They Collect Data, You Collect Data
You've probably heard the line that if you're not paying for the product, you are the product, right? It gets repeated so often that it has started to sound like background noise, which is a shame, because for small businesses it's more practical than it sounds.
The tools that cost us nothing still have to pay their bills somehow, and for many of them the answer involves data: what we type, what we upload, how we use the app, and sometimes what our clients send us through it. Even paid tools often collect more than we'd guess, simply because the data is useful to them.
This post looks at that from both directions. First we'll look at what's being collected about you while you work, and then we'll turn around and look at what your own website and emails might be collecting about the people who visit them (this second part is the one I find most interesting, and the one I had to look at in my own business too).
What your tools collect, and what rides along
Most apps collect two kinds of information. The first is about how you use them: what you click, when you log in, which features you use, and what device you're on. The second is the content itself, meaning your emails, documents, form responses, and messages.
The first kind is mostly about you. The second kind is often about your clients, and that's where it gets more personal for client-facing businesses. An intake form built in a free form tool, a client note saved in a shared drive, or a text thread on your phone each sends client information through a company the client didn’t choose and probably never heard you mention.
For many small businesses, client information ends up scattered across several of these places at once. A form lives in one app, the follow-up conversation lives in your inbox, and your notes live in yet another tool. Every one of those places has its own terms, and your client is quietly subject to all of them.
Reading a privacy policy for what it allows
Privacy policies are written to be accurate rather than readable, so most of us skim them for reassurance. A more useful habit is to skim them for permission, looking for what the company is allowed to do rather than what it says it values.
A few phrases are worth slowing down for:
"Improve our services" can mean fixing bugs, and it can also mean using your content to build or train new features.
"Trusted partners" or "third parties" means your information may travel beyond the company you signed up with.
"Aggregated" or "de-identified" data is stripped of obvious names, though it's still built from what you and others put in.
"We may update this policy" means today's answer is the current answer, not a permanent one.
None of these phrases is automatically a red flag, and plenty of good companies use all of them. They simply mark the places where a promise is broader than it first sounds, and they tell you which settings are worth a look.
Now turn the camera around
Here's the part most privacy advice skips. If you have a website or an email list, you're very likely collecting data too, and often more than you realize.
Website analytics record which pages people visit, how long they stay, where they came from, and roughly where in the world they are.
Tracking pixels from social platforms and ad tools can report visits back to those platforms, sometimes even if you never ran an ad.
Embedded content like videos, maps, booking widgets, and some fonts can let the company behind them see that someone loaded your page.
Email platforms usually track who opens your emails and which links they click, and that's switched on by default in most of them.
All these features are useful for small businesses, and they likely came bundled with your website builder or email platform, and you've probably never been asked to think about it. It does, however, put you on both sides of the same question, though, because the visitors reading your site are trusting you in exactly the way you trust your tools.
Collecting honestly
For me, the goal isn't to collect nothing because knowing which blog posts help people, or which email links get clicked, is genuinely useful for a small business, and I use that information myself to decide what to write next.
What changes things is collecting on purpose and saying so plainly. In practice, that can mean asking whether you actually look at a piece of data before you keep collecting it, removing tracking that was added once and forgotten, and telling people what you collect in ordinary language rather than burying it in a policy page you hope no one ever reads.
You'll see that in this very course. The signup form says I count clicks in these emails so I know which topics help most, and that's true. It's a small sentence, but it lets you decide with your eyes open, which is all any of us is really asking from our own tools.
Your one move: two quick checks
This one has two parts, one for each side of the camera.
Find where your client information lives. Pick one recent client and trace their information through your business, from the first inquiry to the intake form, your notes, and your messages. Write down every tool it touched. If a client asked what you do with their information, this list is the beginning of your answer.
See what your own site collects. Open your website builder's settings and look for analytics, connected pixels, and third-party integrations. Then check your email platform's tracking settings. Keep what you actually use, and make a note of anything you'd forgotten was there.
You don't need a perfect system by the end of today. Just knowing where the information goes on both sides is enough for now.
Where we go from here
Data collection runs in every direction at once: your tools collect from you, your clients' information travels through those same tools, and your own website collects from the people who visit it. Seeing all three together is what makes the decisions feel fair, both to the people you trust and to the people trusting you.
The next post (Day 4 of the email course) looks at the newest layer in all of this, which is AI, including the AI features your existing tools may have switched on without much fanfare.
If you'd like a quick snapshot of where your own business stands, take the How Private Is Your Business? self-check, and join the free 5-day email course Your Private Business. And if you found a tracker on your site you'd completely forgotten about, you're in very good company... I'd love to hear what it was.
