Privacy information.
Notice version 2026-10-30-v20
Who handles the inquiry
Lunchbreak handles your inquiry. Privacy contact: support@lunchbreak.com.
What the form collects
The estimate form collects your company name, first and last name, role, email, website, and an optional phone number. It then asks for your business type, employee-count range, years operating, tools used, and operating status.
The CAD design estimate form collects the same contact details. It then asks for your design discipline, team size, years operating, operating status, the CAD tools you use, the types of CAD assets you hold, and the approximate number of CAD files, total dataset size, number of distinct products or systems, and type of archive. If you choose Other as the archive type, it also asks for a short free-text description; please describe the archive only, without personal details. When you submit, we calculate a preliminary estimate from your archive answers (a dollar range, or a note that the archive needs review first) and store it with your request. It is a non-binding indicator, not a formal valuation or offer; see the submission terms.
Each time you continue to the next step, those answers are saved with your email and a dated progress history. Completed steps are retained even if you leave before sending the final request, and may be used to follow up about your inquiry.
Do not include raw datasets, customer details, passwords, access tokens, bank details, or confidential material. There are no file uploads or connected accounts at this stage.
When you send a request, we also record it in Attio, our customer relationship system, so the team can follow up: your name, email, company and website, the request’s reference, a summary of your answers and any estimate shown to you, our review notes, and, if you allowed advertising cookies, the site or campaign that first brought you to us.
Expert applications
When you apply for an expert role, we collect your name, email, LinkedIn profile link, the role you selected, and your résumé (a PDF or Word file). These details are saved only when you submit the application, together with its date, the contact notice shown to you, and the version of this Privacy Policy. Your résumé is uploaded as part of submitting; if the application is not completed, the uploaded file is deleted within a day. Unsaved entries remain in page memory and are not stored in your browser or saved as partial leads.
Approved staff use this information to review your professional background and contact you about suitable expert projects. We keep a record of follow-up status. Applying registers your interest; it does not create an employment agreement or guarantee a project. No connected LinkedIn account is required.
We may also email you about new Lunchbreak programs and our referral program. Every such email has an unsubscribe link, and unsubscribing does not affect your application or how we review it.
We also record each application in Attio, our customer relationship system, so the team can follow up: your name, email, LinkedIn profile link, the role you applied for and the date, our review notes, and, if you allowed advertising cookies, the site or campaign that first brought you to us. Your résumé stays in our private file storage; Attio holds only a link that requires a staff sign-in.
Technical quote inquiries
The code quote form collects a technical inventory, languages or formats, approximate scale and history, and the asset owner’s follow-up details. A code quote request is recorded in Attio with your contact details, a summary of the inventory, the request reference and, with advertising permission, the first site or campaign that brought you to us. Partner inquiries we received before the referral program opened are kept under the retention terms below.
Your Lunchbreak account
You sign in to Lunchbreak with your email address, using a one-time code that Stytch emails to you. The first time you do, we create one account record for you: the email addresses you have signed in with and when each was confirmed, Stytch’s ID for you, when you last signed in, and the workspace you used last. Your expert profile and your referral partner account, if you have them, are linked to it. Signing in alone does not make you an expert or a referral partner: expert work is by invitation, and you join the referral program separately. If you ask us to link two accounts that you signed in to separately, we record both email addresses and your request so our team can link them.
Identity verification
If we invite you to do expert work, you can verify your identity from your Lunchbreak workspace after you sign in. The check runs only when Persona is configured for that environment. Our server sends Persona (withpersona.com) your internal account ID, the address of the workspace page you return to, and the identifier of the check template set in Persona’s dashboard. You then photograph a government-issued photo ID and take a selfie on Persona’s pages. The workspace tells you that Persona compares the selfie with the photo on the ID. A link to finish a check lasts 24 hours; after that you start a new one.
Persona returns a status, which we record. A completed or approved check is recorded as verified, with no separate review step in Lunchbreak. A check Persona marks for review stays in review until someone approves or declines it in Persona’s dashboard. A failed or declined check stays failed until a Lunchbreak staff member allows another attempt. Staff can activate you for expert work only once this check is verified and you have also accepted the current agreements, finished payout setup, and had a trial task approved. Turning the account active is a staff action.
We store Persona’s reference for the check, the link while the check is still open, and the status (not started, pending, in review, verified, failed, or expired) with the time we last read it. We do not store the photographs or the details printed on the ID. A webhook from Persona can include those details; our server reads only the check’s reference from it and does not keep the rest. You see the status in your workspace. Approved staff see the same status, can ask Persona for an update, and can open the check in Persona’s dashboard.
