PRIVACY POLICY
Last Updated: July 12, 2026
Wise International LLC (“Company,” “we,” “us”), a Wyoming limited liability company operating SHA-256 Labs (https://sha-256.co), provides this Privacy Policy to explain how we collect, use, disclose, and protect personal information in connection with our website, dashboards, and GEO software services (the “Services”).
This Policy is a notice. Where consent is required by law, we will obtain it through an appropriate mechanism. Using the Services does not by itself waive statutory privacy rights.
1. Controller / Business
Business name: Wise International LLC
Brand: SHA-256 Labs
Contact: support@sha-256.co
For California CPRA purposes, we are a “business.” For GDPR/UK GDPR (if applicable), we are the “controller” of personal data we determine the purposes for.
2. Categories of Personal Information We Collect
| Category | Examples | Sources |
|---|---|---|
| Identifiers | Name, email, Clerk user ID, IP address (hashed for anonymous rate limits) | You; Clerk; automatic |
| Commercial information | Plan tier, billing status, Stripe customer/subscription IDs | You; Stripe |
| Internet / network activity | Pages viewed, feature usage, device/browser, referrer | Automatic; analytics |
| Professional information | Brand names, domains, URLs, keywords you submit | You |
| User content | Drafts and text submitted to scoring, optimization, or conversion tools | You |
| Inferences | Limited product analytics (e.g., feature usage patterns) | Derived |
We do not collect payment card numbers on our servers; Stripe processes payments.
Sensitive personal information: We do not intentionally collect SSNs, precise geolocation, biometric identifiers, or government ID. Do not submit such data into the Services.
3. AI / GEO Processing (Important)
When you run audits, Share of Voice checks, scoring, optimization, or conversion tools, we process:
- URLs, brand/keyword queries, and related metadata;
- generated scores, reports, and rewritten drafts;
- prompts and outputs sent to third-party model providers (e.g., OpenAI, Google Gemini, xAI, Perplexity, and—where configured—DeepSeek / Qwen) as needed to deliver the feature you requested.
What this means: content you submit to AI features is transmitted to those providers under their data-processing terms. Do not submit secrets, passwords, health data, or confidential third-party data you are not authorized to process.
We store short previews / metadata of tool results in your account history (not full article bodies by default) to power the dashboard History tab.
4. How We Use Information
We use personal information to:
- provide, secure, and maintain accounts and Services;
- process subscriptions and prevent fraud/abuse (including rate limits and quota enforcement);
- enforce Terms, quotas, and acceptable use;
- communicate service, security, and billing notices;
- improve product quality and reliability;
- comply with law and respond to lawful requests;
- with your consent or as otherwise permitted, send product updates/marketing (you may unsubscribe).
Legal bases (EEA/UK, if applicable): contract performance; legitimate interests (security, product improvement, fraud prevention); consent (where required); legal obligation.
5. Cookies and Tracking
We use essential cookies (authentication/session via Clerk) and may use analytics cookies (e.g., Google Analytics). You can control cookies via browser settings; disabling essential cookies may break login. We honor Global Privacy Control (GPC) signals as a “Do Not Sell/Share” request where required by applicable U.S. state law, to the extent technically feasible.
Guest (logged-out) scan results may be stored temporarily in your browser localStorage on your device only.
6. Disclosures to Service Providers / Processors
We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising as defined by CPRA.
We disclose personal information to vendors that help us operate (“service providers” / “processors”), including:
| Vendor | Purpose |
|---|---|
| Clerk | Authentication / identity |
| Stripe | Payments / billing |
| Google Cloud / Firestore | Hosting / databases |
| Cloudflare | CDN / security / edge |
| Vercel / Framer | Website hosting |
| LLM / AI API providers | Feature generation and scoring |
| Analytics providers | Aggregated product analytics |
| Email / support tools | Customer communications |
We may disclose information if required by law, legal process, or to protect rights, safety, and integrity of the Services, or in connection with a merger, acquisition, or asset sale (with notice where required).
7. Retention
We retain personal information only as long as needed for the purposes above. Current product defaults:
| Data | Retention |
|---|---|
Dashboard scan history (Firestore scan_history) | 30 days, then auto-deleted via TTL; you may clear it anytime in the dashboard |
| Usage / quota / paywall logs | Typically ~31 days |
| Pending checkout reconcile records | Typically ~90 days |
| Account / identity (Clerk) | Life of the account + up to 24 months after closure (or longer if required for disputes/taxes/legal holds) |
| Billing records (Stripe + necessary mappings) | As required by tax and accounting laws (often up to 7 years) |
| Marketing contacts | Until you opt out or we delete inactive contacts |
Automated deletion depends on cloud TTL jobs completing; residual copies may briefly remain in backups.
8. Security
We implement commercially reasonable administrative, technical, and organizational measures, including:
- HTTPS in transit;
- server-side access to customer databases (no public client Firestore access);
- authentication via Clerk;
- secrets stored in cloud secret managers;
- rate limits and abuse controls on expensive API routes.
No method of transmission or storage is 100% secure. You use the Services at your own residual risk.
9. International Transfers
We may process data in the United States and other countries. If you are in the EEA/UK, we rely on appropriate transfer mechanisms (e.g., Standard Contractual Clauses) where required.
10. Your Privacy Rights (U.S. States including CCPA/CPRA)
Depending on your state of residence, you may have rights to:
- Know / access categories and specific pieces of personal information;
- Delete personal information (subject to exceptions);
- Correct inaccurate personal information;
- Opt out of sale/sharing (we do not sell/share as defined);
- Limit use of sensitive personal information (we do not use sensitive PI for inference of characteristics);
- Non-discrimination for exercising rights;
- Appeal a denied request (where required).
How to exercise (self-serve + email)
- Clear History in the dashboard deletes your cloud scan history immediately.
- Export: authenticated
GET /api/privacy/exportreturns your stored history JSON (30-day window), or email us for a copy. - Account / billing deletion or other rights: email support@sha-256.co with subject “Privacy Request,” state your request type, and the email on your account. We verify identity (e.g., via account email control) and respond within 45 days (extendable as permitted by law). You may use an authorized agent as allowed by law with proof of authorization.
Closing a Clerk account does not automatically purge every billing record we must keep for legal/tax reasons.
Notice at Collection: We collect the categories in Section 2 for the purposes in Section 4. We do not sell or share personal information.
11. Children’s Privacy
Services are not directed to children under 13 (or under 16 where required). We do not knowingly collect personal information from children. If you believe we have, contact us for deletion.
12. Changes
We may update this Policy by posting a new version with a revised “Last Updated” date. Material changes will be highlighted where appropriate. Continued use after the effective date means you acknowledge the updated Policy.
13. Contact
Email: support@sha-256.co
Entity: Wise International LLC (Wyoming)
Brand: SHA-256 Labs