Privacy Policy

Who we are

Decodability provides documentation strategy, restructuring, rewriting, search optimization, and AI discovery foundations for marketing and e-commerce software companies. We are responsible for information we collect for our own website and business enquiries. Client information handled during an engagement is also subject to the agreed service terms and any applicable data-processing agreement.

Information you provide

Our contact form collects your name, work email, company, website and documentation links, software type, documentation stage, estimated budget, selected goals, and any message you include. We also receive information you send by email or share while discussing or delivering an engagement.

Please share only what is needed for the enquiry. Do not include passwords, payment details, sensitive personal information, or confidential customer records in the public form. During client work, access to product materials, analytics, and technical sources is agreed with your team.

To prevent contact-form abuse, we keep temporary request counters using keyed hashes of network identifiers and email addresses, rather than raw identifiers or enquiry messages. These counters expire within two days.

Docs Discoverability Score

Our free documentation tool stores the submitted public documentation URL, software category, sampled page observations, scores, and report. Unlocking a full report also stores your name, company, and email so our team can review and respond to your documentation enquiry. We store these operational records in private MongoDB collections outside Payload CMS and send an internal notification through Resend. Qualified contacts may also be stored in a dedicated Resend segment, without a new marketing subscription. Existing subscription preferences are preserved.

Anonymous assessment records expire after two days, cached scan evidence after 24 hours, and unlocked reports and associated tool lead records after 90 days. Email correspondence and any contacts retained in Resend are handled under the business-purpose retention and privacy-request process described below. A short-lived HttpOnly cookie lets the contact form prefill details from your unlocked report for up to 30 minutes. Report links are access links: anyone you share a link with can view its documentation findings until it expires.

Complete assessments appear automatically on the leaderboard after report unlock, displaying only your supplied company name, documentation URL, and calculated score. Your email and full report are not listed. Public entries expire after 90 days unless renewed by a newer unlocked assessment. Contact us to request correction or removal. We use keyed hashes of client network identifiers for rate limiting rather than storing raw IP addresses in tool records, and explicitly mask tool form and report content in Clarity.

Website and interaction data

Hosting providers may process IP addresses, request times, browser and device information, and technical logs to deliver and protect the website. On our live public domain, Google Analytics measures visits, referral sources, page navigation, and engagement. Microsoft Clarity provides interaction analysis, heatmaps, and session replay to help us improve the website.

Clarity receives information about clicks, scrolling, page layout, and other interactions. We explicitly mask contact-form content in Clarity. Analytics tools are excluded from our Admin area, localhost, and Preview hostnames.

The Help Center lets you explore Decodability by choosing questions and related topics. Its question history stays in browser memory during your visit and resets when you reload the page.

How we use information

We use information to respond to enquiries, assess fit and scope, prepare proposals, deliver agreed services, communicate with clients, maintain business records, and improve the website. Technical information helps us diagnose errors, prevent misuse, and protect our systems.

Where applicable law requires a legal basis, our purposes may rely on steps you request before a contract, performance of an agreement, legitimate interests in business communication and website security or improvement, legal obligations, or consent where required. A contact enquiry does not automatically subscribe you to a mailing list.

Cookies and your choices

Google Analytics and Microsoft Clarity can use cookies and similar identifiers to distinguish visits and connect interactions. Clarity uses first-party and third-party cookies. Microsoft may use the information it collects under its own privacy statement, including for its products and advertising services.

You can block or remove cookies in your browser and use tools that restrict analytics scripts. Google offers an Analytics opt-out browser add-on. Blocking cookies alone may not prevent every technical request or all cookie-free measurement. These options do not prevent you from contacting us by email.

See Google's Privacy Policy, Clarity's cookie documentation, and the Microsoft Privacy Statement for provider details.

Service providers and sharing

Vercel hosts the website, and Vercel Blob stores public editorial media. Payload CMS manages editorial content and authorized team accounts, with MongoDB Atlas storing editorial records and media metadata. Public visitors do not need a CMS account.

Resend processes accepted contact-form submissions to deliver them to our team by email; enquiries are not stored as leads in Payload CMS. Our email provider processes the resulting correspondence. Google Analytics and Microsoft Clarity process website measurement data as described above. Provider policies include Vercel's Privacy Notice, MongoDB's Privacy Policy, and Resend's Privacy Policy.

We may share relevant information with authorized team members, specialists, and professional advisers where needed for your enquiry or engagement, or disclose it when required by law or necessary to protect legitimate rights and security. We do not sell enquiry or client contact details. External analytics providers' uses are described in their own policies.

International processing

Our providers may process information in countries other than your own, depending on their infrastructure. Where applicable law requires safeguards for international transfers, those safeguards must apply to the relevant processing.

Retention and security

We retain enquiries, correspondence, and engagement records for as long as needed for the relevant business purpose, legal obligations, or dispute resolution, then delete or anonymize them where appropriate. Analytics, email, logs, and backups are also subject to provider settings and retention practices.

We use reasonable access controls and technical safeguards to protect information. No internet transmission or storage system can be guaranteed completely secure.

Your privacy rights

Depending on the law that applies to you, you may have rights to access, correct, delete, or receive a copy of your information, restrict or object to processing, or withdraw consent where processing relies on it. Some records may need to be retained for legal or contractual reasons. You may also have the right to complain to your local data-protection authority.

Contact us to make a request. We may need to verify your identity and identify the relevant information before responding. We handle requests in accordance with applicable law.

External websites and children

External software platforms, documentation, and resources have their own policies. Our website and services are intended for business users, and we do not knowingly seek personal information from children.

Policy updates

We may update this policy as our services or data practices change. The effective date above identifies the current version. We will provide additional notice of material changes where required.

For privacy questions or requests, email support@decodability.com.