Privacy Policy

Last updated November 10, 2026

The CX 500 is an independent index of customer service teams. This policy explains what personal information we collect through cx500.org, the reports we email, and our events; what we do with it; who else handles it; and the choices you have. "We", "us" and "our" mean The CX 500. "You" means anyone who visits the site, fills in one of our forms, or receives a report from us.

1. Information you give us

You can read the rankings, the methodology and the marketplace without telling us who you are. We collect personal information only when you send it to us:

Report requests. Your first and last name, work email, job title, and the organization you looked up.
Free inspections. Your name, work email, and the company website or LinkedIn profile URL you want inspected.
Get evaluated. Your name, work email, job title, company website, industry, and, if you choose, a phone number, notes, and the kinds of tools or providers you are looking for.
Marketplace listings. Your name, work email, the product's name and website, a category and a short description.
Events. If you stop by our table at an event and ask for a report or a printed copy, the details you give us there.
Messages. Anything you write to us by email.

If you don't give us these details, we can't prepare a report, evaluation or listing for you.

2. Reports we email you

Reports are emailed from a cx500.org address with a link that is unique to you. When you open that link, we record that it was opened, roughly how long the report was read, which pages were viewed, how far each was scrolled, where the pointer moved on the page and where you zoomed in (so we can replay how the report was read; never anything you type, and never a recording of your screen) and whether it was downloaded or printed, along with basic technical details such as the time, browser type and approximate location derived from your IP address. We use this to know a report arrived and was useful, and to decide whether and how to follow up. Because the link is personal to you, please don't forward it if you'd rather your reading not be counted as yours.

3. Information collected automatically

When you visit cx500.org we use Google Analytics to understand how the site is used: pages viewed, time on page, how far you scroll, which buttons you press, your browser and device type, your approximate location, and the website, campaign or ad that brought you here. We also record the organization names and website addresses typed into the site's search boxes, so we can see which organizations people look for, including ones we have not rated yet; anything that looks like an email address or phone number is dropped first. Apart from that, we never send what you type into a form to analytics; for the inspection form we record only whether the entry looked like a LinkedIn profile URL. We also use Microsoft Clarity to see how pages are used (clicks, scrolling and anonymous session replays, with what you type into form fields masked); it follows the same consent rules as the analytics cookies below. If we advertise, we may also use measurement tags from advertising platforms such as Google, LinkedIn or Meta to see whether those ads lead to visits or requests.

4. Cookies and similar storage

We use a small number of cookies and browser storage items:

Analytics cookies set by Google Analytics, to count visits and tell new visitors from returning ones.
A form cookie set by our form provider, so a request you send can be linked to your earlier visits to the site.
Your consent choice, kept in your browser so we don't ask again.
Campaign details (the campaign tags and ad-click identifiers in the address you arrived at), kept in your browser only, so a later request can tell us which campaign brought you.

Visitors in the European Economic Area, the United Kingdom and Switzerland are asked before any analytics or advertising cookies are set; until then only cookieless measurement is used. Anyone can block or delete cookies in their browser settings. The site still works without them.

5. How we use information

To prepare and deliver the reports, inspections, evaluations and listings you ask for.
To follow up with you about what you asked for, and from time to time about related CX 500 research or events.
If you opted in on the Get evaluated form, to introduce you to providers in the categories you chose.
To review marketplace listings before they are published.
To run, measure and improve the site and our reports, and to see which campaigns work.
To keep the site secure, prevent abuse, and meet legal obligations.

If you are in the EEA, the UK or Switzerland, we rely on these legal bases: performing the request you made (delivering a report or evaluation); your consent (analytics and advertising cookies, introductions to providers), which you can withdraw at any time; and our legitimate interests in running and improving the index and following up with people who contacted us, which we balance against your rights.

