Privacy Policy

DRAFT for Brent's review (Nov 2, 2026). Business privacy policy for therasaas.com, written for the consent v2.2.1 round. It replaces the 2023 website policy on this preview branch only. Items in [brackets] need a decision before this goes live.

Effective date: [DRAFT: set on the day this version goes live]
Last updated: [DRAFT: set on the day this version goes live]

This policy explains what information TheraSaaS LLC ("TheraSaaS," "we," "us") collects through this website, therasaas.com, how we use it, who we share it with, and the choices you have.

TheraSaaS makes a client-intake CRM for therapists and mental-health private practices. This website is for practice owners and staff learning about our product. It is not a place to share client or health information.

This policy covers our website only. Information our customers put into the TheraSaaS product (their own leads, clients and messages) is handled under our Terms of Use and, where it applies, our Business Associate Agreement, not this policy.

The short version

• Optional cookies stay off until you say yes. You can change your mind any time in Cookie preferences.
• We may run advertising, such as Google Ads, but we don't do remarketing, and we don't share your data with third-party advertisers or remarketing tools. [DRAFT: true only after Google Ads remarketing and audiences are turned off. Today the Google Ads tag in our tag manager sends remarketing calls. Brent: turn them off, or change this statement.]
• We don't sell or share your personal information.
• You can unsubscribe from our emails and texts at any time.
• You can ask to see, fix or delete your information. Email brent [at] therasaas.com.

Information we collect

Information you give us

When you book a demo, fill out a form (for example, a free guide, the affiliate sign-up or a website build request), email or call us, or sign up for our emails, we may collect:

• Your name, email address and phone number
• Your practice name, your role and details about your practice you choose to share, such as its size or the tools you use now
• The date and time you pick for a demo, and anything you write in a message box

Please don't include information about your clients or anyone's health in a form or message. We don't need it to answer you.

Our demo calendar and forms

Our demo booking calendar and our forms run on our own product, TheraSaaS, which is built on technology from LeadConnector (HighLevel).

• They load only when you choose. At first you see a short note and a button in place of each calendar or form. Nothing loads from TheraSaaS or LeadConnector until you turn on Functional cookies (or press "Accept all"), or click the button. One click turns on all our calendars and forms, and we remember it in your browser. You can turn it off in Cookie preferences.
• What they collect: the details you type in, plus the date and time, the page you were on, and basic technical details like your IP address and browser.
• What else loads with them: fonts from Google Fonts and files from Google Cloud Storage, so Google receives your IP address and browser details, and a Cloudflare security check that may set a cookie named __cf_bm (about 30 minutes).
• Campaign details. If you allow Advertising cookies and arrived from one of our campaigns, we save the campaign name, source and medium (the utm_ parts of the link) in your browser and add them to your demo booking, so we know which campaign brought you.

Information collected automatically

Our site and the tools it uses can collect some details automatically, such as your IP address and rough location, your browser and device type, the pages you visit and the page you came from, and, if you allow Analytics or Advertising cookies, a random ID stored in a cookie.

How we use your information

We use your information to:

• Hold the demo you booked and send you confirmations and reminders
• Reply to your questions and send the guide or resource you asked for
• Send you our emails or text messages about TheraSaaS, if you agreed
• Understand how people use our website so we can improve it (only if you allow Analytics cookies)
• Measure which of our ads bring demo bookings (only if you allow Advertising cookies)
• Keep our website safe and working, and follow the law

Email and text messages

• Emails. If you book a demo, download a resource or sign up, we may send you emails about TheraSaaS. Every marketing email has an unsubscribe link. Click it any time and we will stop.
• Text messages. When you book a demo you agree to get texts about that booking. We send marketing texts only if you agree. Message and data rates may apply. Reply STOP to any text to stop, or HELP for help. Agreeing to texts is never a condition of buying anything.
• Even after you unsubscribe, we may still send messages you need, such as a reply to your question or a note about your account.

Advertising and remarketing

We may run advertising, such as Google Ads, but we don't do remarketing, and we don't share your data with third-party advertisers or remarketing tools. [DRAFT: see the note in "The short version".]

The Google Ads tag only measures which of our ads bring visitors and demo bookings. It loads only if you allow Advertising cookies (or press "Accept all"). It never loads if you choose "Reject all" or your browser sends a Global Privacy Control signal.

By "remarketing tools," we mean code that follows your visit so ads can be shown to you later on other websites and apps. We don't use any of these, for example Google Ads remarketing (audience) tags, the Meta (Facebook and Instagram) Pixel, the TikTok Pixel, the Microsoft (Bing) UET tag, the LinkedIn Insight Tag, or Google Analytics advertising features such as Google Signals or ads personalization.

If this ever changes, we will update this policy first.

Cookies and similar tools

Cookies are small files a website saves in your browser. Similar tools include pixels, tags, scripts and local storage. You choose which ones to allow.

Category	What it does	Default
Necessary	Makes the site work and remembers your cookie choices.	Always on
Functional	Loads our demo calendar, forms and videos from outside services.	Off until you say yes. Clicking a calendar or form turns on all of them; pressing play turns on our videos.
Analytics	Helps us count visits and see which pages are useful.	Off until you say yes
Advertising	Lets Google Ads measure which ads bring demo bookings.	Off until you say yes

When you first visit, a small box asks what you want to allow. "Reject all" is just as easy as "Accept all." To choose category by category, open "Review options." You can change your choices any time with the Cookie preferences link in the footer of every page.

