Privacy Policy

PRIVACY POLICY Effective Date: August 23, 2026 Version: 1.2 Blindspot Audits LLC ("Blindspot Audits," "we," "us," or "our") respects your privacy. This Privacy Policy describes how we collect, use, disclose, and protect information when you visit our website or use our services. 1. INFORMATION WE COLLECT We may collect: (a) Information you provide directly, including your name, email address, company name, website URL, role, monthly ad spend range, product category, problem description, and other information submitted through our forms. (b) Information collected automatically, including IP address, browser type, operating system, referring URL, pages visited, and timestamps. (c) Information from cookies and similar technologies (see our Cookie & Tracking Disclosure). (d) Information you authorize us to access from third-party advertising, analytics, attribution, and ecommerce platforms (see Section 3, Platform Integrations). (e) Business and marketing data submitted to our API or MCP preview service under an API key, including data assembled and transmitted by an AI assistant or other software acting on your behalf. 2. HOW WE USE INFORMATION We use the information we collect to: (a) provide, operate, and improve our services; (b) communicate with you about your audit request; (c) analyze website usage and improve user experience; (d) comply with legal obligations; (e) protect the security and integrity of our services; (f) where you have separately opted in, produce anonymized, aggregated findings for Blindspot's published research. Your brand is never identified in published research, and this opt in is never required to receive an audit. You can withdraw it at any time by contacting us. 3. PLATFORM INTEGRATIONS (SHOPIFY AND OTHERS) When you connect a third-party platform to receive an audit, you authorize us to access a defined set of read-only data from that platform on your behalf. We do not modify, write to, or take administrative actions on your accounts. (a) Shopify. If you install our Shopify app, we request read-only scopes covering orders, products, customers, analytics, reports, inventory, price rules, and discounts. We use this data solely to generate your audit. We do not access payment card data. Shopify access and refresh tokens are stored encrypted at rest using Supabase Vault and are scoped to your store only. You can revoke access at any time by uninstalling the app from your Shopify admin, which triggers Shopify's mandatory shop/redact webhook and causes us to delete the stored tokens and associated store identifiers. (b) Other connected platforms. We may receive read-only access to advertising and analytics platforms (e.g., Meta Ads, Google Ads, Google Analytics, TikTok Ads, Northbeam, Triplewhale, Klaviyo) via Leadsie or direct invitation. Access is limited to what is required to perform the audit. (c) Customer personal data. Our audits use aggregated metrics and modeled signals. We do not build customer-level profiles, do not enrich customer records, and do not sell or share customer personal data with third parties for advertising. (d) API and MCP preview. If you use our API or MCP preview service, data reaches us only when you or software acting on your behalf transmits it to us. We do not access your platforms directly through this service. Handling and retention of preview submissions are governed by the API & MCP Preview Access Terms. 4. SUBPROCESSORS We use the following service providers to operate the audit service. Each is bound by its own terms and contractual confidentiality obligations: • Lovable Cloud / Supabase (hosting, database, encrypted secret storage) • Resend (transactional email) • Google Workspace (Drive storage of audit deliverables, Gmail drafts for review) • Anthropic (Claude API for generating audit drafts from your provided data) • Leadsie (platform access invitations) • Google Analytics, Google Ads, Meta Pixel, Meta Conversions API, LinkedIn Insight Tag (website analytics and advertising measurement) • Shopify (when you install our Shopify app) • Render (hosting of the audit engine API and MCP server) 5. INFORMATION SHARING We do not sell your personal information. We may share information with: (a) the subprocessors listed above; (b) professional advisors (e.g., legal, accounting); (c) law enforcement or regulators when required by law. 6. DATA RETENTION Audit materials, connected-platform data, and related workpapers are retained for up to 180 days after completion of the audit unless a longer period is required by law or you request earlier deletion. Shopify access and refresh tokens are deleted immediately upon receipt of Shopify's shop/redact webhook (issued 48 hours after uninstall) or earlier upon your written request. Customer redaction requests received via Shopify's customers/redact webhook are logged and acted on within 30 days. Data submitted through the API or MCP preview service is retained for up to 180 days after the associated preview run. De-identified, aggregated derived information may be retained indefinitely as described in the API & MCP Preview Access Terms. 7. SECURITY We use commercially reasonable safeguards designed to protect your information, including TLS for data in transit, encrypted storage of OAuth tokens in Supabase Vault, row-level security on our database, and least-privilege access controls. No method of transmission or storage is completely secure. 8. YOUR RIGHTS Depending on your jurisdiction, you may have rights regarding your personal information, including the right to access, correct, delete, or port your data. To exercise these rights, contact us at contact@blindspotaudits.com. See also our Data Deletion page for self-serve instructions. 9. CALIFORNIA RESIDENTS If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by these laws. 10. CHANGES TO THIS POLICY We may update this policy from time to time. Changes will be posted on this page with an updated effective date. 11. CONTACT Questions about this Privacy Policy should be sent to: Blindspot Audits LLC contact@blindspotaudits.com 1020 Ridgefield Drive, Plano, TX 75075