10Signals privacy policy
10Signals is operated by 10claws, Inc. This policy covers our hosted website, account service, connected chat tools, research reports, price monitoring and support. Last updated: 23 October 2026. Contact support@10signals.xyz with privacy questions or requests.
Account, research and monitoring data
We process your account name, email address, account and workspace identifiers, authentication and session records (including the IP address and browser identifier recorded at sign-in), plan and payment-provider references, and report and monitoring usage. These records let us sign you in, separate workspaces, enforce permissions and allowances, manage subscriptions, and investigate service failures. Payments are handled by Stripe; payment-card details should not be entered into our chat tools or support forms.
Research inputs include the website domains and product URLs you request, selected products and competitors, and preferences or feedback you submit. We save report results, public-page evidence, prices, source URLs, observation times, comparison choices, job status and usage records. Price monitoring also stores watched URLs, schedules, checks and notifications. Public pages may contain business contact information or other personal information published by their owners. We use this data to deliver the research or monitoring you request, not to obtain private competitor records.
Who receives service data
Our hosting and infrastructure providers process service records to run and protect 10Signals. Research and orchestration providers, including OpenAI, Trigger.dev, Context and Firecrawl, receive the inputs and public-page material needed for the requested research or page retrieval. Payment providers process billing information; email-delivery providers process recipients and notification or support content. Authorized support staff can access relevant account and operational records to handle requests and failures. Chat clients receive the tool results you request. Chatbase, Google Analytics and PostHog processing is described separately below.
Retention and your controls
Standard saved reports have a 90-day expiry. Paid organisation access can extend saved-report retention through the paid period plus 90 days, as described in our terms. Competitor catalogue crawl results are removed during later cleanup after 30 days, or when their report no longer exists. Expired reports and their associated report records are eligible for cleanup, with safeguards for active work; expiry is not a promise of immediate deletion from every system. MCP action previews expire after five minutes. Confirmation intents and command receipts older than the applicable 30-day cutoff are removed when a new preview is created. OAuth access tokens expire after ten minutes and refresh tokens have a 30-day lifetime; credential expiry or revocation does not itself erase historical operational records.
Price watches and their observation history have no automatic expiry; you can delete a watch to remove its associated history. Aggregate billing usage is retained separately. Account, billing, support and operational records do not all follow the report expiry window. Records without an automatic expiry remain until removed through the applicable service or support process. Provider-side records and backups can have separate retention, so deleting an active record does not immediately remove every copy. Contact support for access, correction or deletion requests and the retention applicable to your records; we verify account ownership before acting.
You can revoke chat access in Account → Connected apps, manage or remove price watches, change comparison feedback, and disable report sharing. Removing an organisation from tracking retains its saved report history until expiry. Revoking a chat connection prevents future access but cannot remove results already delivered to the chat client. Analytics controls and their limitations are explained below.
Chat connections and support
The support email form sends your supplied email address, subject and message through Cloudflare to our support inbox so we can reply. Your reply address is supplied by you, not verified by the form. Delivery protection uses a hash of the address and submission ID for a 24-hour window; older entries are removed on the next submission. Message content is not stored in the application database. The message remains in our support mailbox for handling your request.
When you connect 10Signals to a chat client, OAuth grants that client the permissions shown on the consent screen. Tool calls use your account and workspace to read saved reports, products, competitors and watches, or carry out authorized changes. Requested results are returned to that client, whose own privacy terms also apply. You can revoke a connection from Connected apps in your account. Revocation stops future access; it does not remove results already returned to the chat client.
Hosted MCP tool-call analytics sent to PostHog include the tool name, outcome, duration, a hashed client identifier and an account identifier, with verified report correlation when available. Raw tool inputs, results and credentials are excluded from these analytics. We retain connection and operational records needed to authenticate requests, enforce permissions and investigate failures. Do not include passwords, API keys or payment-card details in tool inputs or support messages. Our support chat is provided by Chatbase; messages you send there are processed by Chatbase and are available to our support team. For privacy questions or account-deletion requests, contact 10Signals support.
We use two analytics services. Google Analytics runs on every page for every visitor. PostHog usage analytics and technical browser diagnostics are enabled by default on supported pages of our hosted service, including for existing customers. There is no analytics prompt or preference button. Do Not Track and Global Privacy Control disable PostHog collection; they do not stop Google Analytics.
Google Analytics
Every page of 10Signals loads Google Analytics 4 (measurement ID G-TVLFZPN2BP), provided by Google LLC in the United States. It starts when a page opens, for every visitor. Do Not Track and Global Privacy Control do not turn Google Analytics off.
Google Analytics collects the full address of each page you visit, including report addresses and shared-report links, the page title, the referring page, your browser, device, screen size and language, and events such as scrolling, clicks on links that leave our site and file downloads. Google receives your IP address and uses it to estimate your approximate location; Google says Google Analytics 4 does not log or store IP addresses. It sets first-party cookies (_ga and _ga_TVLFZPN2BP) that recognise returning browsers for up to two years. Google processes this data under its own terms and privacy policy.
