`docs/ADVERTISER_DATA_POLICY.md`

82 lines
# RENTV Advertiser Intelligence — Data & Source Policy

The privacy, research, and source rules from the master prompt (§6), restated as
**operational policy**. Every rule here is enforced in code, not merely documented —
see `docs/SECURITY_ADVERTISER_VIEWER.md` for the enforcement points and the test suite.

## 1. No LinkedIn scraping — ever

- The generic fetcher hard-blocks `linkedin.com`, `www.linkedin.com`, `m.linkedin.com`,
  and `lnkd.in` (and any subdomain). Enforced in `lib/compliance/fetch-guard.js`
  (`assertFetchAllowed`) and tested in `test/compliance.test.js`.
- We **never** crawl or copy LinkedIn profile or company page content.
- LinkedIn **URLs** may be collected only from: a search-engine API result, a public
  first-party company page, an official event/speaker page, a press release, or a manual
  user entry. For each we store only the URL, the result title/snippet (when licensing
  permits), the discovery query, the discovery date, and a manual-review status.
- Every profile is opened by a human via **Open LinkedIn** / **Search LinkedIn**
  buttons in a normal browser — the app never fetches it.

## 2. No inferred / pattern-generated emails

- We **never** infer or generate an email address from a naming pattern
  (`first.last@domain`, `flast@domain`, etc.). `looksLikePatternEmail()` detects the
  forbidden case so importers and the UI can refuse it.
- A phone or email is stored **only** when it is explicitly published as a business
  contact on a first-party company page, press release, media kit, event page,
  government record, or public professional page — or manually entered by an authorized
  user.

## 3. Explicit-public-only contacts, with evidence

- `assertContactEvidence(contact)` throws unless the contact carries a
  `source_evidence_id` **and** `explicitly_public === true`. No evidence, no storage.
- Every displayed factual field is traceable to an evidence record (source URL, owner,
  title, observed date, retrieved date, access method, parser version, confidence,
  rights/export status).
- We never store home addresses, personal mobile numbers identified as private, dates of
  birth, or sensitive/protected attributes.

## 4. No invented ad spend

- We do **not** estimate a company's ad spend. The opportunity score (§13) ranks RENTV
  **sales opportunity** using activity counts, recency, fit, and evidence quality — never
  invented dollars. The output must never be relabeled an "ad-spend estimate."

## 5. Panelist ≠ sponsor; editorial ≠ advertising

- A verified panelist/speaker is stored as `SPEAKER_OR_PANELIST_ONLY`. It may not be
  promoted to `VERIFIED_CONFERENCE_SPONSOR` / `VERIFIED_ADVERTISER` without separate
  sponsor evidence. Enforced by the classification guard and tested in
  `test/classification.test.js`.
- Editorial coverage is not advertising without a disclosure or a direct record. CoStar
  Group is seeded as `VERIFIED_CONTENT_PARTNER`, not a paid sponsor.

## 6. Suppression, correction, and do-not-contact are honored

- Correction, suppression, and do-not-contact requests are respected in search, exports,
  and outreach preparation. A suppressed or do-not-contact record is filtered out of
  every export.

## 7. Rights-aware exports

- Exports honor suppression, do-not-contact, private notes, and source rights.
  `applyExportRights(rows, kind)` filters out suppressed rows, do-not-contact /
  export-disallowed contacts, private notes, and `INTERNAL_EVIDENCE_ONLY` creative
  assets. Internal-only evidence images never leave the app.

## 8. Only official APIs; no bypassing controls

- Google Analytics, Search Console, Google Ads, Gmail, and search providers are accessed
  only through their official APIs.
- We never bypass authentication, paywalls, CAPTCHAs, robots directives, rate limits, or
  anti-bot controls, and we never scrape proprietary login-gated databases (CoStar,
  LoopNet, ZoomInfo, Apollo, MLS).
- We do not auto-open email click-tracking URLs (that would create false clicks); the
  tracking URL is stored and opened only by a deliberate human action.

## 9. Reversible merges

- Uncertain entities are never silently merged. Merges are reversible with a full
  side-by-side review, evidence, conflicts, and undo (§12).