Effective Date: October 22, 2026
This Privacy Policy describes how Hexoglyph Holdings, LLC ("Hexoglyph," "Company," "we," "us," or "our") collects, uses, processes, stores, and discloses information in connection with its phone number verification, contact data validation, and lead hygiene services offered under the brand name NumberBroom (the "Service"). NumberBroom is a proprietary brand identifier of Hexoglyph Holdings, LLC.
By accessing or using the Service, you acknowledge that you have read, understood, and agree to the terms outlined in this Privacy Policy.
"Service" refers to the NumberBroom platform, including its phone number validation, contact grading, lead hygiene, litigator screening, name-match verification, and any associated web-based interfaces, APIs, dashboards, and reporting tools operated by Hexoglyph.
"Customer" or "User" means any individual or legal entity that creates an account, uploads data, or otherwise uses the Service to verify or process contact information.
"Customer Data" means phone numbers, names, email addresses, physical addresses, and any other contact information submitted by a Customer for verification through the Service.
"Verification Results" means the outputs generated by the Service, including validity indicators, activity scores, contact grades, line-type classifications, carrier information, litigator flags, and name-match assessments.
"Subprocessor" refers to third-party entities engaged by Hexoglyph to process data on its behalf, including telecommunications data providers, cloud infrastructure providers, and verification engines.
When you use the Service, you submit Customer Data for processing. This may include phone numbers, full names, email addresses, and physical addresses. The Service processes this data solely for the purpose of returning Verification Results.
Files may be uploaded as CSV, TSV, Excel, or PDF, or as other delimited text. Excel and PDF files are converted to CSV by your own browser before anything is sent to us, so the original Excel or PDF file never reaches our servers. The one exception is a scanned PDF, which has no text in it for your browser to read: if you ask us to read one, your browser sends us an image of each of its pages. We pass each image to a third-party text recognition provider, return the text it finds to your browser, and keep nothing: the images are not stored by us, and the provider may not use them to improve its services. The PDF file itself is still never sent. A CSV, TSV or other delimited text file is sent as the text it contains. If a file has more rows than one job accepts, your browser sends only the rows that job will process.
The free contact data assessment is handled differently from a paid job: the file you submit is analyzed in memory and discarded when the report is generated. It is never written to storage, and no copy of it is retained.
When you create an account, we collect your email address. Your account record also holds your job history, your pre-paid API credit balance, and the first-visit information described in Section 2.6. Card and billing details are collected and held by our payment processor, not by us. If you create API keys, we store only a one-way hash of each key, never the key itself, with its label, its daily limit and when it was last used. Numbers you look up one at a time through the API are not stored. A list you send through the API to be scrubbed is stored as an uploaded file, the same as a file uploaded on the website, and kept and deleted on the same terms (Section 6).
You may also use the Service without creating an account first. If you do, we create an account for you after payment using the email address you gave our payment processor at checkout, so that your job, your output file, and your receipt have somewhere to live. Your receipt contains a sign-in link valid for seven (7) days; after that you can sign in using the same address. If that address already has an account, the job is added to it instead, and no sign-in link is sent. The same applies to API credits bought through an AI agent's checkout. Receipts and completion emails contain a link to download your output file, valid for thirty (30) days; anyone who has that link can download the file.
If you add numbers to your own do-not-call list in Settings, we store those phone numbers in your account and use them for one purpose only: to remove them from the lists you scrub while signed in, before any number is checked. The list is never shared with anyone, never combined with another account's, and never used for anything else. You can download it, remove numbers from it, or empty it at any time.
If you connect an AI assistant to your account, we create an API key for that connection and store it like any other key, as a one-way hash, together with the assistant’s name and the identifier it connected with. You can see each connection in Settings and disconnect it, which revokes its key. The key itself is held, encrypted, by our authorization service on separate edge infrastructure, and the assistant’s provider holds an access token that lets it use the key; neither receives your password, and the identifier they hold for your account is derived from it without revealing it. The one-time code that finishes a connection is deleted within two days.
We automatically collect metadata about how you interact with the Service, including query volumes, API call timestamps, feature usage patterns, IP addresses, browser type, and device identifiers. This data supports service delivery, troubleshooting, and product improvement.
The Service queries third-party verification providers to generate Verification Results. These providers return data elements such as line type, carrier, activity scores, and contact grades. Hexoglyph does not control the underlying data sources maintained by these providers.
Customers may optionally purchase Business Line Lookup, an add-on that queries a third-party caller identification provider to append a business name and industry classification to numbers identified as registered business lines. This add-on is restricted to business-registered lines only: if a number is not identified as belonging to a business, no name, address, or other identifying information about the individual associated with that number is returned or retained.
