Privacy Policy

Last updated: October 22, 2026

Introduction

Golden Digital ("we," "our," or "us") operates this website and provides free marketing tools for D2C ecommerce brands. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

By using our tools and services, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Information You Provide

When you use our calculators and tools, we may collect:

  • Email address (when you request reports or analysis)
  • Name and contact information (when you book calls or submit forms)
  • Business metrics you enter into our calculators (ad spend, revenue, conversion rates, etc.)
  • Website URL (for our audit tool)
  • AI Visibility Checker category, confirmed brand details, and report requests
  • Company name and industry information
  • Contact information when you reach out to us

Automatically Collected Information

When you visit our website, our hosting and security infrastructure processes basic technical information — such as your IP address, browser type, and the date and time of your request — in server logs and in our abuse-prevention records to deliver pages, prevent abuse, and diagnose errors. The abuse-prevention records (rate limits and blocks) hold your IP address for up to 30 days, longer only for an address we block permanently for abuse.

When you tick a marketing consent box, we store a one-way hash of your IP address and your browser's user agent with that consent, as a record of who gave it.

If you choose to contribute your calculator numbers to our benchmarks, we store those inputs with your niche and result, but not your email address, to improve our benchmarks.

Unless you opt out, or your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, Google Analytics 4 also collects:

  • Browser type and version
  • Device information (type, operating system, screen resolution)
  • Pages visited, time spent on pages, and navigation paths
  • Referring website or source
  • Date and time of visits
  • Approximate geographic location (country, region, city based on IP)

How We Use Your Information

We use the information we collect to:

  • Provide and deliver the free tools and services you request
  • Send you analysis reports and recommendations via email
  • Improve our tools and user experience
  • Respond to your inquiries and provide customer support
  • Send you marketing communications (with your consent)
  • Analyze usage patterns and optimize our website (unless you opt out of analytics or send a GPC or DNT signal)
  • Prevent fraud and ensure security
  • Score leads automatically from the tools you use and the details you share (for example, finishing a store audit or using several tools), so our team knows whom to follow up with first. The score is only used inside Golden Digital and has no legal or similarly significant effect on you

We do not use your information for advertising: we run no ad campaigns through this site, build no custom audiences, and deliver no personalized advertising on third-party platforms.

Cookies & Analytics

Technologies We Use

We keep tracking to a minimum. This is the complete list of technologies this site uses:

Essential Cookies & Local Storage

Required for the website to function properly, such as session state and security tokens. Your cookie preference is stored in your browser's local storage (under the keys gd_cookie_consent and gd_analytics_opt_out) — neither is a cookie, and neither is transmitted to us or anyone else.

How You First Arrived (Local Storage)

Your browser keeps a short note of how you first reached this site, under the key gd_first_touch: the name of the website that sent you, the first page you landed on (without anything after a ? in its address, and with private share links reduced to the page type), and any campaign tags or Google or Meta click IDs in the link you followed. It is not a cookie and it expires after 90 days. It reaches us only if you submit one of our forms, when it is saved with your details so we know which page or campaign brought you here.

Analytics Cookies (GA4) — On by Default, With an Opt-Out

We use Google Analytics 4 to understand how visitors use our tools, and Squid to recognise returning visitors (see below). Analytics is enabled by default unless your browser sends a GPC or DNT signal (see below), and you can turn it off at any time from the cookie notice or the link in our footer. Opting out sets Google's own ga-disable flag in your browser, which stops GA4 sending anything at all — not a reduced or anonymised signal, nothing. We are a US business and this site shows no ads and does no ad personalisation.

Google Analytics 4 (GA4)

Purpose: Aggregate website analytics — which pages and tools get used, and how visitors navigate the site

Data collected (unless you opt out): Page views, session duration, device and browser information, approximate geographic location, user journey paths

Retention: 14 months (Google Analytics' default)

Your control: On by default; choose "Opt out" in the cookie notice and GA4 stops sending immediately and on every later visit

Squid (asksquid.ai)

Purpose: Recognising returning visitors and the businesses they work for, so we know which companies are using our tools

Data collected (unless you opt out): Pages visited, a device identifier, and matches from Squid's identity partners

Your control: The same as GA4 — it does not load if you choose "Opt out" in the cookie notice or your browser sends a GPC or DNT signal

What We Don't Use

This site runs no ads and no ad pixels. Specifically, we do not use:

  • Google Ads tags, conversion tracking, or remarketing
  • Google Tag Manager
  • Facebook/Meta Pixel or any other social media pixels
  • Custom audiences or lookalike audiences built from your data

We do not sell your data. Squid (above) works with identity partners, which receive the pages you visit so it can recognise returning visitors; it does not load if you opt out or send a GPC or DNT signal.

