Privacy at Cuttyhunk

What you give us

What you type into a form or the concierge, plus the few things below that your browser sends along.

The contact form

It asks for your name, email, business, town, the kind of work you need and a note. We email that to our own inbox through Resend so we can write back, keep it on a list of the newest 200 requests in our database, and send a short alert with your business name and town to our own devices. The concierge’s “connect me with the team” button sends the same kind of request and can carry a phone number instead of an email.

The free SWOT and scans

They ask for your business name, the kind of business, your email and a few answers, and some also ask for your town, your website and up to three competitors. We read the public websites you give us and send your answers, never your email, to an outside service that helps write your summary. Then we email the result to you through Resend and send a copy, competitors included, to our own inbox. These tools don’t save your answers in a database, so those emails are the only copies we keep.

The box you tick first also signs you up for the occasional note from Cuttyhunk, and replying “unsubscribe” to any of them stops it. Our Lookout self-check works differently, because it runs in your browser and its answers never reach us.

The concierge

Your messages, and the business details you share with it, go to that same outside service so it can write each reply. Your browser keeps those details on your device so you don’t have to type them again, and we don’t keep free chats.

Give it a business name and town or a Google Maps link, and we look the business up on Google Places, Yelp and TripAdvisor and read its public website to build a visibility scorecard, which sits in server memory for up to 6 hours. The concierge can also search the web through the outside service to find a business online, and it writes those searches itself from your conversation.

Notifications

Turn notifications on and your browser gives us a push address, linked to your account if you subscribe. We use it to tell you when something needs your OK and to send the occasional update to everyone who turned them on, and we keep it until you turn notifications off or your browser retires the address.

Your browser

The concierge saves your access code if you have one, the business details you entered and a note that you’ve seen its welcome in your browser’s storage, and clearing your browser data removes them. Our code sets no cookies, though Stripe, Google and Plaid may set their own on their own pages.

Request counts

To stop abuse, we count requests by internet (IP) address. The concierge’s counts sit in our database and delete themselves after 10 minutes or about 26 hours, and the contact form, the SWOT and the scans count only in the server’s short-term memory.

Paid plans

Jasper, Jasper Studio and The Feed are paid plans, and paying for one means we hold a bit more.

Payment

Payments run on Stripe’s checkout page, so Stripe collects your card details and an email address, or we pass along the email you gave the concierge. We never see your card number. We send Stripe your business name and town to tell subscriptions apart, and Stripe sends back a subscription ID we use to check your plan is active. Jasper subscribers can update a card, see invoices or cancel in Stripe’s customer portal, linked from the concierge.

Your access code

Jasper and Jasper Studio subscribers get a private access code that carries their business name, town, plan, end date and Stripe subscription ID. We check its signature when you use it, so we don’t need to keep a copy.

Notes the concierge keeps

For Jasper and Jasper Studio subscribers, it keeps up to 30 short notes you’ve told it, like your goals or your busy season, and a dated one-line log of your last 12 conversations so it remembers what you’ve already covered. It’s told never to save anything sensitive, like health or personal money matters. There’s no switch to turn this off, and the notes stay until you ask us to delete them.

Connected accounts

Jasper subscribers can connect Google Calendar, a business bank account through Plaid, and their own email address. You approve Google and Plaid on their own screens, and we never see your bank login. We store the access keys they give us so the concierge can read your next 14 days of events, and your account names, last four digits, balances and last 30 days of transactions. To send email from your own address, we register your domain with Resend and store that address. The concierge can’t move money, and it can’t add an event or send an email until you tap Approve.

What it reads from a connected account goes to the outside service with your conversation so it can answer you. A card waiting for your OK expires after 7 days, and once you approve or turn one down we keep it, what it said included, with no end date. We also keep a log of your last 100 actions, which records only the kind of action and never what it said. If you disconnect an account in the concierge, the access keys we stored for it are deleted.

Graphic previews

Jasper Studio’s graphic previews load fonts from Google Fonts, so Google sees your device’s internet address when one opens.

Who else handles it

Each outside service gets what’s described above for its part of the job, and what it keeps falls under its own privacy policy.

Our database

It runs on Upstash Redis, and everything we store there is encrypted with AES-256-GCM, except the request counts, which delete themselves.

Hosting and email

Vercel hosts the site, Resend sends our email, and the emails we receive sit in our own inbox.

Other services

We also send information to the outside service that writes the concierge’s replies and the tool summaries, to Google for Places, Calendar and Fonts, and to Yelp, TripAdvisor, Stripe and Plaid, while your browser’s own push service delivers notifications.

How long we keep it

Contact emails and tool copies stay in our inbox until you ask us to delete them, and the request list holds only the newest 200. Concierge notes, connections, decided cards, the action log and push addresses stay until you ask us to delete them, disconnect or turn notifications off.

Deleting it

To have something deleted, email hello@cuttyhunkbranding.com and tell us what it is. We’ll remove what we hold about you, including your contact requests, concierge notes and connections, approval cards and push address, and tell you when it’s done. Copies the outside services keep, Stripe’s payment records included, fall under their own rules.

Changes

If we change this policy, we’ll update this page and the date at the top so you can see when it changed.