Privacy Notice

Effective October 21, 2026

This Privacy Notice explains how J&T Solutions Inc., a Delaware corporation doing business as Diced, 251 Little Falls Drive, Wilmington, DE 19808, United States ("Diced", "we", "us"), handles personal information.

Summary

• Diced is a data broker. We license information about consumers and professionals in the United States from third-party sources and sell it to businesses for marketing and sales. Under California law and other state laws, that is a "sale" of personal information.
• This notice covers two groups. Part A covers the people in our data, who usually have no direct relationship with us. Part B covers our customers, their users and visitors to our websites.
• You can opt out, delete or see your information. Use our privacy request page or email legal@diced.si. We do not charge for requests, and we will not treat you differently for making one.
• We do not sell or share information about our customers, users or website visitors. Our websites use no advertising or analytics cookies.

Data broker notice

J&T Solutions Inc., doing business as Diced, is a data broker. We collect and sell personal information about people who are not our customers and with whom we have no direct relationship.

We are registered, or will be registered before we sell data about residents of those states, as a data broker in California, Texas, Oregon and Vermont. [CONFIRM: registration status and numbers for each state before publishing. Texas requires a specific data broker notice on the website. Confirm the exact required wording and placement, and add "NOTICE: We may sell your sensitive personal data." if any data we sell is sensitive data under the Texas Data Privacy and Security Act.]

Part A. People in our data

A1. What Diced does with this information

Our customers describe the people or businesses they want to reach, for example "Texas homeowners researching solar panels". We show them free masked previews that hide contact details. If they pay, we reveal the full record. Customers can also look up a person they already know by email, phone, IP address, postal address or a hashed email, and get back the record we hold.

A2. Where the information comes from

We do not collect this information from you directly. In short, it is commercially available data from third-party data partners, public records, and online activity signals. In more detail, it comes from these categories of sources:

• Licensed third-party data partners. Companies that compile and license consumer and business data, under contracts that require them to collect and license it lawfully.
• Publicly available sources. For example, public records, government records, company websites and public professional profiles.
• Online activity and intent signals. Information about the topics people and businesses research online, compiled by our data partners from websites, apps, publisher networks, co-registration and partner networks where people agreed to the use of their data. We get topic-level signals, such as "researched solar panels in the last 14 days", not browsing histories.
• Inferences. Estimates that we or our partners derive from the information above, such as an intent level or an income range.

[CONFIRM: these categories must match the data partner's representations in the reseller agreement and the categories in our data broker registrations. Confirm whether the partner provides any consumer notice and opt-out at the original point of collection, as Cal. Civ. Code § 1798.115(d) requires before a third party resells data it bought.]

A3. Categories of personal information

Not every record has every field. The categories below use the California Consumer Privacy Act categories.

Sensitive personal information. We do not knowingly collect or sell sensitive personal information as California law defines it, such as Social Security numbers, account log-ins, precise geolocation, racial or ethnic origin, religious beliefs, union membership, health information or sex life. [CONFIRM: some intent topics may relate to health, finances or other personal subjects. Counsel must review the topic list. Health-related topics may be "consumer health data" under Washington's My Health My Data Act or "sensitive data" under Connecticut, Colorado, Oregon, Maryland and other laws, which can require consent before collection or sale. Maryland bans the sale of sensitive data outright.]

A4. Why we use it

• To license and sell it to business customers for marketing, sales and prospecting.
• To match records when a customer looks up a person they already know.
• To keep suppression lists and honor opt-out and deletion requests.
• To keep the Services secure, prevent fraud and enforce our Acceptable Use Policy.
• To comply with the law, including data broker and privacy laws.

We do not use this information to make decisions that produce legal or similarly significant effects about you, such as decisions about credit, jobs, insurance or housing. Our Acceptable Use Policy bans customers from doing so.

A5. Who we disclose it to

Sale and sharing. In the last 12 months, we have sold all of the categories in A3 to business customers. We do not "share" this information for cross-context behavioral advertising ourselves, but our customers may use it for their own advertising, which some state laws treat as targeted advertising. An opt-out request covers sale, sharing and targeted advertising. [CONFIRM: "in the last 12 months" wording for a new business. Replace with "since launch" if counsel prefers.]

We do not knowingly sell or share personal information of people under 16.

A6. How long we keep it

• Lead records stay in our database while they are part of a customer audience or a customer has unlocked them, and our data partners may refresh them. [CONFIRM: there is no automatic maximum retention period for lead records today. Set one, for example 24 months after last refresh, and build the deletion.]
• Suppression records stay as long as we operate, so we can keep honoring your request. We store only a one-way hash of your email address or phone number, not the plain value.
• Privacy request records stay for at least 24 months, as California regulations require. [CONFIRM: no automatic deletion of privacy request records exists today.] For a delete, access or correction request that is never confirmed, we remove the email address, phone number and correction details 14 days after the link expires, and keep only the type of request and its dates.

