Skip to content

Legal

Privacy Policy

1. Introduction

Causality Engine B.V. ("we," "our," or "us") is a private limited company registered in Utrecht, Netherlands. We are the data controller under the General Data Protection Regulation (GDPR) for the personal data processed through our marketing attribution and analytics platform.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services. By accessing or using Causality Engine, you acknowledge that you have read and understood this policy.

2. Information We Collect

We collect the following categories of information:

  • Account data, name, email address, and company details provided during registration
  • Marketing data you integrate, data from Google Analytics 4, Shopify, ad platforms, and other sources you connect to the platform for attribution analysis
  • Payment information, processed by our payment provider Polar Software Inc. We do not store credit card details on our servers
  • Usage data, platform interactions, feature usage, session information, and technical logs
  • Communications, messages and correspondence with our support team
  • Cookie and consent data, your cookie preferences and consent records as described in our Cookie Policy

Benchmark contribution on /start. The free preview at /start reads your GA4 export in your browser and does not upload it. Under the first finding you can choose to add four numbers to a public benchmark: the days buyers who saw two or more channels took to convert, the days for one channel (Direct left out), your number of channels and how many days the export covers. Nothing is sent unless you click to add them. We store those four numbers, the time they arrived and the version of the wording you agreed to, and nothing else: no store name, no file, no IP address, nothing that identifies you or your customers. We publish only averages, and only once 30 stores have taken part. To have yours removed, write to hi@causalityengine.ai. We keep no identifier, so we cannot tell which entry is yours; send us your four numbers and we will delete any entry that matches them.

The free book. When you ask for The Price of Being Found, we store the email address you enter, the page you asked from, the time zone your connection comes from and whether you ticked the box for research emails, and we send you one email with a confirmation link. The link carries your address in encrypted form and stops working after 48 hours. Opening it sends nothing: the book goes out only when you press the button on the page it opens. Then we mark the address as confirmed and add it to our CRM (HubSpot) as someone who asked for the book. If you ticked the box, we also record when you did and the wording you agreed to, and add the address to our research list at Resend; every research email has a one-click unsubscribe. Without the box ticked, the only emails our website sends you for the book are the confirmation and the book itself, and if you never confirm, nothing more is sent. To have your address removed, write to hi@causalityengine.ai.

3. How We Use Your Data

We use the information we collect for the following purposes:

  • Service delivery, to provide, maintain, and operate the Causality Engine platform
  • Attribution analysis, to process your marketing data and generate causal attribution insights
  • AI processing, your data may be sent to OpenAI, Anthropic, Google, and PublicAI (a Swiss AI provider) for real-time inference only. These providers do not train their models on your data
  • Product development, to improve and develop new features based on usage patterns and feedback
  • Anonymised benchmarking, to create aggregate, anonymised benchmarks as permitted under our Terms of Use (Section 7.7)
  • Fraud prevention and security, to detect, prevent, and address technical issues, abuse, and unauthorised access

4. Legal Basis for Processing

Under GDPR Article 6, we process your personal data on the following legal bases:

  • Contract performance, processing necessary to deliver the services you have subscribed to, including attribution analysis and platform access
  • Legitimate interests, security monitoring, usage analytics, product improvement, and fraud prevention, where these interests are not overridden by your rights
  • Consent, marketing communications and non-essential cookies, which you may withdraw at any time
  • Legal obligation, where processing is required to comply with applicable law, including tax records and fraud prevention obligations

5. Data Sharing and Sub-processors

We do not sell your personal data. We share data with the following categories of sub-processors to operate our services:

