Security & privacy
Countlift works from sales totals by location and ad spend by market. No customer records and no tracking, so there is nothing to leak about the people who walk in.
What we never collect
Countlift has no use for anything that identifies a person, so it never stores it.
Never
All we use
POS connectors roll orders into daily totals as they arrive. Individual orders are not saved.
Where your data goes
The engine also reads calendar, holiday, weather and local-event data, none of it about people. Local market data (early access) and benchmarks from similar brands (opt-in) are aggregates; benchmarks only pool five or more brands and never include prices or margins. No phone tracking. What feeds the engine →
Built-in controls
Meta connects with ads_read only. Google Ads gets reporting queries only. Countlift never creates, edits, pauses or spends.
Connection tokens and webhook URLs are encrypted with AES-256-GCM before storage. Disconnecting deletes them.
Every connection between your browser, Countlift and our providers is encrypted in transit.
Delete a brand and its locations, sales, spend and results go with it. Want everything gone? Ask us.
Four roles. Agency client users can be limited to specific brands.
| Can | Owner | Admin | Analyst | Viewer |
|---|---|---|---|---|
| See results and reports | ||||
| Upload data, run reads, plan tests | ||||
| Connect accounts, approve moves, invite people | ||||
| Manage owners and roles |
Every approval, upload and connection, with who did it and when.
Dental, clinics & med spas
Countlift works from daily visit counts per location. It never receives protected health information: no names, birth dates, appointments or treatments.
Because no PHI is involved, Countlift is not positioned as a HIPAA-covered service and does not sign business associate agreements. Send only aggregate counts.
Subprocessors
A short list: each provider, what it does and what it sees.
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Web application and analysis engine hosting | Account details, results, and sales and spend totals in transit or for the length of a read |
| Prisma (Prisma Postgres) | Database | Account details, totals, results, encrypted connection tokens, audit log |
| Resend | Email delivery | Recipient email addresses and report or alert content |
| Anthropic | Ask Countlift answers | Summary results only, never raw sales rows |
Send it over. We answer plainly, including what we don’t have yet: Countlift does not currently hold SOC 2 or ISO 27001 certification.
Email hello@countlift.comTell us privately, with steps to reproduce. Don’t access other customers’ data or disrupt the service while testing. We’ll confirm receipt and keep you posted on the fix.
Report to hello@countlift.comSee also our privacy policy and how the measurement works.
Free location report · No card · Totals only