We use Google Consent Mode, so Google tools on our site are told your choice. If you have not allowed Analytics or Advertising, Google Tag Manager does not load at all.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as "Reject all" for Analytics and Advertising, even if you pressed "Accept all" before. You can still turn on our calendar, forms and videos yourself. Learn more at globalprivacycontrol.org.

You can also block or delete cookies in your browser settings.

The tools we use

These are the outside services our website uses. Each has its own privacy policy.

Necessary

• Website hosting (Netlify) and network security (Cloudflare). They deliver the site and protect it from attacks, and they handle your IP address and basic request details. Cloudflare may set a security cookie to block bots.
• Your cookie choices. Saved in your browser (local storage key cookie_consent).

Functional

• TheraSaaS / LeadConnector demo calendar and forms. See "Our demo calendar and forms" above.
• Videos. Our YouTube videos play in YouTube's privacy-enhanced mode (youtube-nocookie.com) and our Vimeo videos with Vimeo's "do not track" setting. Neither loads until you press play. [DRAFT: a Loom video on the website-build pages and a Tenor GIF on the tech-call thank-you page still load without a click. Gate them or list them here.]
• [DRAFT: ProofyBubble. A video bubble widget. It loads from our tag manager today, after "Accept all". Brent: keep or drop; if kept, it should wait for a Functional yes.]

Analytics

• Google Tag Manager and Google Analytics 4 (Google). Google Tag Manager loads our tags only after you allow Analytics or Advertising cookies. Google Analytics counts visits and shows which pages are used. It sets cookies named _ga and _ga_<ID> that keep a random ID for up to 2 years. We keep Google Signals and ads personalization turned off. Google Analytics keeps visit data for up to 14 months. Google's privacy policy.
• [DRAFT: Ahrefs Web Analytics. A visit counter from Ahrefs. Brent: keep or drop; if kept, it should wait for an Analytics yes.]

Advertising

• Google Ads conversion tracking (Google). Measures which of our ads lead to demo bookings. It may set cookies such as _gcl_au (about 90 days) and Google's IDE cookie on doubleclick.net. Only with an Advertising yes.
• [DRAFT: LeadConnector attribution script (am.js) and an IP lookup (api.ipify.org). Today these load from our tag manager after "Accept all" to record which page or campaign a lead came from. Brent: keep or drop; if kept, they should wait for an Advertising yes.]

Other sites

Our site links to other websites, such as our app, Capterra, our social media pages and partner sites. The Capterra badge on our site is a copy we host ourselves, so Capterra gets nothing until you click it. We are not responsible for other sites' content or privacy practices.

Who we share information with

We don't sell or share your personal information. "Share" means giving your information to other companies so they can show you targeted ads on other websites and apps. We don't do that.

We give information to others only in these cases:

• Service providers that help us run the website and our business, like our web host, LeadConnector, our email and text-message tools, and Google Analytics and Google Ads (if you allow them). They may use the information only to provide their service to us.
• When the law requires it, such as a valid court order, or to protect our rights and the safety of others.
• If our business changes hands, as part of that change, with this policy's protections kept in place.
• With your permission, for any other reason.

How long we keep information

• Demo bookings, contact details and messages: while you are on our contact list or a customer, and for a reasonable time after, unless you ask us to delete them.
• Unsubscribe requests: we keep a record so we don't email or text you again.
• Google Analytics data: up to 14 months.
• Privacy requests: about 24 months, so we can show we handled them.

How we protect information

We use reasonable safeguards, including encryption (HTTPS) on this site, and we choose service providers that protect data. No website or email system is 100% secure.

Your choices and rights

No matter where you live, you can:

• Change your cookie choices any time in Cookie preferences.
• Unsubscribe from emails (use the link in any email) or texts (reply STOP).
• Ask what information we have about you, ask us to fix it, or ask us to delete it. We may need to keep some of it if the law requires it.

How to make a request: email brent [at] therasaas.com or call (630) 593-7759. Please say "Privacy request" and tell us what you would like us to do. We'll confirm we got your request within 10 days and respond within 45 days. If we need more time, we will tell you why. We may ask you to confirm who you are, and we will not treat you differently for using your privacy rights.

California residents

[DRAFT: keep this section only if TheraSaaS meets a California (CCPA) threshold. The footer's "Do Not Sell or Share My Personal Information" link points here, so if this section goes, that link should go too.]

If you live in California, you can ask what personal information we collected about you in the last 12 months, ask us to correct or delete it, and opt out of its sale or sharing. We don't sell or share personal information, and we treat a Global Privacy Control signal as an opt-out. To make a request, use the contact details above. You may use an authorized agent.

Visitors outside the United States

Our website and service providers are based in the United States. If you visit from another country, your information will be handled in the United States.

Children

This website is for businesses and is not meant for children. We do not knowingly collect personal information from children under 13. If you think a child sent us information, please contact us and we will delete it.

Changes to this policy

We may update this policy when our website or the law changes. We will post the new version here and change the "Last updated" date. If we make a big change, such as adding remarketing, we will update this policy first.

Contact us

TheraSaaS LLC
201 East Ogden Avenue, Hinsdale, IL 60521
Email: brent [at] therasaas.com
Phone: (630) 593-7759

Related pages: Terms of Use · Cookie preferences