Privacy Policy

When you apply for the diagnostic, we collect:

• Your application answers — the business, offer, baseline numbers, marketing activity, costs, results and follow-up process you describe.
• Your name and email address — collected part-way through the application so we can send you a private link to continue, and so we can tell you the outcome.
• Business evidence you upload — ad platform exports, analytics reports, booking or CRM exports, payment summaries and similar records.
• Technical records — the status of your application, timestamps, and a log that an email was sent. We store a one-way hash of the recipient address in that log, not the address itself.

We do not collect payment card details. Payment is handled entirely by Fygaro, and card data never reaches us.

The diagnostic needs business totals, not personal records. Please remove personal information before uploading, and never send:

• medical records or patient information
• legal case files
• card numbers or banking details
• passwords or login credentials
• personal information about people who are not part of this review

We do not offer medical or legal claims review. If you send us something in this list, we will delete it.

The application saves your answers in your browser's local storage as you go, so you can leave and come back without losing work. Before you give us an email address, that browser copy is the only copy — nothing has reached our servers yet.

That local copy is cleared when you submit, and expires by itself after 30 days without activity. You can also clear it at any time through your browser settings.

• Supabase — hosts our database and the private storage bucket your uploads go into. Hosted in the United States (us-east-1).
• Netlify — hosts this website and the server functions your application is submitted through.
• Gmail — sends our transactional emails, such as your private resume link and your application outcome.
• Fygaro — takes payment if your application is approved. They handle card details under their own privacy policy.
• Calendly — used to book your call, and only shared with you after payment clears.
• Google Tag Manager and Google Analytics — only if you accept analytics. See below.

These providers process data in the United States and other countries. If you are applying from elsewhere, your information is transferred internationally as part of using this service.

The storage bucket is private. There is no public URL for anything you upload, and files are never attached to an email. When we need to review your evidence, we generate a link that expires within minutes.

Files are stored under randomised paths that cannot be guessed from your name, business or file name, and one application can never reach another application's files.

No system is perfectly secure, and we cannot guarantee absolute security — but we do not keep what we do not need, and we delete on the schedule below.

These periods are enforced automatically by our database:

After a completed call we keep the diagnostic finding for 24 months, and a minimal record that an application existed and what happened to it for 24 months. That minimal record does not include your answers or your uploads.

We use Google Analytics through Google Tag Manager, and it only loads if you accept it. Decline and no analytics scripts load at all.

We measure how far people get through the application — which step was completed, whether a file was attached, whether an application was submitted. We never send your answers, your name, your email address, your business name or anything about your uploaded files to analytics.

Our Google Analytics measurement ID is G-V51LGHE7HV, delivered through Google Tag Manager container GTM-P7QB86DW. Analytics data is retained for 14 months. You can change your choice at any time.

Change your analytics preference

You can ask us to:

• show you what we hold about you
• correct something that is wrong
• delete your application and uploads before the retention period ends

Email unlimiteddbm@gmail.com from the address you applied with and we will act on it. If you ask us to delete an application before your call, we cannot deliver the diagnostic without the evidence.

Part-way through the application we email you a private link so you can continue on another device or come back later. That email contains your name, the link and its expiry date. It never contains your answers, and it never has your uploaded files attached.

Treat that link like a password — anyone with it can see and change your application. It expires, and requesting a new one immediately invalidates the old one.

This service is for operating businesses and is not intended for anyone under 18. We do not knowingly collect information from children. If we learn that we have, we will delete it.

If we change how the system handles your information, we update this page and the date at the top. Material changes affecting applications already in progress will be emailed to the address on the application.

Questions about this policy or your information go to unlimiteddbm@gmail.com.