Privacy Policy

Aileron Shift LLC · Last updated October 19, 2026

Who We Are and What This Policy Covers

This Privacy Policy explains how Aileron Shift LLC, a California limited liability company, 636 Cypress Avenue, Hermosa Beach, CA 90254 ("Aileron Shift," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you visit aileronshift.com and its subdomains, including our free website scanner at scan.aileronshift.com (together, the "Site"), contact us, create an account, or buy our services.

This Policy is our notice at collection and our privacy policy under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), and the California Online Privacy Protection Act ("CalOPPA"). It describes our practices for the preceding 12 months and going forward.

When we host or maintain a website, application, or other property for a client, we process the personal information of that client's visitors on the client's behalf, as the client's service provider, under our Hosting Terms of Service. The client's own privacy policy governs that information, and requests about it should go to the client.

1. Personal Information We Collect

1.1 Information you give us. We collect what you choose to send us, including:

Contact details you enter in our contact form: your name, email address, phone number, answers to the questions on the form, and your message.
Account and order details when you buy a hosting plan or other service: your name, billing address, email address, phone number, any order notes, the plans you buy, your subscription and renewal history, and your account login.
Payment details you enter at checkout. Card and wallet payments are processed directly by our payment processor. We receive a payment token, the card brand, the last four digits, and the expiration date, but we never receive or store full card numbers.
Onboarding details you give us to launch or move a site, such as domain names, registrar and hosting account details, account credentials you choose to share, launch dates, and project notes.
Website scanner details: the website address you submit and, if you choose to unlock your full report, your email address.
Correspondence: the content of emails, support requests, and other messages you send us.

1.2 Information collected automatically. When you use the Site, we and our providers collect:

Device and log data, such as IP address, browser type and version, operating system, referring page, pages viewed, and the date and time of each request. Our hosting infrastructure records this in server logs to deliver and secure the Site.
Analytics data, if you have not opted out: pages viewed, time on page, approximate location derived from your IP address (city level), device type, and how you reached the Site. We collect this with Google Analytics, which sets cookies and similar identifiers in your browser.
Cookies and local storage needed to run the Site, such as cart, checkout, and login cookies, and a record of your privacy choice. See Section 5.

1.3 Information from others. We receive transaction and fraud-screening results from our payment processor, and we may receive your contact details from a client or partner who refers you to us.

1.4 Sensitive personal information. The only sensitive personal information we collect is account login credentials that you choose to give us (for example, a registrar or hosting login during onboarding) and the login for your Aileron Shift account. We use them only to provide the services you request and to keep your account secure, and we do not use or disclose sensitive personal information to infer characteristics about you.

2. How We Use Personal Information

2.1 Purposes. We use personal information to:

respond to your inquiries and send you the information or proposals you ask for;
set up, provide, maintain, and support the services you buy, including hosting, onboarding, migrations, and our client console;
process payments, subscriptions, renewals, refunds, and renewal reminders;
run the website scanner and deliver your report;
send transactional and service messages, such as order confirmations, invoices, maintenance notices, and security alerts;
send you news about our services if you are a client or have asked to hear from us; every marketing email includes an unsubscribe link;
understand how visitors use the Site so we can improve it, if you have not opted out of analytics;
detect, prevent, and respond to fraud, abuse, security incidents, and illegal activity;
comply with law, enforce our agreements, and establish or defend legal claims; and
carry out any other purpose we describe to you when we collect the information, with your consent where required.

2.2 No automated decisions. We do not use personal information to make decisions that produce legal or similarly significant effects about you based solely on automated processing.

3. How We Disclose Personal Information

3.1 Service providers. We disclose personal information to companies that process it on our behalf under contracts that limit their use of it to providing services to us, including:

payment processing: WooPayments, powered by Stripe, which also handles Apple Pay, Google Pay, and Affirm;
email delivery: SendGrid, which sends our transactional and service emails;
hosting and infrastructure: the data center, cloud, content delivery, and security providers that host the Site and our clients' sites;
analytics: Google Analytics; and
professional advisors, such as accountants, auditors, and lawyers.

3.2 Legal and safety reasons. We disclose personal information when we believe in good faith that the law, a subpoena, a court order, or another legal process requires it, or when it is needed to protect the rights, property, or safety of Aileron Shift, our clients, or others, including to investigate fraud or abuse.

3.3 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

3.4 With your direction. We disclose personal information to others when you direct us to, such as a registrar or developer you ask us to work with.

3.5 No sale. We do not sell personal information, and we have not sold it in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.

3.6 Analytics and "sharing." Google Analytics collects information through cookies on the Site. To the extent that this is "sharing" for cross-context behavioral advertising under the CCPA, you can opt out at any time as described in Section 5, and we automatically treat a Global Privacy Control signal as an opt-out. We do not use any other advertising or tracking pixels on the Site.

4. Categories of Personal Information

4.1 Notice at collection. The table below lists the categories of personal information we collect, as defined in the CCPA, where they come from, why we collect them, and the categories of recipients we disclose them to for a business purpose.