We do not sell personal information. We share it only as follows:

Service providers who run parts of the service for us and may use the information only to do so: our customer relationship and forms system (HubSpot), web analytics (Google), email delivery (Resend), website and report hosting (Render), and the messaging tool our team uses to see new requests.
Our sponsors. The CX 500 is supported by sponsors, and some of the people who run the index and follow up on requests also work for a sponsor. Requests and contact details may be handled by that team for the purposes in section 5. Sponsors have no say in how organizations are rated.
Providers you asked to hear from. Only if you ticked the box on the Get evaluated form: your name, work email and company, shared with providers in the categories you chose. They use it under their own privacy policies.
Legal and safety reasons, as described in section 17.
A change of ownership. If The CX 500 is reorganized, merged or sold, the information may pass to the new owner under this policy.

7. The rankings and public information

Organization ratings are built only from public evidence about organizations, such as public reviews, help-center content, app store listings and job postings. Ratings describe organizations, not individuals. Reports may name an organization's customer service leaders and link to their public professional profiles. If you are named and want to be removed or corrected, write to us and we will act on it. Scores outside a published Top 100 are never published; they are shared only with people who request their organization's report.

8. How long we keep it

We keep contact details and request records for as long as we are in touch with you about a report, evaluation or listing, and as long as we need them to meet legal obligations, resolve disputes and enforce our agreements. Then we delete them or make them anonymous. You can ask us to delete your details sooner (section 11). Analytics data is kept for the retention period set in Google Analytics and then deleted automatically. The moment-by-moment record of how an emailed report was read (pointer, scroll and zoom, used for replays) is deleted after 180 days; the totals per report and per page (opens, reading time, how far each page was scrolled) are kept with the request record.

9. Where it is stored

We are based in the United States, and our service providers store information in the United States and other countries. If you are outside the US, your information will be transferred to and processed in the US. Where data protection law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses. You can ask us about the safeguards that apply to your information.

10. Security

We use reasonable administrative, technical and physical safeguards, including encrypted connections, access limited to people who need it, and providers with recognized security programs. No method of sending or storing data over the internet is completely secure, so we can't guarantee absolute security.

11. Your rights

Depending on where you live, you may have the right to:

know what personal information we hold about you and get a copy, including in a portable format;
have it corrected or deleted;
restrict or object to how we use it, and object to direct marketing at any time without giving a reason;
withdraw consent you gave us, without affecting what we did before;
complain to your local data protection authority.

To use any of these rights, write to reports@cx500.org. There is no charge. We may need to confirm your identity first, and we answer within 30 days (or sooner where the law requires).

12. US state privacy rights

Residents of California and other US states with privacy laws may have the rights to know, access, correct and delete personal information, to opt out of its sale or of sharing for cross-context behavioral advertising, and not to be treated differently for using these rights. In the last 12 months we collected the categories described in sections 1 to 4 (identifiers and contact details, professional information, internet activity, and approximate location), for the purposes in section 5, and disclosed them to the recipients in section 6. We do not sell personal information, we do not knowingly collect sensitive personal information, and we do not use any information to make decisions about individuals with legal or similarly significant effects. You or an authorized agent can make a request at reports@cx500.org.

13. Emails from us

We send you a report or reply because you asked for it. We may also send occasional emails about CX 500 research and events. Every such email says who it is from and lets you unsubscribe, and we follow the US CAN-SPAM Act. To stop all emails from us, reply to one or write to reports@cx500.org.

14. Children

The CX 500 is a professional resource for people who work in and around customer service. It is not meant for children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.

15. Do Not Track

There is no common standard for how websites should respond to browser "Do Not Track" signals, so we don't respond to them. We don't track you across other companies' websites. You can control cookies as described in section 4.

16. Other websites

Our pages link to other websites, including the organizations we rate, the providers in our marketplace, CX communities and LinkedIn. We aren't responsible for their privacy practices; please read their policies.

17. Legal disclosure and breaches

We may disclose information if the law requires it, for example in response to a subpoena or court order, or when we believe in good faith that disclosure is needed to protect our rights or the safety of others, to investigate fraud, or to respond to a lawful government request. If a security breach affects your personal information, we will investigate it and notify you, and any authorities, as the law requires.

18. Changes to this policy

We may update this policy as the site and the law change. We'll change the date at the top, and for significant changes we'll post a notice on the site. We won't use personal information you gave us in a materially different way without your consent.

19. Contact us

For any privacy question or request, write to reports@cx500.org.
The CX 500, Chicago, Illinois, USA