Privacy policy, StoreSweep

Visitors to storesweep.app

This website runs no analytics and loads no outside scripts, fonts or images. It sets one cookie, and only if you press the light or dark button: it remembers that choice and nothing else. We do not know who reads it. It is served by Cloudflare, which handles the requests needed to deliver the pages and keeps its own short lived server logs under Cloudflare's privacy policy.

If you email us, we keep the email for as long as the conversation is useful, and delete it on request.

Stores we contact

We find US online stores and email one person at each about what our scan of their store found. This is business to business marketing under the CAN-SPAM Act. Here is what that involves.

What we collect

Store web addresses. We get these from public lists of websites, the same kind search engines are built from (one of them is called Common Crawl). Nothing about a store is private at this stage, since this is only a list of shop addresses.
A business contact email address, read from the store's own public pages: contact, about, privacy and terms pages, and the home page footer. We prefer a role address such as info@ over a named person. We never buy lists, scrape social networks, or guess addresses.
Scan results: which scripts load on the store's public pages, which outside domains they come from, the security headers those pages send, accessibility violations found by the axe-core engine, and a screenshot of the checkout page as any shopper would see it. The bot enters nothing and creates nothing, so no shopper's data and no customer's data is ever involved. What the bot does is described in full on its own page.
Whether the email address works. Before we send anything, we ask a service called MillionVerifier whether the address can receive mail. They see the address and nothing else, and they tell us yes or no.
Your reply, if you send one, and what happened to each email we sent.

What we do not do

We use no tracking pixels, open tracking or tracked links, so we cannot tell whether an email was opened.
If you reply asking for your report, it is sent to you straight away. Every other reply is read and answered by a person.
One sequence of three messages per store, once. A store that does not answer, or says no, is never written to again.
Nothing is sold, rented or shared for anyone else's marketing.

How long we keep it

Store and scan records are kept while we may still contact the store, so that we can keep the limits above. Reply STOP to any email and the address and the domain go on a permanent suppression list, which we keep indefinitely because it is what stops us from contacting you again. Everything else about the store is deleted on request.

Your choices

Reply STOP, or email hello@storesweep.app with the domain or address, to stop contact, to see what we hold, or to have it deleted. We act within 10 business days and confirm by email. To stop the bot from visiting your store at all, see the opt out section of the bot page.

Customers

What we collect

Account details: your name, email address, company name, and the store addresses you ask us to monitor.
Your password, kept only in a scrambled one way form (a salted scrypt hash). Nobody here can read it back, and we will never ask you for it.
Billing is handled by Stripe. Your card number goes to Stripe and never to us. We receive the last four digits, the card brand, and whether a payment succeeded. Stripe's handling is covered by Stripe's privacy policy.
Scan records for your store: script inventories, headers, accessibility findings, screenshots of your public pages, the changes between scans, and every authorization, note and decision you record. These are the evidence your account exists to produce.
Emails we send you: alerts and weekly digests, and a record of each one's delivery. They come from alerts@storesweep.app, contain no tracking pixels or remote images, and you can turn digests off from any of them.

Who else sees it

Your scan records are visible to you and to anyone you give access to, such as an agency that manages your store or an assessor you share an evidence pack with. We look at them when you ask for help or when something in the system needs a person. We do not share them with anyone else. Our email is delivered by Google Workspace, our servers are at DigitalOcean, and this site and our encrypted backups are on Cloudflare. Each processes data only to provide the service.

How long we keep it

For as long as your account is active. When a paid plan ends, your records stay for 90 days so you can export them or come back, then they are deleted. You can ask for deletion sooner at any time. Invoices are kept for as long as tax law requires.

Free scans

If you ask for a free scan, we collect your name, your business name, the store address and email address you enter, and the network address your request came from. We use them to run one scan of that store, to email you the report, and to stop the form being used to send mail at other people. We do not add you to a mailing list. Requests are kept for 12 months and then deleted; write to hello@storesweep.app to have yours deleted sooner.

For everyone

Where data lives. In the United States. We serve US stores and do not target people in other countries.
Children. The service is for businesses. We do not knowingly collect anything from anyone under 18.
Security. Data is encrypted in transit. Credentials are never stored with the data they unlock. Access is limited to the people who run the service.
Legal requests. We hand over data only when the law requires it, and we tell you when we are allowed to.
Changes. When this policy changes, the date at the top changes, and customers are told by email if the change affects them.

Contact

CtrlAltCreate LLC, 1209 Mountain Road Pl NE STE R, Albuquerque, NM 87110. hello@storesweep.app.