A7. Your choices

You can opt out of the sale of your information, ask us to delete it, ask what we hold, or ask us to correct it. Section C explains how.

Part B. Customers, users and website visitors

B1. What we collect

Enrichment lists you upload are handled under our Data Processing Addendum. For those, we act as your service provider.

B2. Why we use it

• To create and run your account and workspaces, and to sign you in.
• To process payments, grant chips and send receipts and notices.
• To provide the features you use, including the AI "describe your buyer" feature, which sends your prompt to OpenRouter.
• To send transactional emails, such as sign-in links, invites, low-chip alerts, watched-audience digests and webhook alerts. We do not send marketing email today. [CONFIRM: if marketing email is added later, update this section and add opt-out handling.]
• To secure the Services, prevent fraud and abuse, enforce rate limits and our policies, and stop duplicate signup bonuses.
• To fix bugs and improve the Services, using usage data.
• To comply with the law and enforce our agreements.

B3. Who we disclose it to

• Service providers that run the Services for us, listed on our subprocessors page: Supabase, Vercel, Stripe, Resend and OpenRouter.
• Cloudflare, for the Turnstile captcha on sign-in and privacy request forms, and Google, if you choose Google sign-in. [CONFIRM: whether Cloudflare Turnstile must be listed as a subprocessor. It processes device signals of users and requesters, not Customer Data.]
• Your workspace owners and members, who can see workspace activity.
• Third-party tools you connect, such as AI assistants through the MCP server.
• Authorities and others when the law requires, to protect rights and safety, or in a merger or sale of the business.

We do not sell or share personal information about customers, users or website visitors, and we do not use it for targeted advertising.

B4. How long we keep it

B5. Cookies

We use only the cookies needed to sign you in and remember your workspace. We use no advertising or analytics cookies. See the Cookie Notice.

Part C. Your privacy rights

C1. Your rights

Depending on where you live, you may have these rights over your personal information:

• Know and access. Learn the categories of information we collect, the sources, the purposes, the categories of recipients, and get a copy of the specific pieces we hold about you.
• Delete. Ask us to delete your information.
• Correct. Ask us to correct inaccurate information.
• Opt out of sale, sharing and targeted advertising. Tell us to stop selling or sharing your information.
• Opt out of profiling for decisions with legal or similarly significant effects. We do not do this kind of profiling.
• Limit the use of sensitive personal information. We do not use or sell sensitive personal information in ways that trigger this right. [CONFIRM: depends on the sensitive-topic review in A3.]
• Portability. Get your information in a usable format.
• List of third parties. Where your state law gives this right, such as in Oregon and Minnesota, ask for a list of the specific third parties to which we disclosed your information.
• Appeal. Appeal our decision on your request.
• No discrimination. We will not deny you service, charge a different price or give a different level of quality because you used your rights.

These rights come from the California Consumer Privacy Act as amended by the California Privacy Rights Act, and from the comprehensive privacy laws of other states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Some rights vary by state. Nevada residents may opt out of the sale of covered information under Nevada law. We honor opt-out and deletion requests from any U.S. resident, whatever state they live in. [CONFIRM: list of states in force on the launch date, and whether to honor all requests nationwide as written.]

C2. How to make a request

• Use our privacy request page. It handles opt-out, delete, access and correction requests.
• Or email legal@diced.si, with "Privacy request" in the subject. Use email for list-of-third-parties requests, to include a phone number in an access or correction request, or if you cannot use the form.
• California residents can also send one deletion request to every registered data broker through the California Privacy Protection Agency's Delete Request and Opt-out Platform, known as DROP. We check DROP and process its deletion requests at least every 45 days, as California law requires. [CONFIRM: DROP processing cadence and that the admin import is run on schedule.]

Give us the email address, and for an opt-out or deletion the phone number, we may hold for you. We find records by those values, so send a request for each email and phone you want covered.

C3. What happens after you ask

• Opt-out. We add a hash of your email and phone to our suppression list. Your records stop appearing in new searches, previews, reveals, watched-audience runs and enrichment matches. An opt-out sent from our privacy request page takes effect within minutes. If an unusually large number of opt-outs arrive at once, for example from a script, we may hold them for review first, and we still act on genuine ones within 15 business days. One that reaches us another way takes effect within 15 business days, usually much sooner. Customers who already received your record before the opt-out keep it. [CONFIRM: whether Diced must notify those customers, see the DPA.]
• Delete. We suppress you as above, and we delete matching lead records from our database, including from every customer workspace in Diced. A deletion from our privacy request page deletes the records that match your email address; a phone number in the same request only suppresses, because people share phones. A request with only a phone number, which can reach us by email or through DROP, deletes the records with that number. Copies that customers exported before the deletion are outside our systems. [CONFIRM: notice to customers that received the data.] We keep the hash on our suppression list so your records are not added again.
• Know and access. We compile what we hold about you, including the records that match your verified email address and how many customer workspaces unlocked them. We email it to you.
• Correct. We review what you tell us is wrong and correct the record by hand. If we cannot confirm the correct value, we may delete the record instead of keeping inaccurate data.

