Privacy Policy

The short version

We collect what the product needs to work and nothing else. There are no analytics, no advertising, no tracking pixels and no third-party cookies on this site. We do not sell or share anything for advertising.

Who we are

Exalted is operated by Tyler Helton. Questions about any of this go to hello@getexalted.com.

What we collect from customers

• Your email address and business name, so you can sign in and so the product can address you.
• Your password, hashed. We store a scrypt hash with a random salt, never the password itself. Nobody here can read it.
• Billing state — your plan, whether it is active, and the identifiers Stripe gives us. We never see or store your card details. Those go straight to Stripe on their own page.
• Server logs, kept briefly, so we can work out what broke when something breaks.

What we collect from your clients

When somebody fills in one of your collection links, we store the name they type, the role they type if they choose to, their star rating, and their testimonial.

We do not ask them for an email address or a phone number and we do not have one for them. We never contact them, and we never market to them.

This information is collected on your behalf. You decide whether it gets published, and you are responsible for having their permission to publish it.

Waitlist

If you joined the waitlist before signing up, we stored your email and which link brought you here, so we knew what was working. Ask and we will delete it.

Cookies

One cookie: your sign-in session. It is necessary for the site to know you are signed in, it holds a random token rather than anything about you, and it expires after 30 days. No analytics or advertising cookies exist on this site, so there is no consent banner to click through.

Who else touches your data

Four companies, each doing one job:

• Neon — the database your data is stored in
• Vercel — hosting, so the website runs
• Stripe — payments, and the only one that handles card details
• Resend — sends the emails Exalted sends you

That is the whole list. We do not sell data, we do not share it for advertising, and we do not hand it to anybody else unless the law requires it.

Where it is kept

On servers in the United States. If you are outside the US, using Exalted means your data is processed there.

How long we keep it

• Account and testimonials: until you ask us to delete them.
• Sign-in sessions and emailed links: they expire on their own, and expired ones are cleared out automatically.
• Server logs: a short period, then gone.

Your rights

Whatever country you are in, you can ask us to show you what we hold about you, correct it, or delete it. Email hello@getexalted.com and we will do it — normally within a few days, and at most within a month.

If you are in the EU or UK, that includes your rights under the GDPR, and you can complain to your data protection authority. If you are in California, that includes your rights under the CCPA. We do not sell personal information, so there is nothing to opt out of.

If you are a client who wrote a testimonial and want it removed, you can ask the business you wrote it about, or email us and we will pass it on and act on it.

Children

Exalted is for businesses. It is not intended for anybody under 18 and we do not knowingly collect their information.

Security

Passwords are hashed with scrypt and a random salt. Sign-in sessions and emailed links are stored only as SHA-256 hashes, so a stolen copy of the database could not be used to sign in as anybody. Everything travels over HTTPS.

No system is perfect. If we ever discover a breach that affects you, we will tell you.

Changes

If we change this policy in a way that matters, we will email you. The date at the top always says when it was last updated.