Global Privacy Control (GPC) & Do Not Track

We honor both signals. If your browser sends a GPC or DNT signal, Google Analytics never loads on this site: a script in the head of every page checks for the signal before Google's analytics script is requested, skips that request, and sets GA4's own ga-disable flag. The cookie notice tells you analytics is off and why, and it can't be switched back on from the site while the signal is on. If you'd like to be counted, turn the signal off in your browser. We never sell or share personal information for advertising, with or without a signal.

Your Analytics Choices

Analytics is on unless you turn it off, and you can change your mind at any time:

  • Opt out in the cookie notice: Choose "Opt out" and GA4 stops sending immediately and on every later visit. Choosing "Got it", closing the notice, or ignoring it leaves analytics on
  • Send a privacy signal: Turn on Global Privacy Control or Do Not Track in your browser and Google Analytics never loads here (see above)
  • Change your mind later: Reopen the cookie notice from the "Cookies" link in the footer, untick Analytics Cookies and choose "Save Preferences". Tick it again to turn analytics back on. Clearing this site's browser data also clears the preference (gd_analytics_opt_out), which turns analytics back on and brings the notice back
  • Google Analytics opt-out: Install the GA opt-out browser add-on to block Google Analytics everywhere, including here
  • Browser settings: Adjust your browser to refuse cookies or alert you when cookies are being set
  • Marketing emails: Every marketing email we send includes an unsubscribe link

Cookie Retention Periods

  • Session cookies: Deleted when you close your browser
  • Analytics cookies (GA4): Up to 14 months. Never set while your browser sends a GPC or DNT signal. Opting out stops GA4 sending anything, but cookies it set before you opted out stay until they expire or you clear them
  • Consent preference (local storage): Kept until you clear your browser's site data
  • First-arrival note (local storage): 90 days, or until you clear your browser's site data

Service Providers & Subprocessors

We rely on a small set of service providers to run this site. Each receives only the data it needs to do its job:

  • Supabase — Database, sign-in accounts and serverless functions. Stores lead information, form submissions, tool results, and the account you sign in with to see your audits and AI Visibility reports.
  • Vercel — Website hosting and content delivery.
  • Sentry — Error monitoring. Email addresses and IP addresses are scrubbed from error reports before they are sent.
  • Listmonk (operated through Golden Digital Compass) — Email marketing. Receives your contact details and consent record only when you opt in to marketing emails. Requesting a transactional report or download alone does not subscribe you.
  • Resend — Delivers all our transactional email: reports (store audit, calculators, marketing calendar and AI Visibility), sign-in links, AI Visibility notifications, and contact form messages.
  • Firecrawl — Website scraping for the store audit tool. Receives the store URL you submit and fetches that store's public pages.
  • AI Visibility Checker collection providers — When live collection is enabled, Bright Data, DataForSEO or SearchAtlas receives the buyer questions and requested market to collect public AI answers. We do not send your email address to these collectors. Your report identifies the provider and assistants actually measured. We also inspect a limited set of public store and cited source pages.
  • Anthropic (Claude) — AI analysis for the store audit and for AI Visibility Checker reports (your brand, category and the collected answers), sent straight to Anthropic's API.
  • OpenRouter — Passes AI requests to the model that handles them: Anthropic's Claude for the marketing calendar, the ad concept tool and the store audit's fact check, and Google's Gemini for the store audit's screenshot review.
  • Google (Gemini, through OpenRouter) — Looks at screenshots of your store's public pages for the visual part of the store audit.
  • Cloudflare DNS and Google Public DNS — Look up the domain name of a store you submit, so we can check it points to a public website before we fetch it. They receive the domain name only.
  • Inngest — Runs the store audit and the AI Visibility Checker as background jobs. Receives the details you submit, and holds each step's results (scraped pages, collected answers and AI analysis) while the job runs.
  • Google (Analytics 4) — Site analytics, unless you opt out or send a GPC or DNT signal. Page views are measured in our own Google Analytics properties for this site and for www.goldendigital.co, which share cookies across goldendigital.co. See "Cookies & Analytics" above.
  • Squid (asksquid.ai) — Visitor identification. On this site it records the pages you visit and uses a device identifier and its identity partners to recognise returning visitors and the businesses they work for. It follows the same rules as Google Analytics: it does not load if you opt out or send a GPC or DNT signal.