When you pay for a plan, a renewal or Price Watch credits, we also tell Google Analytics about that purchase: its order number from our payment provider, the amount and currency, and the plan or credit pack bought. We send it either from your browser, using the same Google Analytics tag, or from our server. For the server route we keep the Google Analytics browser identifier from your _ga cookie with your account when you start a checkout, where there is one, so the purchase is linked to your visit. We do not send your name, email address, account details or card details.
To stop Google Analytics, block cookies and scripts for this site in your browser, use a content blocker, or install Google’s Analytics opt-out browser add-on.
What PostHog collects
Page views and departures, page categories (such as home, pricing and reports), browser/device families, coarse referral sources, report requests, request failures and the status of reports you open. Random identifiers in this tab’s session storage group visits across page reloads. Sessions expire after 30 minutes of inactivity or 24 hours. These SDK identifiers are not account IDs. Separately, native diagnostic logs for signed-in customers are linked to the account and, where ownership is verified, the report as described below.
Technical error reports
When enabled, browser errors, rejected promises and page-render failures are reported with an error category, generic page category, application release and locations in our public JavaScript files (file, line and column). These help us find broken interactions. Raw error messages, error causes, variable values, source-code snippets and form contents are excluded from our diagnostic payloads. Repeated errors are limited. Sending starts when analytics initializes; a page-render failure still on screen can be included at that point. Collection is best effort, so this is not a complete log of every failure.
Tracked report actions also include opening an organisation, saving a product selection, requesting a saved-product crawl and downloading a catalog CSV. Selection, crawl-request and export events include a bounded primary-product count; they exclude product identities and file contents. A download event means the browser received the export, not that you saved the file.
What PostHog excludes
Browser analytics events exclude report contents, researched domains, report IDs, product names, email addresses, credentials, original page URLs, query strings, referrer paths, form contents and session recordings. The separate account-support records and native logs described below include verified account and report identifiers. Page URLs sent to PostHog use generic categories, for example /reports/report; error stack locations refer only to our public compiled JavaScript assets. Shared-report and authorization pages are excluded from PostHog. PostHog country/IP enrichment is disabled. These exclusions do not apply to Google Analytics.
Provider and choices
The hosted service uses PostHog in the United States. PostHog necessarily receives your network IP address to deliver the request; IP enrichment is disabled. We store temporary analytics identifiers in this tab’s session storage and a local SDK on/off marker used by the application. This marker is not a record of customer consent. Earlier in-site analytics choices are retired by this change; we do not record that you clicked an agreement. Do Not Track or Global Privacy Control disables PostHog collection. Browser content blockers can also prevent delivery. Stopping collection does not delete events already received.
Self-hosted installations do not send PostHog analytics to our project. The Google tag is part of the shared page layout, so installations built from this code load it unless it is removed. Product functionality does not depend on analytics. Counts represent delivered, instrumented browser actions, not an exhaustive ledger of reports or payments.
Comparison feedback
Ratings and optional private notes you submit are saved with your account and the specific saved comparison so our team can improve results. You can change a rating or click it again to remove it. Changing a dislike to a like or removing it also clears its current reason and note. Previous versions, including previous notes, remain in the audit history until the report is purged after its 90-day retention window. This works without browser analytics.
When hosted feedback analytics is enabled, new ratings and selected reasons are shared with PostHog by default using opaque feedback, comparison and report-revision identifiers. This connects the rating and selected reason to operational quality metrics, not to your browser analytics identity. Private notes, product names, source links, emails and account IDs are excluded. There is no separate permission checkbox in the report. Previously unshared submissions are not automatically backfilled. Do Not Track and Global Privacy Control prevent new feedback analytics sharing. Self-hosted installations do not send feedback to our PostHog project.
Hosted account support and research usage
Separately from default browser analytics, our hosted service uses PostHog for account support and research operations. Authorized staff can see your account email, current plan and subscription status, report allowance and usage, and links to your reports. A stable account identifier connects these records to research timing, failures, AI token usage, Firecrawl and Context credits and estimated provider costs. Report-time plans are kept separate from current account access. Complimentary access does not mean a paid subscription.
Email is maintained in the account profile, not sent to research providers as analytics metadata. We do not export passwords, credentials, payment-card details or raw authentication records. Native logs record instrumented browser actions and backend work with a stable pseudonymous account identifier and, when verified, a report identifier. Authorized staff can open customer and report logs from the support dashboard. The server verifies browser account sessions and report ownership for each log request; it does not merge the separate anonymous SDK sessions. Logs are best effort, and older anonymous logs cannot be assigned to a customer retrospectively. Self-hosted and test installations do not export customer profiles to our production project. Historical or standalone CLI runs without verified ownership remain unattributed. Unknown costs are not zero; estimates are not provider invoices. Account-deletion requests include removal of the associated PostHog profile and related operational records through our support process.
If you change or remove a previously shared rating without sharing its replacement, we send only a removal marker so it no longer counts as an active analytics rating. The marker contains no replacement rating, reason or note. Earlier raw analytics events remain subject to PostHog retention.
Operational configuration diagnostics
Separately from browser analytics, the hosted service may send configuration-health signals to PostHog, such as a missing required price-watch email provider. These contain a fixed error category, release, environment and aggregate pending-email count, without customer identities, recipients, report data or browser session identifiers. Duplicate signals are limited. Self-hosted installations do not send these diagnostics to our project.