What I collect,
and why.
Plain version: the free tools compute in your browser and log an anonymous row so I know which ones are worth maintaining. If you hand over an email, you get the full read and you join my newsletter. That trade is what keeps the tools free. In the EU and UK it's a box you tick instead. Everything below is the detail.
01
Running a free tool
What happens if I run a tool and never enter my email?
The calculators run in your browser. The store audit is the exception: it runs on my server, because it has to fetch your public storefront. When a result is produced, one row is logged to a private spreadsheet: the figures you entered, the headline result, and context about the visit (referring page, UTM parameters, landing page, device type, country, an anonymous visitor identifier, visit number, time on site, pages viewed, and the web analytics client ID). There is no name and no email address attached. I use it to see which tools get finished, which get abandoned, and which are worth maintaining.
What happens when I do enter my email?
A few things, and I would rather list them than let you find out one at a time:
- Your email is stored alongside that run's figures and result in the same private spreadsheet.
- Your report is emailed to you, through an email delivery service.
- You are subscribed to the Commerce Dispatch, my newsletter, and a welcome email is usually sent right away, unless another email is already going to you that day. In the EU and UK you see an unticked box instead, and you only join if you tick it.
- Today you receive up to five follow-up emails, at two, four, seven, fourteen and twenty-one days: a question about your result, a related read or tool, an offer to talk, one case study, and a note asking where you'd like to go from here. I run one sequence at a time, so if you use another tool on a later day, the sequence already running carries on, and a new one starts only after it ends. I may change this schedule. Every one carries an unsubscribe link and a postal address, and unsubscribing stops them all. If you send the contact form, or I write to you myself, the automated ones stop. In the EU and UK they only go out if you ticked the box.
- After a calculator or store audit run, the tool sequence can also include a 30-day re-check, about a month later, asking you to run the same tool again and compare. The scorecard has its own re-score reminders instead. The re-check doesn't go out if I start writing to you myself, if I take over because you look like a close fit, if you switch your follow-ups to another tool, or if you turn it off. It has the same unsubscribe link.
- If you haven't run a tool, replied or got in touch for about a month after your follow-ups have gone out, I may send up to three check-ins after a quiet spell over the following months. That's at most one round a year, and never more than six months after your last tool run unless you've also subscribed to something. Running a tool, replying or signing up for the newsletter ends a round. You can turn check-ins off on their own on the email settings page, and unsubscribing from follow-ups stops them too.
- If you ran the DTC Growth Scorecard, I also send a reminder to re-score about two months later, and one more a month after that only if you haven't. Re-scoring starts the two months again. These have the same unsubscribe link and stop the same way.
The follow-up, welcome, re-score, re-check and Index alert emails link to an email settings page, where you can turn off follow-ups, welcome emails, re-score reminders, the re-check, check-ins and Index alerts one at a time, or stop all site email. The newsletter keeps its own unsubscribe link. I also hold back anything promotional so it never lands on a day another email is going to you, and I only send it when fewer than 3 emails have gone to you in the past week. Nothing triggered or promotional goes out on a Tuesday.
Why does entering my email sign me up for the newsletter?
That's the trade for the free tools. The first result is free and needs nothing from you. The full read costs real money to run: hosting, the analysis, and the email sending. The newsletter list is how I cover that, so the email that unlocks the full read also adds you to the Commerce Dispatch. It's about one email a week, and one click takes you off it. The inquiry form works differently: there you only join if you tick the box.
Is my store URL or my numbers shared with anyone?
No. The figures you enter and the store URL you audit are not sold, rented, or passed to anyone for their own use. They sit in my own spreadsheet and are processed by the services named on this page purely to deliver what you asked for. The store audit fetches your public storefront and public page-speed test results, the same things any visitor or crawler can see.
02
The newsletter
What is the Commerce Dispatch and how do I get off it?
Practitioner notes on scaling consumer brands and commerce software. It is a commercial newsletter: part of why I write it is that some readers eventually work with me. If you join from a newsletter form rather than a tool, you also get five welcome emails over two weeks: who I am, The Handoff, the store audit, how to weigh a hire against an advisor, and how working with me works. Each has an unsubscribe link, and any of them can wait a day or more if another email is going to you that day or 3 have already gone out that week. Every issue has a one-click unsubscribe, and it is honoured immediately. You can also reply to any email, or write to hello@taylorsicard.com, and I will remove you by hand.