If you use the chat assistant on our website, we store the messages you send, the assistant's replies, the page on which the conversation began, a salted one-way hash of your IP address used solely for abuse rate limiting, the country your connection came from, and any email address you type into a message. The raw IP address is not retained. Chat conversations are processed by a third-party large language model provider solely to generate a reply; that provider does not receive your email address or your account information. The assistant has no access to your account, your jobs, or any uploaded file. Please do not enter account credentials, payment details, or third-party contact lists into the chat.
Email addresses and phone numbers in your messages are replaced with placeholders before they are sent to the model provider; the stored copy is not redacted. If you ask for a person, raise a billing concern, or a conversation runs past several messages, its most recent messages (up to twenty), the page it started on, and any email address you provided are emailed to our support inbox so that staff can follow up. That email is handled as ordinary support correspondence (Section 2.10) and is not deleted on the ninety-day schedule in Section 6.
Conversations may be read by NumberBroom staff to check the assistant's answers against our published material and to improve that material. We record who carried out such a review and when; that record is stored with the conversation and is deleted with it.
Some of the assistant's answers are drawn from a small internal set of staff-written responses about NumberBroom's own service, such as billing and file formats. These are business information, not legal guidance; the assistant's legal and regulatory answers come only from our published pages.
Our website and customer dashboard use Google Analytics and Microsoft Clarity to understand how visitors use them. These tools use cookies and similar technologies to collect information such as the pages you view, the page that referred you, clicks, scrolling and mouse movement, browser and device type, and approximate location derived from your IP address. Microsoft Clarity also produces session replays and heatmaps showing how pages were used. When you open checkout, and when you return from it, we label that visit in Microsoft Clarity with the first eight characters of the order’s reference number, and mark when a file was chosen, a preview was run and checkout was opened, so that our staff can find the recording of a purchase. The label carries nothing else.
Text typed into form fields is not captured. The areas of the site that display uploaded contact data, lookup results, assessment reports, the customer dashboard and the chat assistant are masked, so their contents are not sent to Microsoft Clarity. For more about how Microsoft processes this data, see the Microsoft Privacy Statement.
Our content delivery network also collects privacy-focused, aggregate traffic measurements on every page, such as page views, the referring page, and country. This measurement uses no cookies and does not identify individual visitors.
When you complete a purchase or a new account is created, we send that event to Google Analytics from our own servers rather than from your browser, so that the purchase or signup is counted even if the tag in your browser did not load. That event carries the analytics identifier already assigned to your browser, the transaction identifier, and the amount paid. It does not carry your name, your email address, or any uploaded Customer Data. To do this, the analytics identifier is attached to the checkout session held by our payment processor.
For each paid order, we connect the Google Analytics record of the visits that led to it with the order, so that we can see how buyers find and use the site and where it gets in their way. That record holds the pages viewed and when, the steps taken on the upload card, the page or search engine that referred each visit and any campaign tags, the keyword, campaign and ad group of a Google ad that was clicked, the type of device and browser, and the state or region and country derived from the IP address. It never holds the analytics identifier itself, the ad click identifier, your email address, the city you are in, or any uploaded Customer Data. It is kept with the order’s job record and deleted with it (Section 6), or sooner when you ask us to delete your data.
We also keep a weekly summary of the visits of each browser that loaded a list on the upload card, or opened checkout, and did not buy that week, so that we can see where the upload card stops people. It holds the pages viewed and the upload-card steps taken and when, how the browser first came to the site and how each visit came as a broad group (such as paid search, organic search or direct), the site that referred each visit, the campaign and ad group of a Google ad that was clicked, how many rows the list held, the type of device and browser, and the state or region and country derived from the IP address. It holds no identifier of any kind, no email address, no city and no uploaded Customer Data, and it is not connected to an account or an order.
