Privacy

Last updated 21 August 2026. Short, because we collect very little.

1. What we collect from a listing owner

• The email address you use at checkout. It identifies your listing and it is how you sign in, since there are no passwords here.
• The listing details you type: name, description, website, category, country, and anything you add to your public profile. All of it is published by design.
• Any contact details you choose to add. These are shown to a visitor only when they ask for them, and we count how often that happens so you can see it.

Payment card details never reach us. Checkout happens on Stripe, and we receive only the confirmation that a payment cleared and the amount.

2. What we collect from a visitor

When someone clicks through to a listing, or asks to see a listing's contact details, we record that it happened so the listing owner can see their own numbers.

We do not store IP addresses. We store a one-way, salted hash of the address, used only to stop the same person inflating a click count. The salt is secret, so the hash cannot be reversed back to an address, by us or by anyone who obtained the data.

We also count how many people have visited the board in total. That is a single running number, not a record of visits: nothing about who you are is stored beside it.

If you agree to analytics, Google Analytics records which pages are read and where visitors arrived from. If you additionally agree to session replay, Microsoft Clarity records an anonymised playback of how people move through the board. Both are off unless you turn them on, and both stop the moment you withdraw. We run no advertising cookies, no ad-targeting and no cross-site profiling at all, whichever you choose.

3. Email

We send transactional email only: your sign-in link, your receipts, and the alerts you turn on in your dashboard. Receipts cannot be turned off, because they are transaction records. Everything else can, from your dashboard, at any time.

Email is delivered by Postmark.

4. Who else sees anything

• Stripe, payments. Their privacy policy governs what they collect.
• Postmark, email delivery.
• Cloudflare, hosting and the database.

That is the entire list. We do not share your data with anyone else, and we do not sell it.

5. How long we keep it

Listing data (name, description, website, email) is kept for as long as the listing exists, plus a short grace period after removal in case of a billing dispute. Click and contact-reveal records are kept in aggregate indefinitely so historical figures on a listing stay accurate. The hashed IP behind a click record cannot be reversed to an address at any point, retained or not. Removing your listing removes it from the board and from every public page.

6. Cookies

Three cookies are ours and need no permission, because the site cannot do what you asked without them: a session cookie that keeps you signed in after a magic link; a visitor count cookie holding the literal character 1, which carries no identifier and exists only so the counter does not count you twice; and a consent cookie recording the choice you made, so we stop asking. All are marked SameSite=Lax so they cannot be replayed cross-site.

Google Analytics and Microsoft Clarity set their own cookies, and only after you accept. Until then their tags run in a cookieless state and store nothing on your device. There are no advertising cookies at any point.

The cookie page lists every one by name, purpose and lifetime, and lets you change or withdraw your choice at any time. We honour Global Privacy Control automatically.

7. International data transfers

Our infrastructure runs on Cloudflare's global network, and our subprocessors (Stripe, Postmark, and, only with your consent, Google and Microsoft) are US-based companies. If you are in the UK or EEA, this means your data may be processed outside your region. Where that applies, we rely on Stripe's and Postmark's own Standard Contractual Clauses and equivalent safeguards, the same mechanism most services of this size use, rather than maintaining a separate one of our own.

8. GDPR and UK GDPR: our lawful basis

For listing owners, we process your email, listing content, and payment confirmation under contract: we cannot run the leaderboard or bill for a bid without it. We process the hashed IP used for click-fraud prevention under legitimate interest, keeping a listing's click count honest, weighed against the minimal privacy impact of a value that cannot be reversed back to an address. None of that relies on consent, and none of it needs to.

Analytics and session replay are different, and we treat them differently. They rely on your consent, asked for before anything is stored, recorded separately for each purpose, and withdrawable at any time from the cookie page with the same single click it took to give. Withdrawing takes effect immediately.

9. California residents: your CCPA rights

You have the right to know what personal information we hold about you, to request its deletion, and to non-discrimination for exercising either right. We do not sell personal information and never have, so there is nothing to opt out of under the CCPA's sale provisions. Submit any of these requests the same way as any other rights request: email [email protected].

10. Children

AgencyLadder is a B2B service for businesses to list themselves and for buyers to find them. It is not directed at anyone under 18, and we do not knowingly collect personal information from children. If we learn we have, we will delete it.

11. Your rights

Depending on where you are, you may have the right to access, correct, delete, restrict, or export the data we hold about you, and to object to how we process it. Email [email protected] to exercise any of these, or simply to see what we hold about you or have your listing and email address deleted. We will verify the request comes from the listing's own email address and confirm once it's actioned.

Deletion does not refund bids already placed. That is a separate matter, covered in the Terms.

12. Changes

If this policy changes materially, the date at the top changes with it.