# Compliance: GDPR, CCPA, CAN-SPAM and TCPA — Ravn

Canonical: https://askravn.com/compliance

Compliance

# Built to keep you compliant.

Contact data is only useful if you can use it lawfully. Here is what we do, and what stays your responsibility.

## Software, not a data seller

Ravn is software. Rook doesn't sell, rent or license databases of people. Our only database is a directory of business facts — company names, categories, addresses, websites and generic role addresses like info@. People lookups run on your own provider account, on your instructions, and the results stay in your account. Because Rook isn't a data broker, there's nothing to register with California's DROP platform — anyone who wants out uses our [opt-out form](https://askravn.com/privacy#optout) instead, which blocks their email or phone everywhere in Ravn.

## Privacy laws (GDPR, CCPA and US state laws)

We honour opt-out and deletion requests from anyone. For data you send us, such as lists to validate, you are the controller and Rook is your processor, acting only on your instructions under our [Data Processing Agreement](https://askravn.com/dpa). For data you receive, you are responsible for having a lawful basis for how you use it.

## Outreach laws (CAN-SPAM, CASL, TCPA)

Verifying emails and checking whether a number is a mobile helps you avoid bounces and wrong-number texts, but it is not consent. You must get the consent your outreach needs and honour every unsubscribe.

## Not a consumer reporting agency

Ravn is not a consumer reporting agency under the Fair Credit Reporting Act. Our data must never be used to decide anyone’s eligibility for credit, employment, insurance or housing.

## Security

- API keys and tokens are stored only as hashes and shown once.

- Opt-outs are stored as one-way fingerprints, not plain addresses.

- Website reads are fetched safely and can never reach private networks.

- Report a vulnerability to [security@askravn.com](mailto:security@askravn.com).

Questions about a data processing agreement or a specific law? Email [privacy@askravn.com](mailto:privacy@askravn.com).