privacy policy
PART 2 : PRIVACY POLICY
Last Updated: July 14, 2026
This Privacy Policy explains how DesireList, Inc. doing business as The Desire Company ("The Desire Company," "Company," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with our websites, customer portals, applications, application programming interfaces, embedded players, reporting tools, content-production services, and other products and services that link to this Privacy Policy. Collectively, these are the "Services."
This Privacy Policy does not apply where we process personal information solely on behalf of a business customer under a separate agreement. In those situations, the business customer generally controls the information, and its privacy policy governs its collection and use.
1. Scope and Roles
Depending on the circumstances, The Desire Company may act as a controller or business when we determine why and how personal information is processed, or as a processor, service provider, or contractor when we process personal information on behalf of a customer according to that customer's instructions.
For example, we may act as a controller for website visitors, account contacts, prospective customers, and our own marketing activities. We may act as a processor or service provider when handling project data, content, user information, or API data on behalf of a brand, agency, retailer, retail media network, marketplace, or other customer.
2. Personal Information We Collect
The information we collect depends on how you interact with us and which Services you use.
2.1 Information You Provide
We may collect information you provide directly, including:
Name, business email address, telephone number, job title, and organization.
Account username, password or authentication information, and communication preferences.
Billing contact, transaction, subscription, and payment-status information.
Support requests, survey responses, messages, correspondence, and feedback.
Project instructions, product and brand information, URLs submitted for analysis, comments, approvals, and review activity.
Files, transcripts, media, recordings, logos, and other content.
Expert or creator profiles, professional experience, qualifications, images, audio, video, voice, likeness, and biography information.
2.2 Account and Organization Information
When you use an account provided by an organization, we may collect:
Organization name, user role, permissions, associated brands, projects, and teams.
Administrator information, account status, login history, authentication events, and workspace activity.
2.3 Project and Content Information
Our Services may process information associated with content-production and fulfillment workflows, such as:
Project, order, scheduling, product, SKU, and product-detail-page information.
Production notes, shipping information, comments, approvals, and content versions.
Media files, transcripts, captions, download activity, expert selections, qualifications, and project information.
Brand, retailer, delivery, hosting, and integration information.
2.4 API Information
When you access or integrate with our API, we may collect:
Account, organization, API-key, application, and domain identifiers.
Authentication and token events, endpoint requests, timestamps, IP addresses, and request parameters.
Product identifiers, URLs, file identifiers, usage volume, rate-limit information, errors, and security events.
Integration configuration and data submitted to or retrieved through authorized endpoints.
2.5 Information Collected Automatically
When you interact with the Services, we may automatically collect:
IP address, browser, device, operating system, identifiers, language, and referring URL.
Pages and features viewed, links clicked, date and time, session duration, and approximate location derived from IP address.
Login, authentication, error, crash, performance, download, playback, and diagnostic information.
2.6 Embedded Players and Content Delivery
When a player, landing page, QR-code destination, analytics integration, or content-delivery feature is accessed, we may collect:
IP address, browser, device, referring page, page or player identifier, and content identifier.
Playback, start, completion, duration, error, approximate location, timestamp, and engagement information.
2.7 Information from Customers and Business Partners
We may receive information from your employer or organization, brands, agencies, retailers, retail media networks, marketplaces, production partners, experts and creators, technology providers, authentication providers, analytics providers, payment processors, public sources, and other partners.
2.8 Information from Public Sources and Websites
Certain Services may retrieve or analyze publicly accessible online information, including product-detail pages, titles, descriptions, images, ratings, pricing, availability, attributes, categories, structured data, retailer specifications, and other webpage information. Website-derived data may change and may not always be complete or accurate.
Payment-card information may be collected directly by a payment processor. We may receive limited transaction details without receiving the full card number.
We may log API requests and metadata to authenticate requests, operate the API, enforce limits, troubleshoot errors, prevent abuse, support customers, maintain security, and comply with law.
3. Cookies and Similar Technologies
We and our service providers may use cookies, local storage, pixels, software development kits, server logs, and similar technologies to keep users signed in, authenticate users, maintain security, remember settings, provide functionality, analyze performance, diagnose errors, measure content engagement, improve the Services, and support marketing where permitted.
