Privacy Policy

Who we are

[COMPANY LEGAL NAME], [ADDRESS], is the operator of Shortlist. Contact [SUPPORT EMAIL] for privacy requests.

What we collect

Account data: name, email, password hash, and the businesses you add (name, category, service areas, website, phone, address, and the facts you type).

Scan data: the questions we send, the answers the AI providers return, citations, scores, and the fix drafts generated from those answers.

Billing data: Stripe stores your card. We store the Stripe customer id, subscription id, plan, and status. We do not store a full card number.

Visit data: if you arrive with campaign parameters, we store the source, medium, campaign, content, term, trade, and city in a cookie named shortlist_visit and copy them onto the account or free scan.

AI providers

To run a scan we send the question, and when drafting a fix we send the answer text, the competitors and sources in that answer, and the business profile you entered, to the AI providers configured on the server. Those can include OpenAI, Anthropic, Google, xAI, and Perplexity, only when that provider’s key is set. Their terms apply to that processing. We send this so the product can do the scan you asked for.

Cookies and analytics

We use a sign-in cookie and the shortlist_visit cookie described above. We do not run a Meta Pixel unless a pixel id is configured later. If a Meta Pixel or Conversions API is turned on, it would receive the events described in the deploy guide (registration, scan start, trial, and purchase) so ads can be measured. That is off until those keys are set.

Deletion requests

Email [SUPPORT EMAIL] from the address on the account and ask us to delete it. We will delete the account, businesses, scans, and drafts, except records we must keep for tax or fraud prevention, such as the fact of a Stripe charge. A platform admin can also delete a complimentary test account from the admin page.