Privacy policy — StoreSweep

Visitors to storesweep.app

This website sets no cookies, runs no analytics and loads no third-party scripts, fonts or images. We do not know who reads it. It is served by Cloudflare, which handles the requests needed to deliver the pages and keeps its own short-term server logs under Cloudflare's privacy policy.

If you email us, we keep the email for as long as the conversation is useful, and delete it on request.

Stores we contact

We find US online stores and email one person at each about what our scan of their store found. This is business-to-business marketing under the CAN-SPAM Act. Here is what that involves.

What we collect

Store domains, from public web indexes such as Common Crawl. Nothing about a store is private at this stage; it is a list of shop addresses.
A business contact email address, read from the store's own public pages: contact, about, privacy and terms pages, and the home page footer. We prefer a role address such as info@ over a named person. We never buy lists, scrape social networks, or guess addresses.
Scan results: which scripts load on the store's public pages, which outside domains they come from, the security headers those pages send, accessibility violations found by the axe-core engine, and a screenshot of the checkout page as any shopper would see it. The bot enters nothing and creates nothing, so no shopper's data and no customer's data is ever involved. What the bot does is described in full on its own page.
Whether the address can receive mail. Before we send, the address is checked by MillionVerifier, an email verification service. They receive the address and return whether it is deliverable. They do not receive anything else.
Your reply, if you send one, and what happened to each email we sent.

What we do not do

No tracking pixels, no open tracking, no tracked links. We cannot tell whether an email was opened.
No automated replies. Every reply is read and answered by a person.
No more than one email sequence of three messages per store per 90 days, and none at all after a reply.
Nothing is sold, rented or shared for anyone else's marketing.

How long we keep it

Store and scan records are kept while we may still contact the store, so that we can keep the limits above. Reply STOP to any email and the address and the domain go on a permanent suppression list, which we keep indefinitely because it is what stops us from contacting you again. Everything else about the store is deleted on request.

Your choices

Reply STOP, or email hello@storesweep.app with the domain or address, to stop contact, to see what we hold, or to have it deleted. We act within 10 business days and confirm by email. To stop the bot from visiting your store at all, see the opt-out section of the bot page.

Customers

What we collect

Account details: your name, email address, company name, and the store addresses you ask us to monitor.
Billing is handled by Stripe. Your card number goes to Stripe and never to us. We receive the last four digits, the card brand, and whether a payment succeeded. Stripe's handling is covered by Stripe's privacy policy.
Scan records for your store: script inventories, headers, accessibility findings, screenshots of your public pages, the changes between scans, and every authorization, note and decision you record. These are the evidence your account exists to produce.
Emails we send you: alerts and weekly digests, and a record of each one's delivery. They come from alerts@storesweep.app, contain no tracking pixels or remote images, and you can turn digests off from any of them.

Who else sees it

Your scan records are visible to you and to anyone you give access to, such as an agency that manages your store or an assessor you share an evidence pack with. We look at them when you ask for help or when something in the system needs a person. We do not share them with anyone else. Our email is delivered by Google Workspace, and our servers and this site are on Cloudflare; both process data only to provide the service.

How long we keep it

For as long as your account is active. When a paid plan ends, your records stay for 90 days so you can export them or come back, then they are deleted. You can ask for deletion sooner at any time. Invoices are kept for as long as tax law requires.

For everyone

Where data lives. In the United States. We serve US stores and do not target people in other countries.
Children. The service is for businesses. We do not knowingly collect anything from anyone under 18.
Security. Data is encrypted in transit. Credentials are never stored with the data they unlock. Access is limited to the people who run the service.
Legal requests. We hand over data only when the law requires it, and we tell you when we are allowed to.
Changes. When this policy changes, the date at the top changes, and customers are told by email if the change affects them.

Contact

CtrlAltCreate LLC, 1208 Mountain Road Pl NE STE R, Albuquerque, NM 87110. hello@storesweep.app.