AI Processing

Our AI-powered tools (Shopify Store Audit, Marketing Calendar Planner, Ad Concept Generator, and AI Visibility Checker) work by sending the information you submit — your store URL, publicly available content scraped from that store, and the business details and metrics you enter — to Firecrawl (for scraping) and to Anthropic's Claude models (for analysis: directly for the store audit, through OpenRouter for the calendar and ad concept tools). The AI Visibility Checker sends your brand, category and the AI answers we collected to Anthropic's Claude models to write your report, and runs as a background job on Inngest. The store audit also sends screenshots of your store's public pages to Google's Gemini model through OpenRouter, and runs as a background job on Inngest. This data is processed as you entered it — it is not anonymized before being sent — so only submit information you are comfortable having processed by these providers.

Under OpenRouter's and Anthropic's API terms, data submitted through their APIs is not used to train their models. We do not use your submissions to train AI models either.

Data Sharing and Disclosure

We may share your information with:

  • Service Providers: The companies listed in "Service Providers & Subprocessors" above, solely to operate the website and deliver the tools you use
  • Legal Requirements: When required by law, subpoena, or to protect our rights
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising. There are no advertising partners in our stack (see the CCPA section below).

Data Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, and regular security assessments. However, no internet transmission is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy. Specifically:

  • Lead information: Kept until you ask us to delete it. We don't delete lead records on a schedule. Email hello@goldendigital.co and we'll delete your lead record and its activity history
  • Contact form messages: Stored in our database, not only emailed to us, and kept until you ask us to delete them. Deleting your lead record deletes them too
  • Marketing consent records: Retained while you are subscribed and afterward as needed to document and honor your consent or unsubscribe request. If you ask us to delete your data after you were on our email list, we keep only a one-way hash of your email address, so a later form cannot add you back to the list
  • Calculator data: Retained for up to 90 days
  • Audit results: Retained for 1 year when the audit is tied to your email address, and for 90 days otherwise
  • Marketing calendars and ad concepts: Retained for up to 180 days
  • AI Visibility Checker reports and evidence: Available for 90 days. Reports are private to your verified account unless you create a share link; anyone with that link can read it until it expires or you revoke it. You can request earlier deletion from your report. Access is revoked immediately and private files are removed by a retryable cleanup process. A minimal account-linked eligibility record enforces the free-check limit and expires 30 days after acceptance. Account or personal-data erasure removes that record. Financial usage totals may remain without your email, store details, or report content. Visitor analytics and identification scripts are disabled in the private AI Visibility Checker workspace and shared reports.
  • Analytics data (GA4): Retained for 14 months. Not collected once you opt out, or while your browser sends a GPC or DNT signal

Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete data
  • Deletion: Request deletion of your personal information
  • Opt-out: Unsubscribe from marketing emails at any time
  • Data Portability: Request a copy of your data in a structured format
  • Object to Processing: Object to certain types of data processing
  • Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, contact us at hello@goldendigital.co. We will respond within 30 days (or sooner if required by law).

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Your California Rights

  • Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you
  • Right to Delete: You can request deletion of your personal information, subject to certain exceptions
  • Right to Correct: You can request correction of inaccurate personal information
  • Right to Opt-Out of Sale/Sharing: You can opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising
  • Right to Limit Use of Sensitive Personal Information: You can limit our use of sensitive personal information to what is necessary for providing services
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Notice of Sale/Sharing

We do not "sell" your personal information, and we do not "share" personal information with third parties for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We use no advertising networks, pixels, or remarketing tags, so there is no sale or sharing to opt out of.

Opt-out preference signals: If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out: Google Analytics doesn't load for you. We treat Do Not Track the same way. No data is sold or shared for advertising, with or without a signal.

How to Exercise Your Rights

To submit a request, contact us at:

We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

Financial Incentives

We do not offer financial incentives for the collection of personal information.

European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

  • Legal Basis: We process your data based on consent (for marketing emails), contract performance (for providing the tools you request), and legitimate interests (for analytics, which is on by default and which you can opt out of at any time, and for security and improving our services)
  • Right to Lodge Complaint: You have the right to lodge a complaint with your local data protection authority
  • Data Transfers: Your data may be transferred to the United States. We rely on Standard Contractual Clauses and other appropriate safeguards for such transfers

Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. If you are located outside the United States, your information will be transferred to the United States. We take appropriate safeguards to ensure your data is protected in accordance with this policy.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we may also notify you via email. Your continued use of our services after any modifications constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us: