What we collect, and what we do with it.

Second Income is operated by International Business Services LLC, 33 N Gould St, Sheridan, WY 82801, USA. We are the controller of the personal data described here.

For anything privacy related, email hello@secondincome.online.

• Application answers. Country, age band, employment and income situation, availability, existing directorships or ownership, and the status questions on the form.
• Contact details. Name, email address, phone number, and postal address where an appointment requires it.
• Identity and verification documents. Government ID, proof of address, and a selfie. In the United States, a credit report you authorise us to obtain or upload. A criminal record declaration, and an optional background check where you consent to one.
• Account data. Portal login credentials (passwords are hashed and never visible to us), notifications, messages with your case handler, and appointment records.
• Payout details. Collected only after approval, when there is something to pay.
• Website and advertising measurement data. Pages viewed, referring URL, coarse device and browser information, a first-party visitor identifier, and advertising click parameters (for example fbclid, utm_source, campaign, ad set and ad identifiers) when you arrive from an ad.

• To assess whether you are eligible and to make a decision on your application.
• To verify your identity, which is a legal requirement for company appointments.
• To arrange bank, notary and registry appointments and to keep your file current.
• To operate your portal account, pay you, and contact you about your application.
• To send marketing email, only if you opted in. You can unsubscribe at any time.
• To measure which ads and pages produce applications, so we do not waste spend.
• To meet record-keeping obligations in the jurisdictions where you are appointed.

For applicants in the EU, EEA and UK, our lawful bases are performance of a contract or steps taken at your request (assessment, appointment, payment), legal obligation (identity verification and record keeping), consent (marketing email, optional background checks, advertising measurement), and legitimate interests (fraud prevention, service security).

We advertise on Meta (Facebook and Instagram). Our site loads the Meta Pixel, and our server sends matching events to Meta through the Conversions API so we can tell which ads produce applications. Identifiers sent to Meta from our server (email, phone, name, country) are hashed with SHA-256 before they leave our systems. We do not send Meta the answers on your application, your documents, or your credit information.

We also keep our own first-party page analytics and ad click attribution in our database. That data is not sold and is not shared with third-party data brokers.

You can control ad personalisation in your Meta ad preferences and block cookies in your browser settings. Blocking them does not affect your application.

We do not sell your personal data, and we do not share your documents for marketing.

• Banks, notaries and company registries involved in a specific appointment, and only after you have signed the engagement letter that authorises it. Registry appointments are public records by law.
• Service providers that run the platform on our behalf: hosting and database, email delivery, address lookup, and advertising measurement. They act on our instructions.
• Authorities, where we are legally required to respond.

Data is processed in the United States and, for appointments, in the country of the company you are appointed to.

If you withdraw before signing an engagement letter, you can ask us to delete your uploaded documents and we will remove them. Declined applications and their documents are removed within 12 months unless we are required to retain them.

Once an appointment is live, retention follows the record-keeping rules of the relevant jurisdiction, which commonly require several years after the appointment ends.

You can ask for a copy of your data, correct it, ask us to delete it, object to or restrict processing, withdraw consent, and ask for your data in a portable format. In the EU, EEA and UK these are GDPR and UK GDPR rights. In California you can request disclosure and deletion, and opt out of any sale or sharing, which for us is already the default because we do neither.

Email hello@secondincome.online from the address on your application and we will respond in writing. If you are in the EU, EEA or UK, you can also complain to your local data protection authority.

Documents are stored in a private, encrypted bucket that is never publicly reachable by URL, access is limited to the reviewers working on your file, and access is logged. Security and privacy has the plain-language version.

The service is for adults aged 21 and over. We do not knowingly collect data from anyone under 21, and applications from under-21s are rejected.

If we change this policy we update the date at the top. Material changes affecting current owners are also sent by email.