To answer your first question, we don't actively capture username/passwords. However, in order to follow a user into an authenticated site, we have to either setup some type of proxy (which requires some work on the client's side), or we do some simple cookie capturing (which requires no work on the client's side) to see what the user sees. Obviously, cookies might contain sensitive information, which is why we're offering this as an optional premium service only.

As for your second question, we can certainly setup the service such that it captures a certain percentage of users, and it's certainly a route we would consider depending on the size of the client.