Privacy policy

Draft, pending legal review. Last updated 13 October 2026.

This policy covers the personal data Punchline Analytics handles as a business: people who visit this website or request a reveal, and people who sign in to Punchline. Data that Punchline collects on our customers' websites is covered differently: there, our customer decides what is measured and we process it on their behalf (see Data on our customers' websites).

Who we are

Punchline Analytics [legal entity name and address to be confirmed]. Contact us about privacy at hey@opsscale.co.

Visitors to this website

• If you request a reveal: your name, work email, company, website address, current analytics tool, and anything you write in the optional message. We use it to reply to you and set up your reveal. The legal basis is your request (steps taken at your request before a possible contract) and our legitimate interest in responding.
• When you browse this site: we measure visits with Punchline Analytics itself. We don't set cookies or use local storage, and we don't store IP addresses or browser user agents. Each request is recorded as the page visited, the referring site's domain, the country, the browser family and device type, and a visitor hash that changes every day and can't be traced back to you. We honor Global Privacy Control.
• Spam protection: when you submit a form, a one-way hash of your IP address is kept in server memory to limit repeated submissions: up to 10 minutes on this website, and up to an hour on Punchline's sign-in and sign-up forms, which also keep a hash of the email address for 15 minutes. These are never written to storage.
• The docs assistant: if you ask it a question, your question and excerpts from our docs are sent to Anthropic to write the answer. Don't include personal data in questions.

We don't use advertising pixels, third-party analytics or tracking cookies, and we don't sell personal data.

People who use Punchline

• Your account: your email address (you sign in with an emailed link; there are no passwords), the sites you belong to and your role on each, and invitations you send or receive. We use it to run your account, keep it secure, and send you service emails such as sign-in links, invitations and usage notices.
• Billing: if you pay for a plan, Stripe takes the payment and holds your billing email, card details and invoices. We keep only Stripe's customer and subscription IDs, your plan, and its status.
• Settings you enter: alert email addresses, Slack and webhook destinations, and connections to tools like your CRM, ad platforms and data warehouse. Credentials for those connections are stored encrypted.
• How you use the product: we keep basic records of activity on your account, such as API key and AI assistant connection use, for security, rate limits and support. [Counsel: confirm the description of operational logs and their retention.]
• Ask Punchline: when you ask a question in the dashboard, aggregate results from your data are sent to Anthropic to write the answer. They contain no IP addresses, user agents or visitor identifiers, and Anthropic doesn't train on them.

The legal basis is our contract with you (or with the company you work for) and our legitimate interest in running a secure service. [Counsel: confirm the legal bases, including for team members invited by a customer.]

Data on our customers' websites

When a company installs Punchline, it decides to measure its own website, and we process that data on its behalf. That company is responsible for telling its visitors, and for any requests about that data; we help it respond. By design, Punchline doesn't store IP addresses, user agents, form contents or persistent visitor IDs, and sets no cookies on visitors' browsers. The details, including retention and the services we use, are on our privacy page. A data processing agreement is available on request. [Counsel: the data processing agreement still needs drafting.]

Who processes data for us

• Vercel (hosting), United States.
• Supabase, on Amazon Web Services (database and dashboard sign-in), United States.
• Resend (email: sign-in links, invitations, alert digests and notices), United States.
• Stripe (payments for paid plans), United States, if you subscribe.
• Anthropic (answers in Ask Punchline and the docs assistant), United States, only when you use them.
• Google Cloud (Google Analytics comparison and BigQuery export), United States, only if you connect them.

If you connect other tools, such as a CRM or ad platform, we send them the data you choose, in your own accounts. [Counsel: add the international transfer mechanism for visitors and customers outside the United States.]

How long we keep it

• Reveal requests: until 12 months after our last contact with you, or sooner if you ask us to delete them.
• Page-visit records on this website: 90 days. Daily totals, which don't identify anyone, are kept.
• Account data: while your account is open. After you ask us to close it, we delete it within [Jeff: number] days, except billing records we have to keep by law. [Jeff: confirm the deletion window; there's no self-serve account deletion yet.]

Your rights

You can ask us for a copy of the personal data we hold about you, or ask us to correct or delete it, by emailing hey@opsscale.co. Depending on where you live, you may have further rights, including the right to object, to restrict how we use your data, to take it elsewhere, and to complain to a data protection authority. If your question is about a website that uses Punchline, we'll pass it to that website's owner. [Counsel: add state-specific disclosures if required, such as California.]

Children

Punchline is a business product and isn't meant for children. We don't knowingly collect their data.

Changes

We'll update this page if our practices change, and change the date at the top. If a change materially affects account holders, we'll also email them before it takes effect.