What happens to your data.

Our cleaning runs on every file before any buyer sees it. It looks for details that could tell someone who a person is. It takes them out, or swaps them for a stand-in.

• Names of people.
• Email addresses, phone numbers and street addresses.
• ID numbers, like Social Security, tax and driver's license numbers.
• Bank, card and account numbers.
• Passwords and keys to other systems. These are taken out, not swapped.
• Web links that carry a person's details.
• Car plates, vehicle numbers and exact map spots.

We also check the places people forget. That means file and folder names, email subject lines, and the hidden details saved inside a document, like who wrote it, comments and tracked changes.

By default, ZIP codes are cut to their first three digits. Ages over 89 are shown as 90 or older.

Buyers want to see how a real business runs. They don't need to know who your customers are. So we keep:

• What was asked, what was done and what was decided.
• The order things happened in, and how long each step took.
• How it turned out: paid, shipped, fixed, won or lost.
• Product codes and dollar amounts.
• Order, invoice and ticket numbers, swapped for stand-ins that match in every system. One order still links to its invoice and its payment.

A name, email or phone number gets the same stand-in every time it shows up, in every file. So a buyer can follow one job from start to end without knowing who did it.

These examples use made-up people and numbers.

A stand-in is a made-up label that takes the place of a real detail. "Pat Example" becomes [NAME_51c0e8a3d2]. The label looks random, and it's the same every time Pat shows up.

We make each label with a secret key that belongs to your deal alone. It only works one way. You can go from a name to its label, but not from the label back to the name. Outside HIPAA deals, we keep no list that matches labels to real names.

Buyers never get the key. Their license also bans trying to find out who anyone is.

So buyers can't turn a label back into a name. We keep one narrow key that only works forward. If a person asks to be deleted, it tells us which labels are theirs, so buyers know what to delete. That key is destroyed when the license ends.

Every deal starts as a Confidential deal. The buyer never learns who you are. data.cool licenses the cleaned data in its own name, so your name isn't on the buyer's license.

We also look inside the data for your company's name, and other names you tell us could give you away. We swap them out, or hold the file back.

You can choose Disclosed to Counsel instead. Then the buyer's outside lawyer can see who you are during their review. That happens only after you approve it, through a link that expires.

Either way, the cleaning on this page still applies.

When we can't clean something safely, we hold it back instead of sending it. Held items go to no buyer. We tell you what we held and why.

• Faces. We blur faces in photos and video by default.
• Voices. A voice can point to a person even when the words are bleeped. So recordings of people talking are held by default. To fix it, leave them out, or talk to us about what the speakers agreed to.
• Private topics. Health, sex life, religion, politics, union membership and criminal records are flagged and held. A person on our team decides what can go. To fix it, take that material out at the source, or show us the consent the law asks for.
• Children. Anything that may involve children is held for a person on our team to check. To fix it, take it out at the source.
• Files we can't clean. Locked or broken files, old formats we can't rewrite, and files packed inside files that we can't open. To fix it, send an unlocked copy or a newer format, or leave the file out.
• Possible patient records. If we see signs of patient health records, we hold the whole deal until we know if HIPAA applies. See below.

Once you fix the source, we clean it again. Anything that passes can go in the next delivery.

Real dates can point to real events. So we move every date in a deal by the same number of whole weeks. The number is random, and it's the same in every system. Buyers never learn it.

Since every date moves together, the order of events stays the same. So do the gaps between them, and the day of the week. A buyer can see that an invoice was paid 10 days after the order. They can't see the real day.

We also look for patterns that could give the real calendar away, like a big holiday rush.

HIPAA deals work a bit differently. See below.

HIPAA is the US law that protects patient health records. It applies to a seller only if the seller is one of these:

• A health care provider that bills health plans, like most clinics and dental offices.
• A health plan or health insurer.
• A clearinghouse that processes health claims.
• A business associate: a company that handles patient records for one of the above.

It can also apply if your company runs its own employee health plan, and that plan's records are in the data.

Most sellers are none of these. A construction company isn't covered by HIPAA. Neither is a software company or an ad agency. That's true even when their files mention an injury or a sick day. What counts is what the records are and who held them, not your industry.

Health details in ordinary business records are still private. We flag them and hold them for a person on our team, like any private topic. Some state laws protect health data even when HIPAA doesn't. If your data holds health details about your customers, we may ask for proof that they agreed.

When HIPAA does apply, here's what changes:

• We take a HIPAA deal only once the agreement HIPAA requires is signed and our HIPAA safeguards are in place.
• Dates are cut to just the year. That's the standard HIPAA method, called Safe Harbor. It's safe, but it hides how long things took.
• Or an outside expert can review our method. If they sign off that the risk is very small, dates can move in whole weeks instead, which keeps the timing.
• ZIP codes keep their first three digits only where that area has more than 20,000 people. Otherwise they become 000.
• Ages over 89 are shown as 90 or older.
• Stand-ins are picked at random, not made from the real detail. The list that keeps them steady from one delivery to the next stays sealed with us. It never goes to a buyer.