What are Index deal alerts and what do you keep?
A separate list from the newsletter, for new deals in the Index. You pick categories, deal types, any brands you want to watch, and the line that describes you; founders can add their brand’s website. Nothing is sent until you click the link in the confirmation email. After that you get one email on Thursday when a deal matching your picks goes into the Index, and nothing in a week with no match. After four quiet weeks you get one roundup of everything added in that time. Later on, you may also get a same-day note about a brand you watch, at most one a day, and never on a Tuesday. I keep your address, your picks, when you confirmed, the page you signed up on and which emails went to you. I also use your role and website to judge whether my work fits you, which can mean I write to you myself. Links in the alerts carry the same short code as the newsletter’s, so I can see which pages you open. You join the Commerce Dispatch only if you tick its box. Every alert has a one-click unsubscribe that stops all of them at once; afterwards I keep only your address and the date you left, so you are never added back by mistake, and I’ll delete that too if you ask.
Can I get my data deleted?
Yes. Email hello@taylorsicard.com and I will delete your address from the newsletter list, remove the rows carrying it from the spreadsheet, cancel any follow-up emails, delete your Index deal alerts record, and delete your record in my visitor log. If you want a copy of what I hold on you first, ask and I will send it. This applies whether or not the law where you live gives you the right, because it is not much work and arguing about it would take longer.
03
Through an AI assistant
What do you see when an AI assistant uses the DTC Deal Index?
The DTC Deal Index lets assistants such as ChatGPT and Claude look up the trackers, welcome offers and calculators on this site and run the store audit. An assistant hosted by its company, such as ChatGPT, sends each request from that company’s servers, so I never receive your name, your email, your IP address or what you typed in the chat. Software running on your own computer, such as Claude Code or Cursor, connects directly, so its requests carry your IP address. My code doesn’t read or store that address, but Netlify’s systems handle it, as described below. Each tool call adds one row to the private spreadsheet: the time, which tool ran, whether it returned an answer, and the user-agent string of the assistant’s software, which names the software rather than a person. For a store audit, the row also holds the address of the store that was audited. Calculator figures, the brands you look up and your questions are not stored. None of it reaches the newsletter or the follow-up emails, because none of it carries an email address. There is no account and no sign-in, so nothing ties a call to you.
What does each tool take in, and what does it send back?
Your assistant chooses the inputs from your conversation and sends only those. They are used to compute the answer and then discarded; apart from the row described above, none of them is written down.
- Deal and earnings lookups (
search_consumer_deals,get_brand_deal_history,get_acquirer_activity,get_earnings_summary). In: a search term, brand, acquirer or company name, and optional filters such as category, dates, amount and result count. Out: matching public records from my trackers, such as acquisitions, funding rounds, shutdowns and reported earnings, with dates, amounts and source links. - Welcome offer lookups (
get_brand_welcome_offer,get_welcome_offer_benchmarks). In: a brand name, or optional filters for segment, offer type and popup vendor. Out: the welcome popup that brand showed in my capture, or counts and medians across the brands captured. - Calculators (
calculate_break_even_roas,calculate_max_allowable_cac,calculate_free_shipping_threshold,calculate_ltv_from_repeat_rate,calculate_landed_cost,calculate_shopify_plus_cost). In: business figures such as average order value, margins, repeat rate, shipping, freight and duty costs, or sales volume. Out: the computed result and how it was worked out. - Store audit (
audit_store_homepage). In: a store’s web address. Out: a score for each area and overall, every check with its result, the platform, apps and theme it detected, and benchmark medians.
Why is it logged, and who receives it?
The log row has one purpose: counting which tools get used, from which assistant, and whether they work, so I know what to fix and what is worth maintaining. It is not used for advertising, not sold or rented, not used to train AI models, not matched with other data about you, and not used to contact anyone. Three outside parties are involved:
- Netlify hosts the server. As with any website, Netlify’s systems handle each request, including the network address and user-agent of whatever sent it (your assistant company’s server, or your own device if your assistant software connects directly), and keep that in their own request and error logs under Netlify’s privacy policy.
- Google stores the log row, in a private Google Sheets spreadsheet that only I can open, under Google’s privacy policy.
