Privacy, with less information collected.

Current launch status

The seller and proposed data controller is BF LLC, a California limited liability company, at 700 Larkspur Landing Cir, Suite 199, Larkspur, CA 94939, USA. Privacy questions can be sent to melih@before-further.com.

Live payment, contact intake and newsletter subscription stay closed until their production providers and operating controls are verified. This page describes the implemented data flow and proposed retention schedule; it is not a claim of completed legal review.

What each step uses

Browsing the resources does not require an account. Vercel receives ordinary hosting request data. No advertising pixels or third-party analytics are installed. Technical logs may include request metadata; the application does not deliberately log questionnaire bodies or payment details.

The fit check asks for the type of decision, countries, deadline range, approximate amount and currency, and required acknowledgements. It also asks whether you previously knew the founder to measure the founding-cohort test. The checkout uses those answers, an order reference and limited campaign tags. Do not place personal information in campaign tags.

Stripe collects payment information on its hosted checkout. The application stores the Stripe session identifier, payment status, currency, amount and the email supplied at checkout; it does not receive card numbers.

The paid questionnaire accepts a short, voluntary summary using aliases. Its body is encrypted by the application before database storage. It is not end-to-end encrypted: the designated operator with the encryption key can read it to deliver the review.

Newsletter signup requires a separate, unchecked consent box and email confirmation. It is not bundled with purchase. Contact messages are used to answer the request, not to subscribe the sender.

Providers and location

Hosting: Vercel. Payments, when enabled: Stripe. Professional mailbox and domain DNS: IONOS. Planned transactional/newsletter adapter: Resend. Database: Supabase, Paris region (eu-west-3), created on 5 October 2026. Test and live records use separate private schemas and dedicated server roles. Cross-border processing and applicable safeguards still require launch review. Provider configuration alone is not a completed compliance assessment.

Retention schedule to apply at live launch

Pending newsletter requests: delete after seven days if unconfirmed.
Confirmed newsletter records: retain while subscribed; allow immediate unsubscribe and deletion through the management link.
Questionnaire text: delete 30 days after delivery, unless a documented necessary retention exception applies.
Contact requests: delete after 90 days.
Security rate-limit buckets: delete after expiry; raw IPs are not stored in those buckets.
Payment/accounting records: retain for the period legally required for BF LLC and the applicable customer transaction. The exact schedule must be confirmed before launch. Deleting the questionnaire does not delete statutory financial records.

Scheduled deletion requires the maintenance endpoint to be connected and observed. The launch report distinguishes prepared code from a running schedule. A human operator reviews failures.

Your choices

The free checklist is ungated. No newsletter subscription starts without confirmation. The newsletter management page supports unsubscribe and deletion. The professional contact address handles access, correction, deletion and other applicable rights requests, with proportionate verification. Never send identity documents unsolicited.

Local browser storage

Only after optional measurement consent on the storage settings page, campaign tags are retained in session storage for the current browser tab. A dismissed reading panel is remembered for 30 days. An HTTP-only order cookie associates the paid intake with the checkout browser for up to seven days. No marketing tracking cookie is used.

Optional measurement

Off by default and separately gated on the server until launch readiness. With your opt-in, the site records page paths (without query strings), reading engagement, form-step events and short campaign labels. It does not record form contents, email addresses, raw IPs or a persistent visitor identifier in the measurement table. Hourly, salted security buckets limit abuse. Counts cover opted-in browsers only; they are not a census or proof of qualified buyers. Event retention: 90 days, subject to the maintenance job described above. Change or withdraw the browser preference on the storage settings page. No email-open pixel is used.

Information about other people

Do not submit intimate media, health data, financial credentials or full message exports. Paraphrase the minimum needed and remove identifiers. No client material is used in public examples without specific, separate permission. The published launch example is entirely fictional.

Questions

Contact BF LLC. Live collection remains closed until the relevant production controls are verified.