Privacy policy

Information we collect

What we collect depends on how you interact with us. You may visit our website, send us a message, run a store we write to or be our client.

• Booking a call. When you book a call, we keep the time you pick and its time zone. We keep your name, your email address and your store's web address and platform. We ask whether your store has had a demand letter or a complaint about its accessibility, and we keep your answer. We also keep anything else you tell us.
• Contact form. When you use our contact form, we keep your name, email address, organization, the topic you pick, your store's web address and your message.
• Date and time. We keep the date and time each booking or message came in.
• Visiting our website. When you load a page, your browser sends our host, Cloudflare, what any host receives. It sends your IP address, the page you asked for and your browser's name and version. From Cloudflare Web Analytics we see totals only, such as how many pages people loaded and from which countries. While Google Analytics is on, it also counts visits for us. We explain both in full under "Cookies and other technologies."
• Stores we check. Before we write to a store, our crawler looks at its public pages at the pace of a single visitor. It obeys the store's robots.txt, the file where a store says what crawlers may visit. It does not sign in or buy anything.

• Screenshots and page source. Our screenshots of a page show what any visitor to that page sees. This can include a name a customer published in a review. We blur such a name in our screenshots and replace it in the page source we keep. We do this only where a review app we recognize displays it.

  Wherever we find email addresses and phone numbers on a page, we blur them in our screenshots and replace them in our stored page source.

• Store owners we write to. We write to the person who runs the store, at a business email address. We find that address on the store's own pages, or through business contact services such as Hunter and Apollo. Sometimes we look it up on a public professional profile, such as LinkedIn. If we find no one, we use the email address the store publishes.

• Client records. For each client, we keep a record of our checks and fixes on its store, which our signed agreement with the client also covers. It holds dated entries, the fixes, the client's approvals of them, the documents we issue and our keyboard tests. We keep all of it permanently, including the screenshots inside documents and the video and screenshots of keyboard tests.

  It also holds each store contact's name, email address and role, and each approval records the approver's name, email address and what they wrote. Other screenshots of the store's pages are client store data, covered in the next item, and are deleted 24 months after the agreement ends.

• Client store data. We keep screenshots of a client's store pages, their page source and our check results. We keep the product data and sitemaps we read from the store.
• Store emails. For each client, we set up an inbox of our own, which is never the client's mailbox. From it, we create an account, join the newsletter and place one test order, then check and keep every email the store sends.

Cookies and other technologies

Two tools count visits to our website: Cloudflare Web Analytics and Google Analytics. Here we explain what each one does, what your browser stores and how you turn Google Analytics off.

We do not put a tracking pixel, advertising tag, chat widget or accessibility overlay on our website.

• Cloudflare Web Analytics. Cloudflare hosts our website. Cloudflare Web Analytics is a small script that runs on every page, for every visitor, and counts page loads for us. It stores nothing in your browser: no cookies and no local storage. It does not record the part of a web address after a question mark.

  It shows us totals only: how many pages visitors loaded, which pages, and which websites sent people to them. It also counts those page loads by country, kind of device (desktop, phone or tablet), browser and operating system. It shows how fast the pages loaded, too.

• Google Analytics: when it runs. Google Analytics counts visits and shows us which pages people read and how they found us. To know where you are, our website asks Cloudflare which country your connection comes from. We keep no record of your country.

  In the European Economic Area, the UK and Switzerland, nothing from Google loads until you say yes. There, a box at the foot of the screen asks "Can we use Google Analytics?" with the buttons "Yes, that's fine" and "No thanks." If we cannot tell where you are, we ask you. Everywhere else, Google Analytics loads with the page, and you can turn it off.

• Google Analytics: what it receives. With each page you load, Google Analytics receives the page's web address, its title and the page you came from. It also receives your browser's name and language, your operating system, your kind of device and your screen's size. It uses your IP address to work out roughly where you are. Google says the service does not log or store your IP address.
• Google Analytics cookies. Google Analytics uses two cookies. The first, "_ga", tells one browser from another. The second, whose name is "_ga_" followed by letters and numbers, keeps track of a visit. Google sets each to last two years. Some browsers cut that: Chrome to at most 400 days, Safari to seven days.
• What we turned off in Google Analytics. We turned off its advertising features: Google signals and ad personalization. We also turned off every setting that would let Google use the data Google Analytics collects on our website for other purposes. Google says that with those settings off, it uses that data only to provide and maintain Google Analytics.
• Privacy choices. A button named "Privacy choices" sits at the foot of every page. It tells you whether Google Analytics is on and lets you say yes or no. Saying no turns Google Analytics off and deletes its two cookies.
• Global Privacy Control. If your browser sends the Global Privacy Control signal, Google Analytics stays off wherever you are. There is nothing for you to do.