- The store you audit receives ordinary page requests from my server, identified as TSC-StoreAudit, the same as any visitor or crawler. It receives nothing about you or your assistant.
How long is it kept?
Log rows are kept for up to ten years from the call and then deleted, so I can compare usage over time. You can have rows deleted sooner by asking (below). Netlify’s request logs are kept for the shorter period Netlify sets. Tool inputs are not kept at all. If I change any of this, I will update this page and the date at the bottom first.
What does the store audit fetch, and who handles the conversation?
The audit reads the store’s public homepage, its robots.txt, sitemap and llms.txt, and one product page: pages any visitor can open. It does not run the speed test or the written analysis that the audit on this site adds, and it sends nothing to any AI model. Your conversation is held by your assistant’s company and covered by that company’s privacy policy. To have the audit rows for a store deleted, write to hello@taylorsicard.com.
What control do I have?
- Don’t connect it, or disconnect it. The DTC Deal Index only runs when your assistant calls it. Removing or turning off the app or connector in your assistant’s settings stops all calls.
- Choose what goes in. Your assistant normally shows each tool call and its inputs. Leave out any figures you’d rather not send; nothing about them is stored either way.
- Ask for a copy, a correction or deletion. Write to hello@taylorsicard.com with the store address or the rough time of the calls. Because rows carry no name, email or account, that is how I find them. I will send you what I hold, or delete it, and tell you when it is done.
- Report wrong data. If a tracker record is wrong, the same address works and I will fix it.
04
Analytics and the rest of the site
What tracking runs on the site?
A tag manager, which loads web analytics, a session-replay tool, search analytics, and a visitor log I built and run myself. Web analytics gives me page and event counts. Search analytics gives me search traffic. The session-replay tool records anonymised session replays and heatmaps on a sample of sessions, so I can see where pages confuse people; every tool's email form is marked as masked, so what you type into it is not recorded. The site also keeps a short record in your browser of which pages you have read here, on this visit and earlier ones, tagged with a random identifier so a repeat visit is not counted as a new person. That record stays on your device unless you send a contact form or use one of the tools, in which case a summary of it is attached so I can see what you read first. It also remembers whether you closed the prompt that slides in on phones. Clearing your browser's site data deletes all of it.
The visitor log works differently from that record, because it sends what it collects to me. It sets a cookie called _vid that holds a random ID and lasts a year. Every page you open sends that ID to my server with the page address and title, the page you came from, how long you stayed and how far you scrolled, your time zone, language, screen size and connection type, any UTM tags or ad click ID in the link, your IP address and your browser’s user agent. My server sends the IP address to a lookup service to see which network it belongs to. When a company runs its own network, that gives me the company’s name. For most people on home or mobile internet it only names the provider, such as Rogers or Comcast, and I treat that as unknown. The lookup never gives me a person’s name.
No advertising pixels and no retargeting. Apart from that network lookup, I don’t send anything about you to an outside service to be matched with other data, and I don’t buy anyone’s identity, so a name only gets attached to a visit in the case below.
The same record, plus the options you pick in the short fit quiz, decides which version of the homepage you see on your next visit. Someone who said they run a software company sees that version first. Web analytics receives the options you picked and the category the quiz assigned (for example “software, raising”). It never receives anything you type, or your name. What you type in the quiz reaches me only if you send the form afterwards.
There is one exception, for people who have already given me their email. If you send a form on this site that asks for an email (a contact form, a tool’s email option, the scorecard or a newsletter signup), the email and any name you typed are linked to the identifiers in that browser, so the pages you read before and after are tied to you. If the email is at a company domain, my server also records the company and reads its public homepage for a short description. Some links in emails I send you end with a short code, after ?vt=. The code is random and only my server can match it to you, so clicking one links that browser to your email the same way. I only put these codes in emails to people who gave me their address. If you’d rather not be matched, delete that part of the link before you open it. The page removes the code from the address bar as soon as it opens, so a link you copy from it won’t carry the code. When you come back later and read the pages about working with me, I get a private note so I can follow up personally. Once a week I also get a short list of people whose tool results suggest my work could fit, so I can write to them myself, and that list goes to no one else. Nothing is sent to you automatically, and none of this happens if you have never given me your email.
If you are in the UK or Europe, nothing that tracks you is stored on your device until you allow it. You get a banner on your first visit. Until you choose Allow, and permanently if you choose Decline, the session-replay tool, the anonymous visitor identifier and the visitor log do not run at all, so there is no session replay, no _vid cookie, and no tracking record in your browser. The one exception is a hand-off you start yourself. If you click from your store audit result to the quiz, or from your quiz result to the inquiry form, that browser tab keeps your answers just long enough to fill in the next page. They are deleted when the quiz or the form reads them, or when you close the tab, and nothing in them goes anywhere unless you send the form. Web analytics stays in a cookieless mode where it counts the page view but sets no cookie and cannot recognise you on a later visit. Your choice is remembered in your own browser, and clearing site data resets it. Elsewhere, analytics load by default, as described above.
The visitor log works differently from that record, because it sends what it collects to me. It sets a cookie called _vid that holds a random ID and lasts a year. Every page you open sends that ID to my server with the page address and title, the page you came from, how long you stayed and how far you scrolled, your time zone, language, screen size and connection type, any UTM tags or ad click ID in the link, your IP address and your browser’s user agent. My server sends the IP address to a lookup service to see which network it belongs to. When a company runs its own network, that gives me the company’s name. For most people on home or mobile internet it only names the provider, such as Rogers or Comcast, and I treat that as unknown. The lookup never gives me a person’s name.
No advertising pixels and no retargeting. Apart from that network lookup, I don’t send anything about you to an outside service to be matched with other data, and I don’t buy anyone’s identity, so a name only gets attached to a visit in the case below.
The same record, plus the options you pick in the short fit quiz, decides which version of the homepage you see on your next visit. Someone who said they run a software company sees that version first. Web analytics receives the options you picked and the category the quiz assigned (for example “software, raising”). It never receives anything you type, or your name. What you type in the quiz reaches me only if you send the form afterwards.
There is one exception, for people who have already given me their email. If you send a form on this site that asks for an email (a contact form, a tool’s email option, the scorecard or a newsletter signup), the email and any name you typed are linked to the identifiers in that browser, so the pages you read before and after are tied to you. If the email is at a company domain, my server also records the company and reads its public homepage for a short description. Some links in emails I send you end with a short code, after ?vt=. The code is random and only my server can match it to you, so clicking one links that browser to your email the same way. I only put these codes in emails to people who gave me their address. If you’d rather not be matched, delete that part of the link before you open it. The page removes the code from the address bar as soon as it opens, so a link you copy from it won’t carry the code. When you come back later and read the pages about working with me, I get a private note so I can follow up personally. Once a week I also get a short list of people whose tool results suggest my work could fit, so I can write to them myself, and that list goes to no one else. Nothing is sent to you automatically, and none of this happens if you have never given me your email.
If you are in the UK or Europe, nothing that tracks you is stored on your device until you allow it. You get a banner on your first visit. Until you choose Allow, and permanently if you choose Decline, the session-replay tool, the anonymous visitor identifier and the visitor log do not run at all, so there is no session replay, no _vid cookie, and no tracking record in your browser. The one exception is a hand-off you start yourself. If you click from your store audit result to the quiz, or from your quiz result to the inquiry form, that browser tab keeps your answers just long enough to fill in the next page. They are deleted when the quiz or the form reads them, or when you close the tab, and nothing in them goes anywhere unless you send the form. Web analytics stays in a cookieless mode where it counts the page view but sets no cookie and cannot recognise you on a later visit. Your choice is remembered in your own browser, and clearing site data resets it. Elsewhere, analytics load by default, as described above.
Who processes this data, and where?
A web host runs the site, its functions and my visitor log. A cloud database holds the visitor log, and an IP lookup service receives your IP address for the network check. The rest each handle one job: the spreadsheet, web analytics, the tag manager, page-speed testing, session replay, search analytics, the newsletter, and the email service that sends reports and follow-ups. If you want to know which company does any of these, write to me and I will tell you. These are United States services, so if you are outside the US your data is processed there. Taylor Sicard Consulting is based in Ottawa, Canada, and I am the one responsible for it.
Something here is wrong, or you have a question this does not answer.
Write to hello@taylorsicard.com. If this page has drifted from what the site actually does, that is a bug and I want to know. Last updated 4 November 2026.