Privacy Policy

• Sample and preview requests. When you request the free sample we collect your email, and optionally your name, company, and website. When you run a free live preview, you give us the subject you ask us to preview - a brand domain (Brand Defense) or a Reddit username you own or are entitled to compile (Reddit Recovery) - which we use only to generate the preview from public data and do not retain beyond that, except for an email you choose to give us for follow-up.
• Orders. When you buy any service, payment is handled by Stripe. We receive order metadata (tier, amount, email) but not your full card number.
• Order inputs. To fulfil an order you give us a subject to research: a buyer category or product (Buyer Cuts), a brand domain (Brand Defense), or a Reddit username you own or are entitled to compile (Reddit Recovery). We use it only to produce and deliver your order.
• Correspondence. If you email us or use the site chat, we keep that correspondence to answer you. The chat assistant’s replies are generated by a third-party model provider (see section 5).
• Usage data. If you consent to analytics, we collect aggregate usage data through Google Analytics 4 (see section 2).

We use Google Analytics 4 to understand which pages convert. Analytics cookies and the GA script load only after you consent through the cookie banner. If you decline, no analytics cookies are set and the GA script does not run. You can change your choice at any time by clearing the consent and reloading.

GA4 collects information such as a truncated IP address, pages viewed, approximate location, device and browser type, and referral source. We do not use this data to identify you personally. Google processes this data as a service provider; see Google’s own privacy resources for details.

• to send the free sample you requested (a single email, no marketing sequence unless you opt in);
• to fulfil and deliver reports you order, and to support you;
• to respond to your messages;
• with consent, to measure and improve the site.

Where GDPR applies, we rely on: performance of a contract (to deliver reports you order), consent (for analytics and any marketing email), and legitimate interest (to answer enquiries and secure the site).

We use a small set of processors and do not sell your data. They are:

• Stripe, payment processing;
• Resend, transactional email delivery;
• Anthropic, the model behind the site chat assistant (it receives only the messages you send in chat, to generate a reply);
• Google Analytics, site analytics (with consent);
• Vercel, hosting and content delivery.

For Buyer Cuts, Winnowhq cites content that people have posted publicly on Reddit. We reproduce short verbatim quotes for the purpose of citation and commentary, alongside a link to the original public post. We may show a public username as it appears on the source post.

We do not, and a deliverable must not be used to:

• deanonymize, dox, or attempt to identify the real-world identity of any poster;
• enrich, append, or cross-reference a poster against other personal data;
• contact a poster in a way that violates Reddit’s rules or applicable law.

Takedown. If you are the author of a quoted post and want it removed from current and future issues, email editor@winnowhq.com with the source link. We will remove it from materials we control within 7 business days and confirm when done.

For Reddit Recovery we read the public RSS/Atom feeds of the account you specify and compile its public posts and comments into an archive we deliver only to you. We do not access private messages, login-gated, or deleted-and-hidden content. You must own the account or be entitled to compile the public data; the Reputation /Record Pull is a compilation of public posts, never an investigation or a deanonymization tool. We keep the archive only as long as needed to deliver it and support you, then remove our working copy on request.

For Brand Defense we query public domain registries (RDAP/WHOIS) and DNS for the brand domain you submit. This is public business-record data about domains, not personal data about you. We deliver the audit only to you and transact no domains during research.

We keep order records as long as needed for tax and accounting obligations. Sample-request emails are kept until you ask us to delete them or they are no longer useful. Analytics data is retained for the period configured in GA4, currently 14 months.

Depending on where you live (for example under GDPR or CCPA) you may have the right to access, correct, delete, or port your data, to object to or restrict processing, and to withdraw consent. To exercise any of these, email editor@winnowhq.com. We do not sell personal information.

We use reputable processors and reasonable technical measures to protect data in transit and at rest. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Our processors may store and process data in the United States and other countries. Where required, transfers rely on appropriate safeguards such as the processors’ standard contractual clauses.

The Service is for business users and is not directed to anyone under 16. We do not knowingly collect data from children.

We may update this policy; the “Last updated” date reflects the latest version. Questions or requests: editor@winnowhq.com. Data controller: Ayomide Emmanuel Olabisi trading as Winnowhq.