Privacy policy
What we collect, who processes it, and how to get it deleted.
Last updated 20 July 2026
Causal is pre-launch. There is no product to sign into and no agent memory stored anywhere. The only personal data we hold is a waitlist email address and, if you accept the analytics banner, ordinary website analytics.
Who we are
Causal (“we”, “us”) operates causal.store. We are the data controller for everything on this page. Write to hello@causal.store for any privacy question or request.
What we collect
If you join the waitlist
- Your email address. You type it; that is the only field on the form. It is stored as a contact in our Resend segment, which is the waitlist itself.
- How you got here. The referring URL, any UTM parameters in the address bar, the page you submitted from, and the time. This is not stored with the contact. It is sent to us in a notification email, so that we can see which channels reach people, including whether an AI assistant sent you.
- Your IP address, briefly. The submission endpoint counts recent requests per IP to block abuse. The count lives in server memory, is never sent to Resend, and is not stored with your email.
If you accept analytics
- Analytics. Pages viewed, referrer, approximate location derived from IP, device, browser, and how you moved through the page.
- Session recordings and heatmaps. Microsoft Clarity records anonymised interaction with the page. Keystrokes in form fields are masked by default.
Either way
- Server logs. Vercel records requests, including IP address, as part of serving the site. This happens for every request and is not something analytics consent turns on or off.
- Your answer to the analytics banner. Stored in your browser, described under Cookies and local storage below. It is stored whether you accept or decline, and it never leaves your device.
We do not collect payment details, government identifiers, or special-category data. There are no accounts. We do not buy personal data from anyone.
Why we are allowed to (GDPR legal bases)
- Consent for the waitlist. You gave us the address to be told when Causal opens. Withdraw it any time and we delete the record.
- Consent for analytics. Google Analytics and Microsoft Clarity load only after you accept the banner.
- Legitimate interests for abuse prevention and server logs: keeping the form from being flooded, and knowing that requests were served.
Analytics consent
Until you answer the banner, no analytics script is on the page and Google Analytics and Microsoft Clarity receive nothing from your visit. Decline and none of it ever loads. Accept and the tags load, with advertising storage left denied — we run no advertising and link no ad account.
Your answer is remembered in your browser, so you are asked once rather than on every page. You can change it here:
Changing an acceptance to a decline reloads the page, which is what removes the tags already running on it, and no further data is collected after that. Clarity is also told to delete the cookies it set. Google gives websites no way to delete its cookies from your browser, so a _ga cookie already written stays until it expires or you clear it — clearing site data for causal.store removes it immediately.
Who processes it
These are our processors. Each is bound by its own data processing terms and none of them receives your data to use for their own purposes. Resend and Vercel are the only two that receive anything before you accept analytics, and Resend only hears from us if you submit the form.
| Processor | What it receives | Why |
|---|---|---|
| Resend | Your email address, stored as a contact. Separately, a notification email to us carrying that address, the page you signed up from, its referrer, any campaign parameters in the URL, and the time | Holding the waitlist, and telling us a signup happened |
| Vercel | Request logs, IP address | Hosting and delivering the site |
| Google Analytics 4 | Only after you accept: page views, referrer, device, approximate location, IP (truncated by Google) | Traffic and channel measurement |
| Microsoft Clarity | Only after you accept: anonymised session recordings, heatmaps, page metadata | Seeing where pages confuse people, and which AI assistants cite us |
Resend is the only processor that sees your email address. It holds the address in a segment — Resend’s name for a contact list — and sends the notification that tells us you joined. Only the address is stored in that list; the attribution exists in the notification email and nowhere else. There is no database, no CRM, and no marketing platform behind this form.
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in the CCPA/CPRA. We do not run advertising pixels on this site.
Cookies and local storage
This site sets one thing before you have chosen anything: your answer to the analytics banner, under the key causal:analytics-consent:v1in your browser’s local storage. It records the word granted or denied. It is stored whether you accept or decline. Being local storage rather than a cookie, it is never attached to a request and never reaches us; this site reads it only to decide whether to ask you again.
If you accept, Google Analytics sets _ga and _ga_<id>, and Microsoft Clarity sets _clck and _clsk, all first-party and used to tell one visit from another. Nothing on this site sets an advertising cookie. If you decline, none of these are set. Blocking cookies in your browser, or using a tracker blocker, costs you nothing on causal.store.
How long we keep it
- Waitlist entries: until Causal launches and we have invited you, or until you ask us to delete the record, whichever comes first. Deleting the record removes the Resend contact and the notification email that carried its attribution.
- Google Analytics: 14 months.
- Microsoft Clarity:recordings for 30 days, aggregate metrics for 13 months, per Clarity’s own retention.
- Server logs:Vercel’s standard log retention, currently up to 30 days.
- Your analytics answer: in your browser until you clear site data. We never receive it, so we cannot delete it for you.
International transfers
Google, Microsoft, Resend and Vercel are US companies and may process data outside the EEA and the UK. Those transfers rely on the EU–US Data Privacy Framework and on Standard Contractual Clauses where the Framework does not apply.
Your rights
Under the GDPR you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable format, or withdraw consent. Under the CCPA/CPRA you can ask what we have collected, have it deleted or corrected, and opt out of sale or sharing — which for this site is already the default, because neither happens. You will never be treated differently for exercising any of these.
Email hello@causal.store. We answer within 30 days. Deleting a waitlist entry takes one reply and needs no account, no form, and no reason. If you think we have handled your data badly, you can complain to your national data protection authority.
Children
Causal is a developer tool for businesses. This site is not directed at anyone under 16, and we do not knowingly collect their data. Tell us if we have and we will delete it.
Security
The site is served over TLS and waitlist submissions are encrypted in transit. Access to the Resend account holding the waitlist is limited to the people who need it. We hold as little as possible: one email address and where it came from.
Changes
When this policy changes, the date at the top changes with it. If a change materially affects people already on the waitlist, we email them before it takes effect.