Strictly Necessary Cookies
Required for authentication, security, account access, and essential functionality.
Functional Cookies
Remember preferences and improve usability.
Analytics Cookies
Help us understand traffic, performance, and use of the Services.
Advertising or Marketing Cookies
May be used to measure campaigns or provide relevant advertising where such technologies are used and legally permitted.
You can manage cookies using browser controls and any preference tools we make available. Blocking some cookies may prevent parts of the Services from operating correctly. Specific providers currently in use should be identified in the Company's cookie notice or consent-management interface where required.
4. How We Use Personal Information
4.1 Provide the Services
Create and manage accounts and authenticate users.
Provide portals, dashboards, content workflows, hosting, media delivery, reports, audits, transcripts, captions, structured data, and API access.
Process projects, orders, scheduling, review, approvals, integrations, support, and contractual obligations.
4.2 Process and Generate Content
Analyze product pages and other authorized sources.
Generate reports, recommendations, summaries, chapters, FAQs, transcripts, metadata, JSON-LD, structured information, and deliverables.
Match projects with experts and support content-production workflows.
4.3 Operate and Secure the Services
Monitor performance, diagnose errors, prevent fraud and abuse, detect unauthorized activity, enforce limits, protect credentials, maintain logs, investigate incidents, back up systems, and maintain business continuity.
4.4 Communicate With You
Respond to inquiries, provide support, send service and security messages, provide project updates, and send billing, policy, or account notices.
4.5 Improve and Develop the Services
Analyze trends, evaluate features, develop and test functionality, improve workflows and automated systems, conduct internal research, and create aggregated statistics.
4.6 Marketing
Send newsletters, product information, event or survey invitations, and measure or personalize business communications, subject to applicable law and your preferences.
4.7 Legal and Business Purposes
Comply with law, respond to legal process, enforce agreements, conduct audits, protect rights and safety, complete corporate transactions, and satisfy accounting, tax, insurance, and recordkeeping obligations.
Where we use artificial-intelligence or automated-processing providers, we will configure and contract with those providers as appropriate to the service and our customer commitments. Unless expressly disclosed and authorized, we do not use confidential Customer Content to train publicly available general-purpose artificial-intelligence models.
5. Legal Bases for Processing
Where European, United Kingdom, or similar data-protection law applies, we may process personal information based on performance of a contract, legitimate interests, consent, legal obligation, or protection of rights and safety. Where we rely on legitimate interests, we consider the nature of the information, reasonable expectations, and potential effects of processing.
6. How We Disclose Personal Information
6.1 Service Providers
We may disclose information to vendors that help host infrastructure, store or deliver data and media, authenticate users, process payments, send communications, provide support, monitor systems, analyze usage, transcribe or process content, prevent fraud, maintain security, or provide professional services.
6.2 Customers and Organization Administrators
If you use the Services through an organization, we may disclose account, project, usage, or activity information to its authorized administrators. Project information may be shared with authorized brands, agencies, retailers, marketplaces, retail media networks, production partners, and designated participants.
6.3 Experts, Creators, and Production Partners
We may disclose information needed to coordinate projects with experts, creators, talent, contractors, production companies, shipping providers, editors, reviewers, and other participants.
6.4 Integrations and Customer-Directed Disclosures
We may disclose information through APIs, exports, webhooks, embedded players, customer-configured destinations, and other connections enabled or requested by a customer.
6.5 Affiliates and Corporate Transactions
We may disclose information to affiliates under common ownership or control and in connection with a proposed or completed merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction.
6.6 Legal Compliance and Protection
We may disclose information when reasonably necessary to comply with law, respond to lawful requests, enforce agreements, investigate fraud or misuse, protect security, protect rights or safety, or establish and defend legal claims.
6.7 With Consent
We may disclose information for another purpose when you direct us to do so or provide consent.
7. Sale and Sharing of Personal Information
We do not sell personal information for money. Some privacy laws define sale, sharing, or targeted advertising broadly enough to include certain disclosures involving advertising cookies or similar technologies.
If we use technologies that constitute selling, sharing, or targeted advertising under applicable law, eligible individuals may opt out through a "Your Privacy Choices" link, cookie-preference tool, recognized opt-out preference signal where required, or the contact methods below. We do not knowingly sell or share the personal information of individuals under 16.
Before publication, the Company should confirm whether advertising, retargeting, cross-context behavioral advertising, or third-party campaign pixels are active and ensure the website configuration matches this disclosure.
8. Data Retention
We retain personal information for as long as reasonably necessary to provide the Services, maintain accounts, fulfill projects, honor customer instructions, meet contractual obligations, maintain security, resolve disputes, enforce agreements, and comply with legal, accounting, tax, and recordkeeping requirements.
Retention periods vary by information type, customer agreement, sensitivity, and law. Account information may be retained while active and for a reasonable period afterward; project content according to applicable agreements; API and security logs for troubleshooting, security, compliance, and abuse prevention; transaction records for accounting and tax requirements; and marketing information until opt-out or no longer needed.
Backup copies may remain for a limited period until overwritten under ordinary procedures. We may retain aggregated or deidentified information that cannot reasonably be linked to an individual.
9. Security
We use administrative, technical, and physical safeguards designed to protect personal information, such as access controls, authentication, role-based permissions, encryption where appropriate, logging, monitoring, secure-development practices, vendor management, backup and recovery, and incident response.
No transmission or storage system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting account credentials and API secrets and notifying us promptly of suspected unauthorized access.
10. International Data Transfers
The Desire Company is based in Chicago, Illinois, United States. Personal information may be processed in the United States and other countries where we or our service providers operate. Those countries may have data-protection laws different from the laws where you live.
Where required, we use recognized safeguards for international transfers, which may include contractual protections, data-processing agreements, or other legally approved mechanisms.
11. Your Privacy Rights
Depending on where you live and subject to exceptions, you may have the right to know whether we process your personal information; request access, correction, deletion, or portability; restrict or object to processing; opt out of sale, sharing, or targeted advertising; withdraw consent; opt out of marketing; appeal certain decisions; and not receive discriminatory treatment for exercising a right.
These rights are not absolute. We may retain information needed to complete a transaction, provide a service, maintain security, comply with law, protect legal rights, or fulfill another permitted purpose.
11.1 Submitting a Request
Submit a request by emailing hello@thedesirecompany.com with the subject line "Privacy Request." Describe the right you wish to exercise, your relationship with The Desire Company, the email address associated with your account or interaction, and information reasonably necessary to locate your records. We may request additional information to verify identity and protect against fraudulent requests.
11.2 Authorized Agents
Where permitted, you may authorize another person to submit a request. We may require evidence of authority and may verify your identity directly.
11.3 Customer-Controlled Data
If we process information solely on behalf of a customer, we may direct your request to that customer or assist the customer in responding. The relevant brand, retailer, agency, employer, or other organization may be responsible for the request.
11.4 Appeals
Where applicable law provides an appeal right, you may appeal a denial by replying to our decision or emailing us with the subject line "Privacy Request Appeal."
12. California Privacy Notice
This section applies to California residents and supplements the rest of this Privacy Policy.
12.1 Categories of Personal Information
Depending on your interaction, we may collect identifiers; California customer-record information; commercial information; internet or electronic-network activity; approximate geolocation; audio, electronic, and visual information; professional or employment information; inferences; and limited sensitive information such as account credentials. We do not necessarily collect every example included within a statutory category.
12.2 Sources
We collect these categories from you, your organization, customers, business partners, experts and creators, service providers, devices and browsers, public sources, integrations, and connected services.
12.3 Business and Commercial Purposes
We use these categories to provide and support Services, process projects and transactions, authenticate users, operate APIs and integrations, generate requested content and reports, maintain security, analyze and improve services, communicate, market, comply with law, and protect legal rights.
12.4 Categories Disclosed for Business Purposes
We may disclose these categories to cloud, hosting, security, analytics, payment, communication, transcription, content-processing, professional-service, customer, organization-administrator, project participant, affiliate, and customer-selected integration recipients.
