Privacy Policy

Four kinds of information, and nothing else:

Microsoft Clarity records how pages are used, including the address of the page you are on as your browser shows it. It loads only if you allow analytics, and only on the public pages of this site — the home page, pricing, FAQ, contact, the blog and the policy pages. A public page opened at an address carrying a sign-in code, an invitation token, an email address or any other credential-like or identifying parameter does not start a recording either, for as long as it is open. It is never loaded inside your workspace — whose address carries only an opaque brand identifier, not your account name — nor on a sign-in, invitation, password or first-setup page, a shared report link, a print or PDF view, an administrative page or the content editor. Because a session recorder reads the address from your browser rather than from us, the rule about it is which pages it may load on at all, and not what we send it; moving from the public site into the product is a full page load, so the recording ends with the page. The page you came from is bounded the same way: every address outside those public pages is served so that your browser passes on this site's name alone and never the address itself. Page text is masked in Clarity's own settings for this project, so the content displayed to you is not collected; that is a setting in Microsoft's console rather than something in this site's code. Clarity is Microsoft's service, and what Microsoft does with a recording is governed by Microsoft's own privacy statement.

Google Tag Manager loads on the same permission and measures more of the site than Clarity does, including pages inside your workspace. What it receives from us is described below: reduced page addresses, and nothing that names you. Google Analytics 4 is set up through it in Google's own console and has not been switched on yet. The cookie policy describes both in more detail.

The analytics events this site sends are assembled from a fixed list of fields, checked in code and in tests. None of the following can appear in one: your email address, your name, your account, brand or competitor names, the domains you monitor, the topics or prompts you track, anything you type into a search box, the text of an AI answer, invitation links, shared report links, or sign-in codes.

Page addresses are reduced to a generic route template before they are sent, so /app/visibility/6f3f7f1e-2d5b-4a8c-9e1d-3c2b1a0f9e8d/reports is sent as /app/visibility/[brand]/reports, and an address the code does not recognise is redacted rather than guessed at. Pages whose address is itself a key — a shared report link — along with print and PDF views and every administrative page are excluded from those events entirely.

Microsoft Clarity does not take the page address from us: like any session recorder it reads the address bar itself — the page you are on, and the page you came from — so the reduction described above cannot be applied to either. That is why it is not allowed to load at all outside the public pages of this site — never inside your workspace, never on a sign-in, invitation, password or first-setup page, and never on a shared report link, a print or PDF view, an administrative page or the content editor. Google Tag Manager is not limited the same way, because what it is given is the reduced address rather than the one in your browser.

The consequence, stated rather than glossed over: session recording covers the public site only, and never the product you are paying for. Page-view measurement does cover the product, and what it reports about it is the reduced kind — a route template such as /app/visibility/[brand]/reports, with the brand identifier removed — never the address as your browser shows it.

Each of these does one job and does not go beyond it:

You can accept or reject analytics and marketing at any time, as described in the cookie policy, and a refusal is what we assume until you say otherwise. You can also ask us what information is held about you, or ask for your account and its data to be deleted.

You can ask us to delete your account from your profile settings. We verify the request with a one-time code sent to your e-mail address, record it, freeze the account at once, and give you 14 days to cancel. Requests are answered within 30 days; if a request cannot be completed in that time we tell you why before the 30 days end and may extend once by a further 30 days.

The e-mail we send when a request is recorded carries the only link that can cancel it. Cancelling asks for a fresh one-time code sent to the same address.

This is what happens when you confirm, and nothing else is promised:

Now

• Every session of yours is signed out, on every device.
• Sign-in to this account is refused while the request is open.
• Your account, your brands and the teams you own are frozen: no one can change them. Work that was already under way when you confirm may still finish and add its results, and a payment that was already under way is still recorded.
• New measurements, scheduled reports, notifications and renewal charges stop, and links you shared to your reports stop working. Work that was already queued or running when you confirm, such as the first scan of a brand you just added, may still finish.
• You have 14 days to cancel, using the link we e-mail you. Deleting your account does not start before then.

Within 30 days of your request

• Your personal data, your brands and your measurements are destroyed or made impossible to link to you.
• Every processor and recipient that received your data is asked to destroy its copy.

Kept for ten years, because the law requires it

• Invoices and payment records, under the Law of Commercial Books and the VAT regulations.
• The numbered measurement record of the paid service, with nothing in it that identifies you.

Backups

• Copies of your data can remain in backups for up to 30 days after they are destroyed, and are erased again if a backup is ever restored.

We update this notice when what we collect, or who handles it, changes. What you are reading describes the system as it is configured now, not as it is planned to be.