  • Hosting and infrastructure. Vercel (EU/US), Microsoft Azure (Netherlands), Supabase (EU), Railway (EU)
  • AI inference providers. OpenAI, Anthropic, Google, and PublicAI. Data is sent for real-time inference only; no provider trains models on customer data
  • Payment processing. Polar Software Inc.
  • Email. Migadu (Switzerland), for our mailboxes, and Resend, which sends the emails our website sends, from the EU (Ireland)
  • Analytics and monitoring. PostHog (EU; product analytics and session recordings, with typed values and tool results masked), Sentry (EU), Google Analytics via Stape server-side proxy (EU), HubSpot (EU)
  • Marketing. TikTok and Pinterest (Pinterest Europe Limited, Ireland), for advertising measurement. Both run only where marketing consent has been given. When you have given that consent and leave your email address on one of our forms, we send TikTok and Pinterest a hashed (SHA-256) copy of it, with your IP address and browser details, so they can measure whether one of their ads led to the sign-up. The legal basis is your consent (GDPR Article 6(1)(a)); withdraw it in the cookie settings at any time and nothing more is sent
  • Security. Tirreno Technologies
  • Video. YouTube (Google Ireland Limited) plays our videos on some articles and glossary pages, only when you press play: until then the page loads nothing from YouTube. Playback runs from youtube-nocookie.com under YouTube's own privacy policy
  • Other. Brandfetch (logo retrieval)

6. International Transfers

We maintain EU data residency for our primary infrastructure. Where sub-processors operate outside the European Union, data transfers are protected by EU Standard Contractual Clauses (SCCs) or European Commission adequacy decisions, in accordance with GDPR Chapter V.

7. Data Retention

We retain your data according to the following schedule:

  • Pay-per-use (PPU) analyses, source data and the analysis stay available while you use them, and are deleted 30 days after your last visit to the analysis
  • Pro subscription data, retained for the duration of your active subscription
  • Anonymised derivatives, retained indefinitely for benchmarking purposes as permitted under our Terms of Use (Section 7.7)
  • Account deletion, you may request deletion of your account and associated data via support@causalityengine.ai or through your account settings. Deletion requests are processed within 30 days

8. Your Rights

Under GDPR Articles 15 through 22, you have the following rights regarding your personal data:

  • Right of access, obtain confirmation of whether we process your data and request a copy
  • Right to rectification, request correction of inaccurate or incomplete personal data
  • Right to erasure, request deletion of your personal data where there is no compelling reason for continued processing
  • Right to restrict processing, request that we limit how we use your data in certain circumstances
  • Right to data portability, receive your data in a structured, commonly used, machine-readable format
  • Right to object, object to processing based on legitimate interests, including profiling
  • Right to withdraw consent, withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing
  • Right to lodge a complaint, file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority

To exercise any of these rights, contact us at legal@causalityengine.ai.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data. These include encryption at rest and in transit, Supabase Auth with HTTP-only cookies for session management, NaCl sealed-box encryption for stored credentials, role-based access controls, and regular security assessments.

10. Children

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 14 days advance notice via email to the address associated with your account. The updated policy will be posted on this page with a revised "last updated" date.

On 25 September 2026 we named Resend as an email sub-processor (Section 5), which already sent our website's emails, and changed how long pay-per-use data is kept (Section 7). The retention change applies to analyses bought from 25 September 2026 at once, and to earlier analyses from 9 October 2026.

On 28 September 2026 we added Pinterest to the advertising measurement that runs only with marketing consent, and described what TikTok and Pinterest receive when you sign up with that consent (Section 5). A marketing choice made before that date does not cover Pinterest: our cookie banner asks again, and Pinterest stays off until you answer.

On 30 September 2026 we replaced Snitcher with Leadfeeder for business visitor identification (Section 5). Leadfeeder can also link the pages you visit to a form you submit, including the email address you enter, which Snitcher did not do. A marketing choice made before that date does not cover Leadfeeder: our cookie banner asks again, and Leadfeeder stays off until you answer.

On 7 October 2026 we described what happens when you ask for our free book (Section 2).

On 15 October 2026 we removed Leadfeeder from our website (Section 5). It ran from 30 September 2026, only for visitors who allowed marketing cookies, and collects nothing from our website now. If you allowed it, our website deletes the identifiers it left in your browser on your next visit.

12. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at legal@causalityengine.ai.

Causality Engine B.V.
Utrecht, Netherlands