12.5 Sale, Sharing, and Targeted Advertising
We do not sell personal information for money. Depending on website technologies, certain advertising-related disclosures may be considered sharing. Where applicable, California residents may opt out through the mechanisms in Section 7.
12.6 California Rights
California residents may have rights to know, access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive information where applicable, and receive equal service and pricing when exercising rights.
Requests may be submitted under Section 11.
13. European Economic Area, United Kingdom, and Switzerland
Individuals in the European Economic Area, United Kingdom, or Switzerland may have rights to access, correct, erase, restrict, object to processing, and receive certain personal information in portable form. You may withdraw consent where processing is based on consent and may lodge a complaint with a local data-protection authority.
Where a customer or another organization is the controller, requests should be directed to that organization.
14. Other U.S. State Privacy Rights
Residents of other U.S. states may have similar rights, including access, correction, deletion, portability, opt-out of targeted advertising or certain sales, and appeal. We will process verified requests as required by applicable law.
15. Automated Processing
The Services may use algorithms, matching systems, scoring tools, artificial intelligence, or other automated technologies to assist with product analysis, content recommendations, expert matching, categorization, transcription, report generation, structured-data generation, fraud prevention, security, and workflow automation.
These tools support business processes and may not always be accurate. Unless expressly disclosed, we do not use automated processing to make decisions that produce legal or similarly significant effects about consumers without meaningful human involvement.
16. Children's Privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information, contact hello@thedesirecompany.com and we will investigate and take appropriate steps.
Business customers must not submit children's personal information unless expressly authorized and all required notices, permissions, and parental consents have been obtained.
17. Third-Party Services and Links
The Services may contain links to or integrate with third-party websites and services. We are not responsible for the privacy, security, content, or practices of third parties. Review their policies before providing information.
18. Email Communications
You may opt out of promotional emails by using the unsubscribe link. Even after opting out of marketing, you may receive account, security, project, transaction, legal, or other non-promotional messages.
19. Google API Services and google ads data
Some of our services connect to Google APIs on behalf of our customers, including the Google Ads API (Keyword Planner), the YouTube Data API, and the Google Search Console and Site Verification APIs.
Data we access. With the Google Ads API we access aggregate keyword statistics (search volumes, competition, related keywords) through a Google Ads account controlled by The Desire Company; we do not access campaign, billing or personal data of any Google user. With the YouTube Data API we access public video metadata and public comments. With the Google Search Console API we access search performance data (queries, impressions, clicks, positions) for a website domain only after the site owner has explicitly authorized our service account, for example by adding a DNS verification record.
How we use it. We use this data solely to produce analyses and reports for the customer who owns the products or website concerned, such as consumer-demand and content-opportunity insights, and to operate and improve those features.
How we share it. We share this data only with the customer it relates to and with the service providers that host and operate our platform under confidentiality obligations. We do not sell it, use it for advertising, or share it with data brokers.
How we protect it. Data is transmitted over encrypted connections, stored on access-controlled infrastructure, and accessible only to personnel who need it to operate the service.
Retention and deletion. We retain the analyses generated from this data for as long as the customer's account is active and delete or de-identify them when the account is closed or on request at hello@thedesirecompany.com. A website owner can revoke our Search Console access at any time by removing the DNS verification record or the property permission, after which we stop accessing that data.
Limited Use. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
20. Do Not Track and Opt-Out Signals
Some browsers transmit Do Not Track signals. Because there is no universally accepted technical standard, the Services may not respond to traditional Do Not Track signals.
Where required by law, we will process recognized opt-out preference signals, such as Global Privacy Control, as a request to opt out of covered sale or sharing activity for the associated browser or device.
21. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our Services, practices, technology, or legal obligations. When we make material changes, we may provide notice through the Services, by email, or another reasonable method. The Last Updated date identifies when the revised policy became effective.
We will not use previously collected personal information in a materially different manner without notice or consent where required by law.
22. Contact Us
Questions, concerns, or privacy requests may be sent to:
DesireList, Inc. dba The Desire Company
4245 N. Knox Avenue
Chicago, Illinois 60641
United States