Your data, our discipline.

• Your domain when you run an audit (so we can scan it).
• Email address when you sign up, sign in, or pay.
• Payment info via Stripe. We never see or store card numbers — Stripe holds them.
• Service intake fields (hosting provider, contact preference, optional notes) when you start a $500 fix engagement.
• Analytics cookies (Google Analytics) — only after you accept the cookie banner. Declined or Do-Not-Track means no tracking.

• Card numbers, CVVs, or banking credentials.
• Third-party ad-tracking cookies. We don’t sell, share, or license your data to ad networks.
• Cross-site fingerprints. No session-replay scripts, no heatmaps, no behavioural ad tech.
• More than we need. Every field on the intake is justified; every field is optional except the ones the engagement requires to scope the work.

Audit data is retained as long as your account is active. Service engagements: we delete intake notes + artifacts 30 days after the engagement closes, unless you opt to keep your audit history (a settings toggle on /portal/settings).

You can request deletion of your account + all associated data at any time by emailing hello@counderscore-theshift.com. We acknowledge within 1 business day and complete deletion within 7 days.

We use the following service providers. Each handles a well-scoped slice of the data — no single provider sees the whole picture.

• Supabase — database + authentication.
• Stripe — payments, card data.
• Resend — transactional email delivery.
• Netlify — application hosting + serverless functions.
• Anthropic, OpenAI, Google, Perplexity, xAI — we send anonymised queries (your domain + topic) to these LLM APIs to measure citation visibility. We do not send personal data.

You can request a copy of your data, correct it, or delete it at any time. Email hello@counderscore-theshift.com. If you’re in the EU, the UK, or California, you have additional statutory rights — exercise them the same way; we honour them.