We confirm receipt of delete, access and correction requests by email as soon as you confirm the verification link, and always within 10 business days, and we respond within 45 calendar days. If we need more time, up to another 45 days, we will tell you why. We email you when we complete a request.

C4. Verifying your identity

We do not need to verify opt-out requests, but we may decline one we reasonably believe is fraudulent. When an unusually large number of opt-outs arrive from our privacy request page in a short time, which suggests automated submissions, we hold the new ones for review instead of applying them right away, and apply the ones that are genuine.

For delete, access and correction requests, we verify that you control the email address in the request. When you use our privacy request page, we email that address a link. The link works once and expires after 48 hours, and we act on the request only after you open it and confirm. If you do not confirm, we do not act on the request. For a request by email or mail, we verify the email address the same way, or confirm your identity another way if the request covers a phone number.

We cannot confirm a phone number by email. So access and correction requests from the form are matched by email address only, and a phone number in a deletion request stops the sale of records with that number but does not delete them.

For an access request asking for specific pieces of information, we may ask for more information to reach a higher degree of certainty. We use information you give for verification only for that purpose. We store only a one-way hash of the code in each verification link.

C5. Authorized agents

You may use an authorized agent to make a request for you. The agent must give us your signed permission, or a power of attorney. For delete, access and correction requests, we may also ask you to verify your identity directly or confirm that you gave the agent permission. Agents can email legal@diced.si with "Authorized agent request" in the subject.

C6. Global Privacy Control

We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing.

Our websites do not collect information about visitors for sale or advertising, so there is no website data for the signal to stop. When you send a request on our privacy request page, we check for the signal in two ways: the Sec-GPC: 1 header your browser sends, and the browser's navigator.globalPrivacyControl setting, which the form reads. We record whether the signal was present with your request. If it was, we treat the request as including an opt-out of sale and sharing for the email address and phone number you give, and that opt-out takes effect within minutes, even before you confirm a delete, access or correction request.

C7. Appeals

If we deny your request in whole or in part, you can appeal. Reply to our decision or email legal@diced.si with "Privacy appeal" in the subject within 60 days. We will respond in writing within 45 days for most states, or 60 days in Colorado, and explain the reasons. If you disagree with the result, you can contact your state attorney general. [CONFIRM: appeal timing per state.]

C8. Request metrics

California data brokers and businesses that handle large volumes of personal information must publish how many requests they received and how they responded. We will publish those figures here for each calendar year, starting with the first full year after launch.

[CONFIRM: exact metrics required under Cal. Civ. Code § 1798.99.85 and Cal. Code Regs. tit. 11, § 7102, including counts of requests denied because they could not be verified, and the deadline for each annual update.]

Part D. Other information

D1. Children

Diced is not for children. Our customers must be at least 18. We do not knowingly collect information about children under 16, and we do not knowingly sell or share it. If you believe our data includes a child, email legal@diced.si and we will delete it.

D2. People outside the United States

Our data is about people and businesses in the United States, and we offer the Services to U.S. businesses. We store and process information in the United States. If you live outside the United States and believe we hold your information, email legal@diced.si and we will respond under the law that applies to you. [CONFIRM: whether non-U.S. signups are allowed and, if so, whether an EEA or UK representative and transfer terms are needed.]

D3. Security

We use reasonable safeguards to protect personal information. Access to customer data is limited by workspace. API keys are stored only as hashes, and webhook secrets are encrypted. Export download links expire after 15 minutes. Errors and logs are scrubbed of personal information where we can. No system is perfectly secure, and we cannot guarantee the security of information.

D4. Deidentified information

When we use deidentified information, we keep it in deidentified form and do not try to reidentify it, except to test our deidentification as the law allows.

D5. Changes to this notice

We may update this notice. We will post the new version with a new date. For material changes, we will tell customers by email or in the app. We review this notice at least once a year.

D6. Contact

J&T Solutions Inc., doing business as Diced Attn: Privacy 251 Little Falls Drive, Wilmington, DE 19808, United States

• Privacy requests, appeals and agent requests: legal@diced.si, or our privacy request page
• Account and general questions: support@diced.si

[CONFIRM: California requires at least two methods for submitting requests, including a toll-free number unless the business operates exclusively online and has a direct relationship with consumers. A data broker has no direct relationship with the people in its data, so a toll-free number may be required.]