Data policy
What we collect, and what we will never do with it
You are being asked for an email address and, optionally, a mobile number. This page says exactly what happens to both.
Last updated 1 February 2026
The short version
We collect your email address, and your mobile number if you choose to give it, for one purpose: to send you CAC Index updates about the launch and our research. We do not sell them, rent them, or hand them to any vendor we assess. You can ask us to delete them at any time, and we will.
What we collect
- Email address — required. It is how the update reaches you.
- Mobile number — optional. If given, it is used for at most one launch message, sent by SMS.
- Your consent record — the wording you accepted and the time you accepted it. We keep this so we can prove the consent was real if it is ever questioned.
- A one-way hash of your IP address — salted and truncated, used only to stop automated signups and abuse. The raw IP address is never stored, and the hash cannot be turned back into an address.
- Your browser's user-agent string — recorded with the signup to help detect abuse patterns.
What we do not collect: no advertising identifiers, no third-party analytics trackers, no cross-site profiling, no behavioural history, and no cookies for anything other than keeping this form working.
Why we are allowed to hold it
Because you told us we could. The consent checkbox on the signup form is the legal basis for these communications, and we record the exact text you saw and the moment you agreed to it. Withdrawing that consent is as easy as giving it — one click in any email, or one message to us.
Who can see it
The CAC Index team, and nobody else. The list is not shared with the vendors we assess, not with advertisers, and not with data brokers. Our database is operated on infrastructure that may process the data on our behalf as a service provider; it does not gain any right to use it.
How long we keep it
Until you unsubscribe or ask us to delete it. If an address has been unsubscribed and inactive for a long period, it is removed rather than retained indefinitely. The consent record for a deleted subscriber is retained only as long as needed to demonstrate that consent was properly given.
Your rights
You can ask to see what we hold about you, correct it, or have it deleted — and you do not need to give a reason. Write to [email protected] from the address concerned and we will act on it. Every email we send also carries an unsubscribe link that works immediately, without asking you to log in anywhere.
If something goes wrong
If we ever become aware of a breach affecting your data, we will tell the affected subscribers directly and promptly, and we will describe what was exposed rather than phrase it vaguely.
Changes to this policy
If the policy changes in any way that affects what we do with data we already hold, we will tell the list before the change takes effect — not after. The date at the top of this page always reflects the current version.
Contact
Questions, corrections, or a deletion request: [email protected].
CACIndex— independent analysis of e-commerce tooling