• Local storage. The Colors menu on every page lets you choose "Light" or "Dark," and your browser keeps that choice on your device. That choice lasts until you change it. Choosing "Match my device" removes the saved choice. The choice only sets how our website looks.

  Your browser also keeps your Google Analytics choice until you change it or clear its data. It never sends either choice to us. Cloudflare Turnstile, the bot check on our call booking and contact pages, also leaves one item in your browser.

• Cloudflare Turnstile. Our call booking and contact forms use Cloudflare Turnstile to tell people from bots. No other page loads it. Turnstile receives your IP address, your browser details, which site you are on and a fingerprint of how your browser connects. Cloudflare uses these to run the check for us and to improve its bot checks. Cloudflare describes this in Turnstile's privacy addendum.

  On those two pages, Turnstile keeps one item in your browser's local storage, under Cloudflare's own address, challenges.cloudflare.com, and sets no cookies. The item stays after you leave the page and when you come back, until you clear your browser's data. Our website cannot read the item, and Cloudflare does not say what the item holds or how long it lasts.

• Do Not Track. Some browsers send a "Do Not Track" signal. Our own code does not follow anyone across other websites, so a Do Not Track signal changes nothing on our website. Global Privacy Control is the signal that does.

How we use your information

• Responding to your requests. We use what you send us to answer you. For a booked call, we also look at your store's public pages and email you a reminder before the call. We do not add anyone to a mailing list.
• Writing to stores. We use the names and email addresses we find to write to the person who runs a store. Before we write, we ask an email-checking service in New Zealand whether the address can receive mail.
• Our first email. Our first email to a store says who we are, why we wrote and where we found the address. It says you can ask us to stop, and it links to this privacy policy.
• Client work. We use what we collect about a client's store to do the work our agreement with the client covers. Outside that work, we use findings from a client's store only in figures that name no store.
• Keeping the site working and safe. We use what our website receives to serve its pages and to tell people from bots on our forms.
• Understanding how our website is used. We use Cloudflare Web Analytics to see how many pages people load and how fast those pages load. While Google Analytics is on, we use it to learn what people read on our website and what led them to us.
• Automated decisions. No software makes a decision about a person on its own. Our checks assess a store's pages. They do not assess people.

Legal bases for using your information

Where EU or UK law applies, we need a legal basis for each use of your personal information. These are the legal bases we rely on.

• Responding to your requests. Taking steps you asked us to take before entering into an agreement.
• Writing to stores. Our legitimate interest in offering a service to businesses it may help. You can object at any time, and we stop.
• Client work. Performing our agreement with the client.
• Keeping the site working and safe. Our legitimate interest in a website that works and is safe.
• Understanding how our website is used. For Google Analytics, your consent, which you can take back at any time in Privacy choices. For Cloudflare Web Analytics, our legitimate interest in knowing how our website is used and how fast its pages load.

How long we keep your information

• What you send us. We keep what you send us, a booked call's calendar entry and our emails with you. We keep them for up to 24 months after we last hear from you.
• Names and email addresses we find. We keep these separately from the record of our checks, for 24 months after our last email.
• Screenshots of stores we write to. We delete a store's screenshots and page source 24 months after our last check of it. Our record keeps each check's date and what it found, but not the screenshots.
• Requests to stop. If you ask us to stop writing to you, we stop. We keep your email address only on a list that stops us writing to it again.
• Client records. We retain the record of a client's store permanently. It is the client's evidence, and no entry in it can be edited or deleted.
• Client store data. 24 months after the agreement ends, we delete the screenshots of the store's pages, their page source and the check results. At the same time, we delete the product data and sitemaps we read from the store, and the emails it sent us. A client can ask us to delete these sooner, once 12 months have passed since the agreement ended.
• Legal hold. If a client receives a claim or demand letter and tells us, we put a legal hold on its evidence. We delete nothing until the hold ends.
• Cloudflare's logs. Cloudflare keeps its own logs of the forms and emails it handles for us, such as which emails it delivered, for up to 31 days.
• Google Analytics. Google keeps the data about each visitor for two months. The two months do not affect our reports of totals, which stay after that. The two Google Analytics cookies last up to two years, less in some browsers.
• Cloudflare Web Analytics. We can see its totals for the previous six months.
• Email-checking service. Our email-checking service normally deletes both the address we send it and its answer within 30 days.
• Backups. Our backups hold older copies of what we keep. We delete each backup 90 days after we make it.

How we share your information

We do not sell personal information or share it for advertising.

We do not publish what we find on a store.

We share personal information with the service providers and other parties below.

• Cloudflare. Cloudflare hosts our website and runs its forms. It keeps what you send through the forms and emails us a copy. It also receives and keeps the emails stores send to the inboxes we sign up with for our checks. It also runs Cloudflare Web Analytics, which counts page loads on our website and shows us totals only. For a booked call, Cloudflare sends our reminder email, so it receives your name, your email address and the call's time.