Referral program
If you are a referral partner. You sign in to your Lunchbreak account as described above. You can also sign in with Google. For Google sign-in, Google and Stytch provide your verified email and account identifiers so we can sign you in to the same partner account. When you join, Lunchbreak creates your partner account and referral link using your name, email and an internal account ID. We record that you accepted the referral program terms and when. Your dashboard shows what we hold about your referrals: visits through your link, the companies you introduced, their progress, your rewards and your payouts.
Getting paid. You set up payouts through Stripe Connect. Stripe collects identity, bank and tax details on its own pages under its privacy policy. Lunchbreak stores your Stripe account reference, setup status, approved commissions and transfer history. We do not receive your full bank details. Deposits follow Stripe’s payout schedule.
If you introduce a company. You give us the company’s name, website and country, and a contact’s name, email, optional phone number and optional role, with a note on how you know them and what records they might have. You must confirm the contact knows about the introduction and agreed to hear from us, and share only accurate details that are not confidential. We use these details to contact that person about selling their company’s data, to check whether we were already in touch with the company, and to credit you. The company and contact are recorded in Lunchbreak and in Attio, our customer relationship system.
If someone referred you. If a partner introduced your company, you arrived through a partner’s link, or you named someone in the estimate form’s optional “Referred by” field, we save that with your request. A partner’s code travels in the link itself and is not stored in your browser, unless you allowed advertising cookies, in which case Lunchbreak also records your visit (see Cookies and measurement below). When your request names a partner, we record its reference and the partner on your request so the partner can be credited, and name the partner on your record in Attio. The partner can see your company’s name if they introduced it, or a partly hidden email address if you came through their link; the progress of your request, such as in review, deal signed or not proceeding; and the reward they earn, which reflects the value of a signed deal. They do not see your form answers. You can ask us at any time to stop contacting you and to delete your details.
Automatic checks. To apply the program terms, we automatically compare a referred company’s website and email domain with our own records and Attio, to see whether we were already in touch with it in the previous 12 months, and check that a deal was signed within 12 months of the referral. These checks decide only whether a partner is credited. They do not affect how we assess your company, and staff can review and correct them.
How long we keep it. We keep partner, referral and reward records while you take part in the program and for up to seven years after your last reward, as tax and accounting records require. Details of introduced companies and their contacts follow the retention terms below.
Why it is collected
The information is used to assess the inquiry, clarify authority and suitability, arrange follow-up, and keep a record of the review. It does not authorize a sale, transfer, model training, or other use of the underlying company records. Once an inquiry is no longer needed, we may keep anonymized or aggregated information from it, which no longer identifies you, to understand market and valuation trends.
AI screening of inquiries and applications
After you submit an estimate request or an expert application, staff can run a screening that suggests how strong it looks. It does not run when you send the form. Staff can also include a saved estimate draft. The screening labels the inquiry Exceptional, Qualified, or Unqualified, with a score from 0 to 100, and keeps reasons and flags. That label is a suggestion for staff. Saving it does not change whether we follow up, and it does not invite you or turn the inquiry away. Approved staff can replace the label; the replacement is what we show from then on. The label, score, a short headline, and the reasons are copied to your record in Attio.
We use TREG (treg.to), Exa (exa.ai), and OpenRouter (openrouter.ai) as processors for this screening. TREG receives the lookup requests described below and calls the source named in each request. Exa searches go straight to Exa when an Exa key is configured, and otherwise to TREG, which passes the same search body to Exa. OpenRouter receives the material below and returns structured notes. Our code turns those notes into the score. OpenRouter is called for an estimate request only when a website was fetched or a company record was found, and for an application only when a LinkedIn profile was read. With no OpenRouter key, or if the model call fails, no notes are used and the score uses the records and the form alone. The model is one we select on OpenRouter; the default in this software is openai/gpt-6.1-sol-pro.
Estimate requests. The purpose is to check that the company looks real and to draft notes for a follow-up: what it does, how large the work looks, how long it has operated, and whether the contact appears able to approve a sale. When the email domain is on our disposable-address list, we label the request Unqualified and do not send it to these providers. On any other request, a website is sent to TREG for a company record by domain (Crustdata, then The Companies API if Crustdata has no match). If that domain resolves, Exa is asked for the home page and up to three further pages aimed at about, projects, portfolio, work, or history, with the page text capped at 4,000 characters in that request. When there is a company name, Exa is searched for it, with the website domain when we have one, and for web pages that mention it. When there is a contact name and a company, Exa is searched for that name, the role (or “employee” if the role was left blank), and the company, to see whether a public profile matches. A name or domain that matches a short list of test placeholders is labeled Unqualified after those lookups. OpenRouter then receives the company name, website, contact name and role, business type, employee-count range, years operating, operating status, and the tools or systems you listed; for a CAD request, also the file count, archive size, product count, and archive type. It also receives the company record, any matching profile, the website text, and the web mentions. A request with no company record, no fetched website, and no outside mention is labeled Unqualified, unless you told us the company is winding down, closed, or no longer operating.
Expert applications. The purpose is to judge experience, seniority, credentials, and fit for the role you applied for, and to check that the LinkedIn profile matches your name. TREG is asked to read the LinkedIn profile link you gave (AnyAPI, then Fetchin if that profile has no roles). Exa is searched on LinkedIn for that profile, using the name, headline, and current employer on it, or your name and the role title if the profile could not be read. Exa is also searched for other web pages about that name, the current employer when we have one, and the role title. TREG is asked for company records for up to three recent employers named on the profile (Crustdata). For engineering and design roles, and for physical sciences, TREG is asked to search Google Patents (Serper) for that name as an inventor. Medicine also searches the public NPI Registry by first and last name. Medicine, computer science, finance, life sciences, physical sciences, mathematics, education, and humanities, and any doctorate role, search OpenAlex by name. Computer science also reads a public GitHub profile when the LinkedIn text names one. OpenAlex, the NPI Registry, and GitHub are called by our server, not through TREG. OpenRouter then receives your name, the role title, its description, the degree it asks for, and its specialties; the profile (name, headline, location, summary, connection count, roles with dates and descriptions, education, certifications, honors, up to 15 publications, and up to 25 skills); the text of your résumé when one is stored, up to 20,000 characters; and the search results, employer records, and registry results. A LinkedIn name that differs from your application is labeled Unqualified. A separate staff command can ask TREG for headcount, growth, and funding on employers named in a screened profile, using the company name and then its domain, and print a ranking. That ranking is not saved on your application.
What we keep, and who reviews it. Approved staff see the label, score, reasons, and flags in the review workspace and can set a different label. The model does not email you. For an estimate request we keep the screening record with the inquiry: the form facts used, including your email, the pages and records gathered, and the model’s notes. For an expert application we keep the scored result with the application: your name, the roles and credentials the score used, the reasons and flags, and links to the sources. Both follow the retention period below. Cached answers from these sources, including the query we sent, are deleted after 90 days. A later screening may reuse an answer from the past 30 days instead of asking again.
Who can access it
Approved staff can access requests through a restricted review workspace. Hosting and database service providers process information on the operator’s behalf. The planned production stack uses Vercel for the application and MongoDB for request storage. Stytch provides sign-in for Lunchbreak accounts (by an emailed one-time code) and for staff, and so receives the email address used to sign in. Google sign-in for referral partners also goes through Google and Stytch, which provide the verified email and account identifiers. Stripe processes affiliate and expert payments, and Attio holds our sales pipeline and expert applications, as described above. Brevo sends our program and referral emails, and so receives the name and email of each person we email, and whether a message was opened or clicked. OpenRouter, Exa, and TREG process the screening described above, and Persona processes identity checks for invited experts. Résumés uploaded with expert applications are stored in a private Cloudflare R2 bucket, and staff open them through links that expire after a few minutes. No other form transfers files or datasets there.
Storage and retention
We keep your inquiry and the contact details submitted with it for as long as we are evaluating, discussing, or pursuing a potential transaction with you, and for up to 36 months after our last contact with you. We may keep information longer where needed to comply with legal obligations, resolve disputes, or enforce our agreements. When information is no longer needed, we delete it or anonymize it so it can no longer identify you; we may retain and use anonymized or aggregated information without limit. Deleted information may persist in routine backups for a limited period until those backups are overwritten. You can ask us to access, correct, or delete your information by contacting the privacy contact above, and we will respond as required by applicable law.
The deployment region and any contractual location requirements must be confirmed before actual exports are requested. This notice makes no data-residency commitment.
Cookies and measurement
Unsaved edits remain in page memory; completed steps are stored on the server. Answers are not saved to browser storage. A short-lived essential cookie records successful submission confirmation and expires after 30 minutes. Lunchbreak and staff sign-in use essential cookies: a 10-minute cookie while a sign-in is in progress, then a session cookie that lasts up to seven days for Lunchbreak accounts and up to eight hours for staff. A cookie with no identifier tells our pages that you are signed in.
