digest email.
• Hetzner — server hosting (EU).

Your choices

• You can request access to, or deletion of, your account data by contacting us.
• You can uninstall the extension at any time, which stops all collection.
• You can opt out of email digests, or stop tracking any buyer, from your settings.

Data retention

We retain account and usage data while your account is active. If you ask us to delete your account, we remove your personal data; the business-client contract corpus, which is public Upwork data and not your personal information, may be retained as part of the shared dataset.

Contact

Questions or data requests: [email protected].