Privacy policy
The short version: we collect what a directory needs to work, we never sell it, and we do not run third-party ad or tracking networks on this site. The long version is below, written to be read rather than skimmed past.
Last updated 1 September 2026 · Operator Oxid Security Inc. · privacy@debutlist.com
Who we are
Oxid Security Inc. operates debutlist.com and is the data controller for everything described here. Written enquiries reach us at privacy@debutlist.com; we answer within five working days, and a person reads every one.
Nothing on this page is a promise we cannot keep technically. Where a practice is a limitation rather than a policy, it says so.
What we collect
| Data | When | Required? |
|---|---|---|
| Email address | Account signup, newsletter subscription | Yes for an account |
| Profile — handle, name, avatar, bio, links | You fill in a maker profile | Handle only |
| Product submissions and updates | You submit or edit a listing | Yes to publish |
| Votes, reviews, comments | You post them | Optional |
| Verified metrics — revenue series read from Stripe | You connect a payment account | Optional, opt-in |
| Billing details | You buy a paid plan or placement | Handled by Stripe |
| Server logs — IP address, user agent, referrer, timestamp | Every request | Automatic |
| Fraud signals — vote timing, referrer concentration, device fingerprint hash | Voting and reviewing | Automatic |
We do not ask for a date of birth, a phone number, or a physical address, and we do not buy contact data from anyone.
Why we use it
Each purpose below stands on its own legal basis. Under Canadian PIPEDA that is consent; for readers in the UK and EU the equivalent GDPR basis is named alongside.
- Running the directory Contract
- Publishing listings, ranking them, sending account email, taking payment.
- Keeping the ranking honest Legitimate interest
- Detecting vote rings, fake reviews and duplicate accounts. Ranking is the product; protecting it is the point.
- Verification Consent, withdrawable
- Reading a revenue series from a payment provider you connected, so a number on a page means something.
- The weekly digest Consent
- One email a week to people who asked for it. Unsubscribe is one click and takes effect immediately.
We never use your data to train a model, and we never sell, rent or licence it. Advertising on DebutList is sold by placement and category — never by targeting an individual reader.
What is public, and what stays public
These are public by design: a product page and its history, dated updates, verified metric series you chose to publish, reviews and comments with the author's handle, maker profiles, and lifecycle records including post-mortems.
Closure records are permanent. A founder can edit their own post-mortem; nobody can delete it, including us, and including the person who wrote it. Deleting your account removes your profile and unlinks your identity, but the record of a product that existed stays up. That is the promise the whole site is built on, and it is the one thing on this page a deletion request cannot override.
Your email address is never public. Neither are your billing details, your connected payment account, or the raw figures behind a verified series — only the series you published.
How long we keep it
- Account and profile
- Until you delete the account
- Server logs
- 30 days, then discarded
- Fraud signals
- 12 months
- Invoices and tax records
- 7 years — Canadian tax law
- Newsletter subscription
- Until you unsubscribe
- Published product records
- Permanently
Your rights
You can ask for a copy of your data, correct it, delete your account, withdraw consent for verification or the digest, or object to a fraud decision and have a human review it. Email privacy@debutlist.com and we act within 30 days, free of charge.
A data export arrives as JSON — profile, listings, updates, reviews and metric series — and is yours to take anywhere. If you are unhappy with how we handled a request you may complain to the Office of the Privacy Commissioner of Canada, or to your local supervisory authority in the UK or EU.
Security
Traffic is TLS-only, passwords are hashed with Argon2id, payment card numbers never touch our servers, and access to production data is limited to the people who need it and is logged. We disclose any breach affecting your data to you and to the Commissioner without delay.
Security reports are welcome at security@debutlist.com. We do not take legal action against good-faith research.
Changes
If this policy changes materially we email every account holder at least 14 days before it takes effect, and the date at the top of this page changes. Previous versions stay available on request. Related reading: the terms of service, the community guidelines, and what is and is not for sale.