Privacy Policy

This policy explains what information EMPEERYAL (empeeryal.com, operated by EMPEERYAL, LLC — "we", "us") collects, why we collect it, and the choices you have. We keep it in plain language on purpose.

What we collect

Account information. If you create an account, we store your name, email address, and a securely hashed version of your password (we never see or store the password itself). We also record whether your email is verified and your account role.

Comments and reactions. If you comment on a post, we store the comment text, the time, and its link to your account. Comments are public. If you "heart" a comment, we store that too (counts are public; who hearted is not). If you follow a post's comments or reply threads, we store that choice so we can email you about replies — every such email has a one-click unsubscribe link.

Saved items and alerts. If you save a post or deal, or follow a deal category for new-deal alerts, we store those choices on your account so your account page and alert emails work. You can remove any of them from your account page, and alert emails carry one-click unsubscribe links.

Contact messages. If you use the contact form, we store your name, email, subject, and message so we can reply. To prevent abuse, we also store a one-way salted hash of your IP address (the IP itself is not stored and the hash cannot be reversed).

Free audit requests. If you ask for a website mini-audit, we store your name, email, and the URL you submit so we can review the site and email you the result (plus the same one-way IP hash for abuse prevention). Your page content may be processed by an AI provider to help draft the review — a person reads and edits every audit before it's sent.

Project requests and client briefs. If you ask us to build something, we store what you submit: your name and email, plus anything optional you include (phone, business name, current site), the project details, budget band, timeline, how you heard about us, and any notes. If you fill in the design brief we send later, we store those answers with the request. The conversation that follows (your replies and ours) is stored so both sides can see the thread on the site. We also record a one-way IP hash for abuse prevention and a short label for where the request came from (for example "google" or a campaign tag) so we know what's working.

Purchases and payments. Payments are handled by Stripe on Stripe-hosted checkout pages — your card details never touch our servers. We store the business record: what was bought (tip, product, project deposit, or membership), the amount, the time, your email address, Stripe's reference IDs for the payment, and any discount code you used (with the original price, so your receipt is honest). For digital products we also generate signed download links tied to your purchase.

Membership. If you join as a paid member, we mirror the subscription's status and paid-through date from Stripe so the site knows what to unlock. Billing itself — cards, renewals, invoices — lives with Stripe.

Newsletter. If you subscribe, your email address is sent to Kit (our newsletter provider) to deliver emails. Kit handles confirmation and unsubscribing; see the Kit privacy policy. Every email we send includes an unsubscribe link.

Reading and click statistics. We count how many times posts are viewed and deal links are clicked, and which site or search engine visitors come from — all as anonymous daily totals. They are not linked to you, your account, or your IP address, and they don't use cookies.

Site searches that find nothing. When a search on this site returns no results, we may store the search phrase itself (as an anonymous daily count, not linked to you, your account, or your IP address) so we can see what readers looked for and write it. Phrases that look like personal information — email addresses, phone-number-like digit strings, URLs — are discarded rather than stored, and everything else is deleted after 90 days.

Testimonials. If we ask you for a testimonial and you submit one, we store the quote and the name and role/business you enter. Nothing is published until you've ticked the permission box on the form AND a person has reviewed it; it's only ever published as you wrote it, and you can ask us to change or remove it at any time.

Rate limiting. To stop spam and abuse, some actions (contact form, newsletter signup, comments, checkout attempts) are counted against a short-lived key derived from a one-way hash of your IP address or your account ID. These counters expire automatically.

Technical logs. Server errors are recorded (what failed and when — not who you are), and our own use of AI tools is logged for cost tracking. Both logs are deleted automatically after 30 days.

AI tools we use

We use AI services (Anthropic, OpenAI, Google, xAI) to help draft and illustrate our own content. Two things you should know:

• When we use AI to help draft a reply to your project request or message, the text you sent us may be submitted to the AI provider we have configured, under that provider's API terms.
• Nothing is ever published automatically — a human reviews everything before it goes out, and AI providers get no access to our database, your account, or your payment details.

Cookies and local storage

• Session cookie — set only when you sign in, and required for your account to work. It is deleted when you sign out.
• Theme preference, draft autosaves, and view tracking — stored in your browser's own local/session storage, never sent to us. Project questionnaire drafts expire after 7 days and are deleted the next time the form loads; on a shared computer, use the form's "Start over" button to clear a draft immediately. When you're signed in, your account's name and email always take precedence over anything a stored draft contains.
• Cloudflare Turnstile — when enabled on our forms, Cloudflare's bot-check widget may set a cookie and process your IP address to tell humans from bots. See Cloudflare's privacy policy.
• Stripe — Stripe's checkout pages set their own cookies for fraud prevention when you pay. See the Stripe privacy policy.
• Advertising cookies — most ads you see here are our own banners, served by us with no third-party ad scripts, cookies, or tracking. Only if Google AdSense is enabled may Google set advertising cookies (personalized or not, depending on your region and consent). Learn more or opt out at Google's ad settings and policies.google.com/technologies/ads.
• Google Analytics — only if analytics are enabled on the site, Google Analytics may set cookies and use device identifiers to help us understand traffic (where visitors come from, which pages they read). See how Google uses this data or block it entirely with the GA opt-out browser add-on.

Beyond the items above, we run no other tracking. Our built-in analytics (Vercel Analytics and our own view counters) are aggregate and cookie-free.

Who processes your data

We use a small set of service providers to run the site:

We don't sell your personal information. We don't share it with anyone else except as required by law.

How long we keep things

• Account data — until you delete your account or ask us to remove it.
• Comments — until you delete them, or we do.
• Contact messages and project requests — for as long as we're working together or the conversation is live; we delete them on request.
• Payment records — kept for as long as tax and accounting rules require, even if you delete your account (that's a legal obligation, not a choice).
• Saved items, follows, and alert subscriptions — until you remove them or your account is deleted.
• Free audit requests — kept while we prepare and follow up on the review; we delete them on request, and junk requests are deleted as we find them.
• Testimonials — published quotes stay until you ask us to remove them; unpublished submissions are deleted on request too. The private submission links we email expire on their own after 90 days.
• Zero-result search phrases — deleted automatically after 90 days.
• Server error and AI usage logs — deleted automatically after 30 days.
• Rate-limit counters — expire within hours.
• Anonymous view/click statistics — kept indefinitely (they contain nothing personal).

One honest technical note: our database keeps short-lived backups for disaster recovery, so deleted data can persist in those backups for a short recovery window before aging out.

Security

The site is served over HTTPS, passwords are hashed with a modern algorithm, admin access is role-restricted, and uploads/inputs are validated. Payments run entirely on Stripe's PCI-compliant infrastructure. No system is perfectly secure, but we follow current good practice.

Your rights

You can update your name and password from your account page at any time, and manage your saved items, follows, and alert subscriptions there too. To access, correct, or delete anything else we hold about you — or to delete your account entirely — email us and we'll take care of it, usually within a few days. The one exception: payment records we're legally required to keep (see above).

If you're in the EU/EEA or UK, you have rights under GDPR (access, rectification, erasure, portability, objection). If you're a California resident, you have similar rights under the CCPA. Either way, the same email works — we don't treat these requests differently based on where you live.

Children

The site is not directed at children under 13, and we don't knowingly collect their information. If you believe a child has created an account, contact us and we'll remove it.

Changes

If this policy changes in a meaningful way, we'll update the date at the top of this page. Significant changes affecting account holders will be announced on the site.

Contact

Questions or requests: use the contact form or email the address listed there. This site is operated by EMPEERYAL, LLC (United States).