On your first visit, your browser's local storage records the page you landed on, the page that referred you, any campaign tags in the link, and the time. That record is sent when you check out, first open the customer dashboard, or submit one of our free tools, and is stored with that job, account or free-tool record (Section 2.7) so that we can tell which channel brought a customer; for a free tool it is also included in the notification emailed to our staff. If you arrive by clicking one of our Google ads, your browser also keeps the click identifier Google adds to that ad’s link, and the time, for up to ninety (90) days; it is sent and stored the same way, so that we can tell which ads lead to purchases. If you arrive by clicking a link in one of our emails, your browser also keeps that link’s campaign tags, which name the email but not you, and the time, for up to thirty (30) days; they are sent and stored the same way, so that we can tell which emails lead to purchases. Your browser also stores your theme choice, the email address you entered in a free tool so the form can be filled in next time, and your recent chat messages for up to twenty-four (24) hours. Links in our follow-up emails and email campaigns carry campaign tags so that a visit from an email is counted as one. After your first paid job, your dashboard may ask how you heard about NumberBroom, until you answer or skip the question, and the email telling you a list is ready may invite you to a short survey about how the job went, which can ask the same question. Answering either is optional. We keep your answers, and any comment you add to the survey, with your account, and an answer about how you heard about us with your first paid job too. Answering the survey earns a one-time discount code whatever your answers say, and we never publish them. The dashboard may also invite you once to review NumberBroom on a public review site; we keep only whether you opened that link or dismissed the invitation, and nothing is offered in return for a review.
Our free tools -- the phone number lookup, the contact data assessment, and the file preview -- ask for an email address, and in some cases a name and company, before returning a result. We keep those details, any phone number you choose to give us, the marketing preferences you selected, the number you checked (for the file preview, the first number in the preview), and summary statistics about the result, and a notification containing them is emailed to our staff. Each phone number lookup also asks a third-party caller identification provider whether the number is flagged for spam, robocall or fraud activity, up to a daily limit across the site; we keep that flag with the record and include it in the result email. We do not keep the file itself. The phone number lookup and the file preview also email their results to the address you entered. Submitting an email address to the phone number lookup or the contact data assessment enrolls it in up to three follow-up emails over the following day. An address submitted to the file preview gets up to five, over three weeks. Every follow-up carries an unsubscribe link, and they stop once you buy a scrub. The email address also serves as a usage limit: it is how we stop one visitor from consuming an unlimited number of paid provider lookups through a free tool.
We also record automated signals about whether a submission appears to come from a real prospective customer rather than an automated script, such as whether the address belongs to a disposable mailbox provider. These signals are used only to monitor abuse of the free tools.
If you choose to have your lists checked against the National Do Not Call Registry, you give us your FTC Subscription Account Number (SAN) and Organization ID in your account settings. We store them encrypted, and our staff can view them only through an audited step, to identify you as our client on the FTC's registry website, which is how the FTC requires a service provider to access the Registry on a seller's behalf. We then download the registered numbers for the area codes your subscription covers and keep them in a store that is used only for your own paid list scrubs: never for the free tools, analytics, marketing, or any other customer. Unlinking your SAN deletes the encrypted SAN and Organization ID.
If you buy a Name Match check on the phone number lookup, we keep the number, the name you enter, your email address and the address you pay with, the result, and the payment reference. To run the check, the number and the name you enter are sent to a third-party verification provider, which says whether they belong together; the number is sent to a third-party caller identification provider, which says whether it is a registered business line and whether it is flagged for spam, robocall or fraud activity; and the number is sent to Google's Places service to find that business's public Google listing. We store only Google's identifier for the listing, never its content, and read the listing from Google again whenever you view your result. Name Match never tells you who a personal number belongs to: about a person it answers only whether the name you supplied matches, does not match, or cannot be checked. The result is emailed to you.
When you email one of our support addresses, such as [email protected], [email protected] or [email protected], or reply to an email from us, we keep the message, any files attached to it, the address it came from, and the replies we send, so that we can answer it and keep a record of what was asked and done. This includes a request to delete your data. Please do not email us passwords, payment card details, or lists of other people’s contact details; anything you attach is kept with the message.
Before we send you an email, we may save it as a draft, which holds the address it is for and what we wrote. An unsent draft is deleted ninety days after it was last changed, or sooner if you ask us to delete your data. Once it is sent, it is kept with the rest of our correspondence.
We keep a contact list of customers and of people who have contacted us or used a free tool. An entry can hold a name, email address, phone number, company, industry, the status of our conversation, a follow-up date, whether you have agreed to receive marketing email, and notes our staff write. We use it to follow up with you and to keep track of who we have spoken to. Marketing broadcasts go only to entries that have agreed to receive them. The list is never sold or shared.
We also keep a list of the businesses and online creators we have contacted ourselves to offer NumberBroom or our partner program. An entry holds the business or creator's name, the work email address or channel they publish, their industry, the status of our conversation, a follow-up date, notes our staff write, and the emails we have sent them. We use it to follow up, to stop writing to anyone who asks us to or whose address bounces, and to see which of our emails lead to replies and orders: we match it against replies to our emails, against applications to our partner program, and against orders placed from the same address or company domain or through a partner's link. It is never sold or shared.
If you subscribe to NumberBroom through AWS Marketplace, Amazon Web Services tells us your AWS account ID and an identifier for your subscription, and we link them to the NumberBroom account you choose. Each hour we report to Amazon Web Services how many API lookups that account made, so that it can bill you. We report counts only, never the phone numbers looked up or their results.
If you apply to our partner program on the partners page, we keep your name, email address, the platform and link to the channel you publish on, the audience size and audience you choose, what you tell us about how you would share NumberBroom, the date you agreed to the program terms, and how you first arrived on our website (Section 2.6). We use it to review your application and to write to you about the program, and nothing else. It never joins our marketing email list. We never ask for payment or tax details through the form; if you join, we ask for what we need to pay you by email.
If you press “Email me this quote” on the upload card, which appears for lists of 500 numbers or more, we keep your email address, how many numbers the card was pricing, the quote, whether you chose Litigators only or the full scrub and whether Scrub + Grade was on, the page link you arrived by, automated signals about whether the request appears to come from a real prospective customer (Section 2.7), and how you first arrived on our website (Section 2.6). We never receive your file or any phone number in it: only the count is sent. We email you the quote once, with no automatic follow-ups after it, and the same details are emailed to our staff, who may write to you personally about it. A quote request does not create an account and does not enroll your address in the follow-up emails described in Section 2.7. The email address also serves as a usage limit, as it does for the free tools.
On a quote of $1,000 or more, the upload card also lets you ask for a better price. If you do, we keep what you add to your quote request (Section 2.14): the price you say would work and the reason you choose, if you give them, along with the quote and how many numbers it was for. We keep them in a record of your request and in a conversation in our support mailbox, so that a person can answer you, and we record what we offer you and what comes of it: whether you bought and, if you did not, why. An offer is a code that works once, for seven days, made with our payment processor; the link in the email applies it for you. We write to you about the price because you asked. To help write our reply we use an AI service. It receives the number of phone numbers in your list, the options you chose, the price quoted, the price you named if you gave one, the reason you picked from our list, and counts of how earlier offers turned out. It never receives your email address, a phone number, your file, or anything else you wrote, and we ask it to use only providers that do not store those details or train on them. A person reads, edits and sends every reply. A price request does not enroll your address in the follow-up emails described in Section 2.7. We never receive your file or any phone number in it.
Hexoglyph uses collected information for the following purposes:
Hexoglyph does not sell Customer Data. We share information only as follows:
Important: NumberBroom is a data verification and lead hygiene service. It does not send SMS messages, make phone calls, or initiate any direct communication with the individuals whose contact data is submitted for verification.
Customers are solely responsible for their own compliance with the Telephone Consumer Protection Act (TCPA), CAN-SPAM Act, and any other applicable telecommunications regulations when using Verification Results to contact individuals.
NumberBroom does not collect opt-in consent from the individuals whose data is verified, as the Service does not communicate with those individuals. Customers must independently obtain and maintain any required consents before initiating contact.
Hexoglyph retains Customer Data only as long as necessary to fulfill the purposes described in this Policy. Consistent with applicable data minimization requirements under the CCPA/CPRA and related regulations, we do not retain personal information beyond what is reasonably necessary for the stated purpose.
Anyone may request early deletion of their data by contacting us at the address provided in Section 13, whether or not they have an account. Deletion requests are subject to legal retention requirements that may override early deletion in certain circumstances.
Where we act on a deletion request, the following are deliberately retained, and the account link is removed from them where they are not already anonymous:
Hexoglyph implements administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security assessments.
No method of electronic storage or transmission is completely secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security.
Depending on your jurisdiction, you may have the following rights regarding your personal information:
These rights apply whether or not you have an account with us: a request about a free-tool record, a chat, a Name Match check or our contact list is handled the same way. To exercise any of these rights, contact us at the address provided in Section 13.
If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act. These include the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale or sharing of personal information.
Hexoglyph does not sell personal information. To submit a verifiable consumer request, contact us at the address provided in Section 13.
The Service is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If we become aware that we have collected information from a minor, we will take steps to delete it promptly.
Information may be transferred to and processed in the United States or other jurisdictions where our service providers operate. By using the Service, you consent to the transfer of information to jurisdictions that may have different data protection laws than your jurisdiction of residence.
Hexoglyph may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the effective date. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.
Privacy-related inquiries may be submitted to:
Hexoglyph Holdings, LLC
NumberBroom Privacy Inquiries
Email: [email protected]