Privacy Policy

Utlyze ("Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit utlyze.com or use our services.

You can use essential features without allowing analytics.

Information you provide directly:

• Name and contact information (email address, phone number)
• Business information (company name, role, industry)
• Your email address and phone number, if you ask us to keep a map for you
• Communications you send to us (messages, support requests)
• Payment information (processed securely through third-party providers)

The home Talk can shape the room from signals your browser already has, and only for your shop.

Those signals are campaign tags on the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the referrer host when you arrive from another site, and the coarse clock time zone from the browser, not GPS.

If you type a shop website or email domain, a first-party utlyze-shop-sketch cookie remembers it so a return visit can reopen the last shop we were building.

We do not invent shop metrics from a host, a cookie, or a referrer.

When you visit, we set the first-party utlyze_advisor_visitor cookie with a random return ID.

It lasts for up to one year, holds no contact details, and cannot be read by JavaScript on the page.

We keep the first and last time we saw that ID, its visit count, and each visit's start and last activity time.

We also keep the page path, cleaned referral and campaign details, a broad device type, and a country code.

Before storage, we remove email addresses and phone numbers from those visit details and drop a field if it cannot be made safe.

The server receives your IP to answer a request.

With essential use, we check the IP against a country database on our server, keep the country code, and discard the full IP.

The hosting network also receives the request, and we have not yet verified how long it keeps IP logs.

If you choose Allow analytics, we also keep an encrypted copy of the full IP for 30 days.

Detailed visits and anonymous return records are kept for 13 months.

If you use the advisor, this tab keeps the chat and session ID in temporary browser storage, including contact details you type.

The server keeps an unkept advisor conversation, including contact details in it, for up to 90 days.

If you keep a map, the map, conversation, contact details, first and last visit times, and total visit count stay until you ask us to delete them.

After you choose to keep a map and give the needed contact details, we email you a one-time sign-in link instead of a password.

The link expires after 14 days and stops working as soon as it is used.

Opening the link sets the first-party utlyze_advisor_workspace cookie and returns you to the map you kept.

That cookie lasts for up to one year, holds no contact details, and cannot be read by JavaScript on the page.

James may call the number you gave for the walk-through you agreed to. We do not sell it, and we do not use it for anything else.

A visit, an email address, or keeping a map does not start a website check by itself.

Start with a recurring job; name and email are optional for advice. We require contact details for a website check or saved map, and ask before reading public pages. A phone number is optional.

With your agreement, Firecrawl receives the website address and reads a few of its public pages for us. We keep the source address, retrieval date, short excerpts, and your confirmation or correction with the conversation.

We do not check pages behind a login or use these checks to look for a new email address or phone number.

We do not add contact details from your chat or your full IP address to the page-reading request.

Giving an email or keeping a map does not turn on analytics.

A public-page check can be wrong, so we will treat what it finds as a question and confirm it with you.

Not finding a tool on a public page never means you do not have one.

We cannot see accounting software, phone systems, payroll, inventory, or anything else that lives behind a login or off the web.

When you keep a map, we queue a small set of facts you stated for a memory layer called Graphiti.

The queue leaves out the raw chat and your email address and phone number.

No live Graphiti connection is turned on now, so queued facts are not sent to Graphiti.

We use the information we collect to:

• Provide, operate, and maintain our services
• Process transactions and manage your account
• Communicate with you about your account, updates, and support
• Send relevant product information and marketing communications (with your consent)
• Analyze usage patterns to improve our platform and develop new features
• Detect, prevent, and address technical issues or security threats
• Comply with legal obligations

Your browser keeps your analytics choice in local storage so the site can follow it.

Your browser also keeps display choices, such as advisor chat width, in local storage.

If you sign in to a site account, this browser keeps the account record, including contact details, in local storage with no set time limit.

The utlyze-user-info record can include account IDs, your name, email address, phone number, sign-in method, role, and account dates.

After you choose Allow analytics, Google Analytics and PostHog can use browser storage to measure site use.

When you visit, we set the first-party utlyze_advisor_visitor cookie with a random return ID.

It lasts for up to one year, holds no contact details, and cannot be read by JavaScript on the page.

Opening the link sets the first-party utlyze_advisor_workspace cookie and returns you to the map you kept.

That cookie lasts for up to one year, holds no contact details, and cannot be read by JavaScript on the page.

We work with trusted third-party providers to deliver our services. These may include:

• Payment processors — to handle billing and transactions securely
• Analytics providers — to understand usage and improve our services
• Cloud infrastructure — to host and deliver our platform
• Communication tools — to send transactional and marketing emails

These providers have access only to the information necessary to perform their functions and are contractually obligated to protect your data. We do not sell your personal information to third parties.

If you choose Allow analytics, we also keep an encrypted copy of the full IP for 30 days.

Detailed visits and anonymous return records are kept for 13 months.

The server keeps an unkept advisor conversation, including contact details in it, for up to 90 days.

If you keep a map, the map, conversation, contact details, first and last visit times, and total visit count stay until you ask us to delete them.

The link expires after 14 days and stops working as soon as it is used.

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Regular security assessments and vulnerability testing
• Access controls limiting employee access to personal data
• Secure cloud infrastructure with monitoring and logging

While we take reasonable steps to protect your data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any breaches.

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request that we correct inaccurate or incomplete data
• Deletion — request that we delete your personal data
• Portability — request your data in a structured, machine-readable format
• Opt-out — unsubscribe from marketing communications at any time

To exercise any of these rights, contact us at james@utlyze.com. We will respond to your request within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information is collected, used, shared, or sold
• The right to delete personal information held by us and by extension our service providers
• The right to opt out of the sale of personal information (we do not sell your data)
• The right to non-discrimination for exercising your CCPA rights

To make a CCPA request, email us at james@utlyze.com with the subject line "CCPA Request." We will verify your identity before processing.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time

Our lawful bases for processing include: performance of a contract, legitimate business interests, compliance with legal obligations, and your consent where applicable.

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.

Our services are not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13 without parental consent, we will take steps to delete that information promptly.

If you believe a child under 13 has provided us with personal information, please contact us at james@utlyze.com.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify you by email or through the platform where appropriate.

We encourage you to review this policy periodically. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: