Legal
Countlift measures locations, not people. Here is exactly what we collect, why, who helps us process it, and how to have it deleted.
Effective · Countlift is operated by First Byte
Countlift is an outcome-measurement service for multi-location businesses. It is operated by First Byte, based in The Woodlands, Texas (“First Byte”, “we”, “us”). This policy explains what information we collect through the Countlift website, the Countlift app and related services (together, the “Service”), how we use and share it, and the choices you have.
Countlift is built for businesses, not consumers. In this policy, “Customer” means the business that holds a Countlift account, “Customer Data” means the business data a Customer uploads or connects, and “you” means the person using the Service.
For account information about the people who use Countlift, we decide how it is used and are responsible for it. For Customer Data, we act on the Customer’s behalf and process it only to provide the Service under our Terms of Service and any agreement we have with the Customer.
When you create an account or are invited to one, we collect your name and email address, the organization you belong to and your role in it (Owner, Admin, Analyst or Viewer), and which brands you can access. If you sign in with Google, we receive your name, email address and profile image from Google. If you sign in with an email link, we send a one-time link to your address. When you invite someone, we keep the invitation, including their email address and role, with your organization’s records.
Countlift works with aggregated business data about locations and advertising. Customer Data typically includes:
If you connect an ad platform or point-of-sale system, we read only what Countlift needs to measure outcomes. Raw provider responses are not stored: data is summed to daily totals as it arrives and kept as weekly totals per location or market. No order-level, customer-level or ad-level records are kept. We also store the list of accounts and locations available in each connection (IDs, names, cities and time zones) so you can map them.
| Service | What we receive |
|---|---|
| Google (sign-in) | If you choose “Sign in with Google”: your name, email address and profile image. |
| Google Ads | Daily cost by Nielsen metro (DMA) for the ad accounts you select. |
| Meta | Daily spend by DMA for the ad accounts you select. |
| Toast | Orders summed to daily guest counts and revenue per restaurant you map. |
| Square | Completed orders summed to daily order counts and revenue per location you map. |
| Slack | A channel webhook, used only to post the summaries and alerts you turn on. |
The access tokens, refresh tokens and webhook addresses these connections need are encrypted with AES-256-GCM before they are stored, are never returned by any Countlift API, and are deleted when you delete the connection.
When you ask Countlift a question, we keep a record that a question was asked and its length, so we can operate and secure the feature. The question and the answer are not stored in your account history.
Countlift keeps an audit log of significant actions in each organization — for example uploads, connections created or removed, and budget moves approved — with the user and time. Our hosting provider processes standard request logs (such as IP address, browser type and the page requested) to deliver and protect the Service.
If you subscribe to a paid plan, payment details are collected and processed by our payment processor. We keep a reference to your billing account and your plan, but we never receive or store full card numbers.
If you request a demo or contact us through a form on our website, we collect what you enter — your name, work email, company, website, role, approximate number of locations, monthly ad spend range, industry and message — together with your IP address and browser type, which we use to prevent spam. If you email us, we receive the information in your message. We use this information to respond to you and follow up about Countlift.
Countlift measures locations, not people. It is designed to work with aggregated counts and does not need information about your own customers, patients or guests. Customers must not upload or connect:
Aggregate counts with no individual identifiers — for example, the number of new patient visits at a practice in a week — are what Countlift needs. If you believe data of the kinds above has been sent to Countlift, contact us at hello@countlift.com and we will help you delete it.
We use the information described above to:
We do not sell personal information or Customer Data, we do not share it for cross-context behavioral advertising, and we do not use Customer Data to train AI models.
We use the following service providers (subprocessors) to run Countlift. Each may process data only to provide its service to us.
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Hosting for the website, the Countlift app and the MarketTwin™ analysis engine; scheduled jobs; request logs | All Service data in transit; location lists, weekly aggregates and spend sent for each analysis (the engine does not store them); account data; request logs |
| Prisma (Prisma Postgres) | Managed PostgreSQL database | Stored account data and Customer Data |
| Resend | Transactional email | Email addresses; sign-in links, invitations, alerts and reports you set up |
| Anthropic | AI answers in Ask Countlift and AI-written summaries | Your question and the brand’s summary analysis results; never raw sales rows |
| Stripe | Payment processing for paid plans | Billing contact and payment details; we do not store card numbers |
Anthropic processes Ask Countlift requests under its commercial terms for API customers. It receives only the question and a summary of the brand’s latest analysis — market and location results, not the underlying sales rows.
Services you connect. Google, Meta, Toast, Square and Slack receive or provide data only when someone in your organization connects them, and only as described in section 2.3. Your use of those services is governed by their own terms and privacy policies.
Within your organization. Customer Data is visible to members of your organization according to their role and brand access. An agency organization can grant a client user access to specific brands.
Other disclosures. We may disclose information if required by law or valid legal process, to protect the rights, safety or property of our users or the public, or in connection with a merger, acquisition or sale of assets, in which case this policy will continue to apply to the information transferred. We will update the list above before adding a new subprocessor that processes Customer Data.
You can ask us to delete your account or your organization’s data at any time by emailing hello@countlift.com. We complete deletion requests within 30 days, except where we must keep information to meet a legal obligation.
Deleting a connection in Countlift does not revoke Countlift’s access at the provider, because the same login may serve other brands. You can remove Countlift under Facebook Business Integrations, your Google Account permissions, the Square Seller Dashboard apps list, Toast Integrations or Slack app management.
We use administrative, technical and organizational measures designed to protect information, including:
No method of transmission or storage is completely secure. If we learn of a security incident affecting your information, we will notify you as required by law. To report a vulnerability, email hello@countlift.com.
Marketing website. The public Countlift website does not set cookies for analytics, advertising or tracking, and does not load third-party advertising pixels.
Countlift app. When you sign in, the app sets essential cookies only: a session cookie that keeps you signed in, and short-lived security cookies used during sign-in (for example, to protect against cross-site request forgery). These cookies are necessary for the Service to work and are not used for advertising. You can delete them in your browser, but you will be signed out.
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to appeal a decision we make about your request. You can exercise any of these rights by emailing hello@countlift.com. We will verify your request and respond within 30 days, or sooner if the law requires it. We will not discriminate against you for exercising your rights.
If your request concerns Customer Data that your organization controls, we may refer you to your organization’s Countlift administrator and will help them respond.
In the app, Owners and Admins can export results as CSV files, remove connections and their data, delete brands, and remove members and invitations at any time.
Countlift is operated from the United States, and information is processed in the United States by us and our subprocessors. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.
The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this policy as the Service changes. We will post the updated policy here and change the effective date. If a change materially affects how we use personal information or Customer Data, we will notify account Owners by email or in the app before it takes effect.
Questions or requests about this policy or your information: hello@countlift.com. First Byte, The Woodlands, Texas, United States.