Privacy

What we process

For every visitor to a customer’s site, in every country, we record the pages viewed, time on page, referrer and UTM parameters, clicks on named calls to action, and whether a named form was started or abandoned.

We do not read form field values. We do not record keystrokes. There is no session replay and no heatmap. Query parameters that look like contact details are stripped in the browser before transmission, and again on our server.

A visitor’s IP address is used transiently to look up an organisation and, for a filtered subset of visits, a person. It is never written to storage and never logged.

Person-level identification runs only for visitors in the United States. Visitors in the EU, the UK, Canada, and any visitor whose country cannot be determined, are organisation-level only. Where we identify a person, we may process their name, job title, employer and business email address, obtained from a third-party data provider.

Our role

We act as a service provider and processor, on the documented instructions of the customer whose website you visited. That customer decides why the data is collected. We make no independent use of it.

Data is never pooled

Data collected for one customer is never combined with another customer’s data, never used to build a shared identity graph, and never resold. Isolation is enforced in our database, not only by policy.

Retention

Raw IP addresses are never retained. Behavioural records are retained for as long as the customer’s account is active, and are deleted when their account is terminated.

Pending counsel
A specific retention period, rather than “while the account is active”, if counsel advises one is required.

Sub-processors

• Cloudflare, for edge delivery and request processing
• Supabase, for database hosting
• Resend, for email notifications to our customers

Pending counsel
The identity data supplier, named once selected. LEGAL.md §5 requires the supplier agreement to be signed before this page is published.

Global Privacy Control

If your browser sends a Global Privacy Control signal, we honour it automatically. Your visit is still counted as first-party analytics for the site you are on, but we attempt no identification and contact no data provider. You can enable it at globalprivacycontrol.org.

Opting out

You can opt out permanently at escendo.co/optout. Opting out applies across every site that uses Escendo. We keep only what is needed to keep honouring it, and it is never surfaced to a customer.

Your rights

You may request access to, correction of, or deletion of personal information we hold about you. Because we act on our customers’ behalf, we may need to refer your request to the operator of the site you visited, and we will tell you when we do.

Pending counsel
The specific rights language for CCPA/CPRA, and the response windows and verification procedure counsel requires.

Contact

privacy@escendo.co

Pending counsel
A real postal address, which several statutes require, and confirmation that privacy@escendo.co is a monitored inbox.