Category	Examples	Sources	Purposes	Disclosed to
Identifiers	Name, email address, phone number, postal address, IP address, account name	You; your device; payment processor	Inquiries, services, payments, communications, security, analytics	Payment processor, email delivery, hosting providers, analytics provider
Customer records (Cal. Civ. Code § 1798.80)	Billing address, phone number, payment card brand and last four digits	You; payment processor	Payments, subscriptions, invoicing	Payment processor, professional advisors
Commercial information	Plans purchased, subscription and renewal history, order notes	You; our records	Services, billing, support, legal compliance	Payment processor, professional advisors
Internet and network activity	Pages viewed, referring page, browser and device data, scanner submissions	Your device; you	Site operation, security, analytics, scanner reports	Hosting providers, analytics provider
Approximate geolocation	City and region derived from IP address	Your device	Analytics, security	Analytics provider, hosting providers
Professional information	Company name, role, project details	You	Proposals, services, support	Hosting providers, professional advisors
Sensitive personal information	Account login credentials you give us	You	Providing the services you request, account security	Hosting providers, only as needed to perform the services

4.2 Retention. We keep each category of personal information only as long as reasonably necessary for the purposes above, using these criteria:

Inquiries: as long as needed to respond and to keep a record of our business relationship.
Account, order, and payment records: for as long as your account is active, and afterward as long as tax, accounting, and other legal obligations require.
Onboarding credentials: until the work they were given for is complete, or sooner if you revoke them. We encourage you to change any password once that work is done.
Scanner submissions: as long as needed to deliver your report and any follow-up you request.
Analytics data: no longer than 14 months, under the retention settings of our Google Analytics property.
Server logs: for the limited period our hosting infrastructure retains them for security and troubleshooting.

We may keep information longer when the law requires it or to resolve disputes and enforce our agreements.

5. Cookies, Analytics, and Your Privacy Choices

5.1 Cookies we use. The Site uses cookies and browser storage that are needed to run it (for example, to keep items in your cart, keep you signed in, and remember your privacy choice) and, unless you opt out, Google Analytics cookies to measure how the Site is used.

5.2 Privacy choices banner. When you first visit, a "Your privacy choices" banner lets you accept analytics or select Decline / Do Not Sell or Share. You can change your choice at any time with the Your Privacy Choices button shown on every page. If you decline, Google Analytics runs in a restricted mode that does not set analytics cookies.

5.3 Global Privacy Control. If your browser sends a Global Privacy Control ("GPC") signal, we treat it as a valid request to opt out of the sale or sharing of your personal information for that browser, and we turn off analytics cookies unless you choose otherwise.

5.4 Do Not Track. Browsers' older "Do Not Track" setting has no common standard, so we do not respond to it separately. We do honor GPC as described above.

5.5 Browser controls. You can also block or delete cookies in your browser settings. If you block cookies needed to run the Site, checkout and sign-in may not work.

5.6 Marketing email. You can unsubscribe from any marketing email we send with the link in the message. We will still send transactional and service messages about your account.

6. Your California Privacy Rights

6.1 Your rights. If you are a California resident, you have the right to:

Know and access: ask what personal information we have collected about you, its sources, why we collected it, the categories of recipients, and the specific pieces of personal information we hold;
Delete: ask us to delete personal information we collected from you, subject to legal exceptions;
Correct: ask us to correct inaccurate personal information;
Opt out of sale or sharing: direct us not to sell or share your personal information. We do not sell, and you can opt out of analytics sharing as described in Section 5;
Limit the use of sensitive personal information: we use sensitive personal information only for the purposes the CCPA permits without offering this right, as described in Section 1.4; and
Non-discrimination: exercise any of these rights without being denied services, charged a different price, or given a different quality of service.

6.2 How to make a request. Email hello@aileronshift.com with the subject line "California Privacy Request," or use our contact form. Tell us which right you are exercising and give the name and email address you used with us.

6.3 Verification. To protect your information, we will verify your identity before acting on a request to know, delete, or correct, usually by matching information you give us with information we already have and by confirming through the email address on file. We do not need to verify opt-out requests. We will use information you give us for verification only to verify your request.

6.4 Authorized agents. You may use an authorized agent to make a request for you. We may ask the agent for written permission signed by you and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney under California Probate Code §§ 4121 to 4130.

6.5 Our response. We will confirm receipt of a request to know, delete, or correct within 10 business days and respond within 45 calendar days. If we need more time, up to 45 more days, we will tell you why. Responses cover the 12 months before the request unless you ask for a longer period and it is possible. Requests are free, up to twice in any 12-month period for requests to know. If we deny a request, we will explain why.

6.6 Financial incentives. We do not offer financial incentives or price differences in exchange for personal information.

6.7 Shine the Light. Under California Civil Code § 1798.83, California residents may ask once a year which personal information we disclosed to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

6.8 Minors' content. We do not offer services that let minors post content publicly. If you are under 18 and believe you posted content on the Site, contact us and we will remove it.

7. Security

7.1 Safeguards. We use administrative, technical, and physical safeguards designed to protect personal information, including encrypted (HTTPS) connections across the Site, payment processing that keeps full card numbers off our systems, access controls limited to the people who need access, and continuous monitoring of our hosting infrastructure.

7.2 Your part. Use a strong, unique password for your account and keep it confidential. Tell us right away at hello@aileronshift.com if you believe your account has been accessed without your permission.

7.3 Incidents. If a security incident affects your personal information, we will notify you and the authorities as California Civil Code § 1798.82 and other applicable laws require.

8. Children

The Site and our services are offered to businesses and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has given us personal information, contact us and we will delete it.

9. Where We Process Information

We are based in the United States, and we and our service providers store and process personal information in the United States. If you use the Site from outside the United States, your information will be transferred to and processed in the United States.

10. Links to Other Sites

The Site links to websites and services we do not control, including client sites shown in our case studies. Their own privacy policies govern how they handle your information.

11. Changes to This Policy

We may update this Policy from time to time. We will post the updated version on this page with a new "Last updated" date, and if we make material changes that affect how we use personal information we have already collected, we will notify you by email or with a notice on the Site before the change takes effect.

12. Contact Us

Questions or requests about this Policy or our privacy practices can go to:

Aileron Shift LLC, 636 Cypress Avenue, Hermosa Beach, CA 90254 · hello@aileronshift.com

If you have a disability and need this Policy in another format, email us and we will provide it.