No session replay is installed. Visitors in the European Economic Area, including its outermost regions and Åland, the United Kingdom and Gibraltar, Switzerland, Saint Barthélemy, Saint Pierre and Miquelon, and Svalbard and Jan Mayen, and visitors whose country we cannot tell, are asked before optional measurement or advertising. Until that choice, PostHog may receive page views and funnel actions, such as form starts and submissions, in memory only, without a cookie or browser storage, and it stops if you reject. Those actions include the contact details typed on our business forms and, after a submission, the request reference, described below, so they can be linked to the request you saved. PostHog does not create a profile under your email or keep an id across page loads. Elsewhere, measurement and advertising run unless you use “Do not sell or share my info” in the footer, which turns both off in this browser. That advertising opt-out is renewed on each visit and otherwise kept for 400 days, including after this notice is updated. Allowing measurement while turning advertising off keeps measurement for 180 days, then turns it off. A browser that sends Global Privacy Control is opted out of advertising in every country. PostHog still receives those page views and funnel actions, including those contact details and request reference, in memory only, without a cookie or browser storage, and PostHog does not create a profile under your email or keep an id across page loads. That signal is read on each visit, so a notice update does not turn it off. When measurement is on, daily counters measure assessment starts, completed steps, and validation failures without recording field values, and PostHog, our product analytics provider, receives page views, the campaign link or website you arrived from, actions in our business and expert flows, page speed, and site errors, with page URLs, browser and device information, and a visitor identifier kept in a cookie for up to 180 days, which starts as a random value and, after a submission with measurement on, becomes your email address. On the business estimate and valuation forms, PostHog also receives the email address, company name and company website domain you have typed, including before you submit, and after a submission the request reference. After a submission with measurement on, PostHog links your visitor history in this browser to your email address, name, company name and domain, and our server sends PostHog one event with your email address, company domain and request reference. This means your site analytics can be linked to the request you saved. We do not send PostHog other form answers, your phone number, or search text, and PostHog does not run on staff pages. Turning measurement off stops PostHog and resets the identifier. An essential preference cookie remembers a measurement choice for 180 days. A choice that turns advertising off is renewed on each visit and otherwise kept for 400 days. Use Cookie settings on the Cookie Policy page, or the footer opt-out, to change it, or read our Cookie Policy. Saved request and workflow counts help measure completion and qualification. The server limits request size and uses temporary hashed rate-limit identifiers to reduce abuse. Full form contents are not intentionally written to application logs.
Advertising is a separate optional choice. If you allow it, Meta Pixel sends page URLs, browser information, and actions such as role views, form starts, saved steps, and completed submissions to Meta. Meta uses these signals for advertising measurement and personalization on Facebook and Instagram. We do not add form answers, contact details, or LinkedIn profile links to pixel event parameters, and automatic form matching is not enabled. You can turn advertising off using Cookie settings. This stops future Lunchbreak pixel events, without recalling information already received by Meta or LinkedIn.
With advertising permission, LinkedIn Insight Tag also measures visits in our business and expert flows and, when configured, successful submissions. LinkedIn receives page URLs and browser information for ad measurement and retargeting. When you submit a business or expert application with advertising allowed, our server also tells LinkedIn that a submission happened, using LinkedIn’s Conversions API. That report includes a one-way SHA-256 hash of your email address (not the email itself), the time of the submission, a reference ID, and, if you arrived from a LinkedIn ad, LinkedIn’s click identifier, which we keep in a first-party cookie for up to 30 days. LinkedIn uses this only to match the submission to its members and measure our ads. We do not send your name, phone number, form answers, or LinkedIn profile link. Turning advertising off stops these reports and deletes the click identifier cookie. With advertising allowed, we also keep a first-party record of how and when you reached us (campaign tags in the link, which ad network you clicked from, the referring website, and your landing page, for your first and most recent visit) and save it with your estimate request or expert application. It stays with us and is not sent to LinkedIn or Meta. If you turn advertising off and then save another step of the estimate form, we remove that record from your saved request. Turning advertising off does not by itself remove a record already saved, for example after your final submission; you can ask the privacy contact to delete it. LinkedIn may use advertising cookies; see LinkedIn’s Privacy Policy.
With advertising permission, Lunchbreak records visits through referral links and stores the partner code in the lunchbreak_referral cookie for up to 90 days. A random visit identifier in session storage avoids counting a page refresh twice and is cleared when permission is withdrawn. Turning advertising off deletes the referral cookie. Without permission, the partner code travels to the form only in the link.
Your choices
You can leave the form before submitting, omit optional details, and ask for correction or withdrawal using the published privacy contact once intake launches. Requests about access, deletion, or other applicable privacy rights should also go to that contact.
Later review is separate
Any collection of actual datasets requires a separate agreed scope, authority checks, and appropriate handling terms. Removing names alone does not guarantee anonymity.