• Google. Google Workspace runs our email and our calendar. A booked call goes on our Google Workspace calendar with you as its guest. The calendar entry holds your store's web address, your name, the time zone you picked, your answers and anything else you told us. Google sends the invitation with a Google Meet link.

  It also runs Google Analytics for us. When Google Analytics is on, it counts visits to our website. Google explains how it uses information from sites that use its services.

• Mail-handling service. A mail-handling service in the US runs our postal mailbox. It opens and scans each letter the day it arrives, so we can read it online.
• Provider of AI models. A company in the US provides AI models that help us with our work, such as drafting text and code that a person then checks. They can work on the things people send us and on what we have recorded about a client's store.
• Email-checking service. We send our email-checking service the address we mean to write to. It does not use that address for its own purposes.
• Financial and professional services. We share a client's agreement and our invoices with our bank, insurers and accountants, in confidence.
• Legal requirements. When the law requires us to disclose something, we do.
• Protection of rights. Besides legal requirements, we may share what we hold when we need to protect our rights, our business or someone's safety. We may also share it to stop fraud.
• Business transfer. If we sell or merge all or part of our business, we may pass what we hold to the buyer in that transaction.

Your rights and choices

Wherever you live, you have the rights below.

• What you can ask. You can ask for a copy of the personal information we hold about you, or a copy you can take elsewhere. You can ask us to correct it or delete it, to limit how we use it or to stop using it. You can also object to our emails.
• How to ask. Email hello@evenentry.com, or write to us at the postal address in the "Contact us" section.
• Our response. We answer in writing within one month. We may ask you to confirm your identity.

• Deletion. On request, we delete what you sent us, our emails with you, any call's calendar entry, and our screenshots and page source of your store. We keep a client's record permanently, as the section "How long we keep your information" describes.

  A client's screenshots, page source, check results, product data, sitemaps and store emails are deleted 24 months after the agreement ends. If the client asks, we delete them earlier, but never sooner than 12 months after it ends.

  If a client tells us of a claim or a demand letter, a legal hold applies, and we delete nothing it covers until it ends. If you asked us to stop writing to you, we keep your email address only on the list that stops us.

• Copies of client records. A client receives a copy of its record within 10 business days of asking.
• Declining to provide information. Sending us anything is optional. Without an email address, we cannot answer you.

Complaints

You can bring a complaint to us first, by email or post. You can also complain to a data protection authority, as described below.

• Our process. Within 30 days, we confirm we have received your complaint. We then inform you of the action we took on it.
• Appeal. If you disagree with our answer, you can appeal by replying to it with the word "appeal". We then review the complaint again within 60 days.
• In the EU. You can complain to the data protection authority where you live or work, or where you think the problem happened.
• In the UK. You can complain to the Information Commission.

Third-party websites

Our pages link to other websites, such as the texts of laws and standards and the sources we cite.

We do not control those websites. Their own privacy policies apply there.

Security

Our access and security page explains how we handle the access a client gives us.

No way of storing or sending information over the internet is free of risk. For that reason, we cannot promise that what we hold will never be accessed without authorization.

International transfers

The service providers above store the personal information people send us in more than one country. We also keep it in our own systems.

Our team works outside the EU and the UK, and that is where we read what people send us. The services above handle it too, as each item says.

Neither the European Commission nor the UK has made an adequacy decision that covers us. We have not joined the EU-US Data Privacy Framework.

• Cloudflare and Google. Both have joined the EU-US Data Privacy Framework and its UK Extension. If the framework stops covering either company, for any reason, that company's data processing terms fall back on the European Commission's standard contractual clauses. Their terms are in Cloudflare's data processing addendum and Google's data processing addendum.
• Provider of AI models. Our provider of AI models relies on the European Commission's standard contractual clauses, as its own privacy policy says. It is not part of the EU-US Data Privacy Framework. You can ask us for a copy of what its terms say about this, and we will send it.
• Email-checking service. A company in New Zealand runs our email-checking service. The European Commission and the UK have both formally found that New Zealand protects personal data well enough. The service may keep or use the addresses it checks for us in New Zealand, the United States and the European Economic Area, including Hungary. It may also use them in other countries where its own providers work, and it says each must protect them to a similar standard.

Children

Our website is for businesses and is not meant for children.

If you think a child has sent us personal information, tell us, and we delete it.

Changes to this policy

When we update this policy, we put the new date at the top. The list of changes at the end says what is different.

Each earlier version stays at its own web address, word for word.

If you are our client, we email you before any change to how we handle your personal information takes effect.

Contact us

For questions about this policy, or to exercise any of the rights above, contact us.

• Email: hello@evenentry.com
• Post: Even Entry LLC, 30 N Gould St #61312, Sheridan, WY 82801, USA