Draft for review. This policy hasn't been reviewed by a lawyer and isn't legal advice. Details in [brackets] are still to be filled in.
Privacy policy
Last updated: [Date]
What Business Fit collects when you use it, why, who helps us run it, how long we keep it, and the choices you have.
In short
- We collect what you give us (your email if you sign in, your profile, your answers and the videos you check) and a little about how you use the app.
- Your profile, answers and the video's transcript go to our AI provider, Anthropic, to analyze the video and write your explanation. It doesn't train its models on them, and we never send it your name, email or IP address.
- Your scores are worked out by fixed rules from the facts in the video and your answers, not by the AI.
- No ads, no third-party analytics, and we never sell your information.
- Results you don't save are deleted after 30 days. You can remove saved results at any time, and ask us to delete your account.
- Questions or requests: shawn@parkdale.digital.
1. Who we are and how to reach us
Business Fit is run by Parkdale Digital (“we”, “us”), which is responsible for the personal information described in this policy. Our privacy officer, [Name and title of the privacy officer], is accountable for how we handle it.
- Email: shawn@parkdale.digital
- Mail: [Mailing address]
2. What we collect
Your account
If you sign in, your email address. Our sign-in provider, Supabase, also keeps a record of your sign-ins (when, and the IP address and browser used) and, if you sign in with Google, the name, email address and profile picture Google shares with it. The app itself uses only your email address.
Your profile
The details you choose to give us: your city, region and country, currency, startup budget, the hours you have and when, vehicle, storage space, how much debt you'd take on, your monthly income target and how soon you need it, things you own that a business could use, skills, things you'd rather avoid, how you feel about physical work and selling, whether you'd hire, your attitude to risk, and your goals.
Every field is optional. Some of them are about your finances, so share only what you're comfortable with. You can change or clear any field on your profile page.
Your answers and results
For each video you check: the questions we asked, your answers, a copy of the profile the result used, the scores, verdict and written explanation, whether you saved it to your library, and your answer to “Did this make your decision easier?” if you give one.
Videos you submit
The video's YouTube id and link, its title and channel name (from YouTube), and its transcript, which we get from our transcript provider. We keep the transcript for 30 days and then delete it. We keep the analysis of the business made from it, which isn't about you, so the next person who checks that video gets it quickly. We never show the transcript to anyone, and it goes to no one but our AI provider (see below).
Text you paste
If we can't get a video's transcript, you can paste one. We send the text to our AI provider to measure it, check that it's about a business and analyze it, but we don't store the text itself. The analysis made from it is kept privately for your result (no one else gets it), and our daily clean-up deletes it once no result uses it, usually within a day.
How you use the app
- A random id in a cookie (
bf_anon) that links your results and your free analyses to your browser (see section 9). - A salted hash of your IP address (of its network part, for an IPv6 address), so the free limits still apply if cookies are cleared, and so free analyses and requests are also counted per network, across everyone using it, signed in or not. Apart from Supabase's sign-in records (above), we don't store the address itself.
- A record of each analysis you request: which video, when, and whether it used one of your free analyses or failed.
- The steps you reach in the app (for example, getting questions or saving a result), linked to the browser id and to your account if you're signed in, never to your IP address. We look at these only as totals.
- Records of each request we make to our AI provider: what it was for, the model, its size, cost and duration, and whether it worked. They contain nothing from your profile, answers or transcripts.
- If you asked to be told when our Plus plan launches: the plan and currency you chose, and the exact consent wording you agreed to, which includes your email address.
- If you use test-mode billing: our Stripe customer id, test Checkout attempt and session identifiers, the plan, currency and billing interval you selected, and a server-synchronized subscription status, paid-period dates and cancellation setting. We keep verified webhook event identifiers and types to prevent duplicate processing. We don't store card details, raw webhook bodies or invoice contents.
Technical information
Like any website, our hosting provider receives your IP address, browser details and the addresses of the pages you open, including the video link in the address of the analysis page. It keeps short-lived server logs, which can include error details, including parts of the data a failed request was handling. We use the country your connection comes from to show prices in your currency, and we don't store it. Error reports we send to our error-monitoring service leave out cookies, request contents and your account details.
What we don't do
We don't show ads, use third-party analytics or advertising cookies, or sell or rent personal information. Plus Checkout is test-only and makes no real charge. Stripe, not Business Fit, handles any test payment details entered there; we don't store them.
3. Using Business Fit without an account
You can check videos without signing in. Your profile is then saved in your browser, but it's also sent to us with each analysis you run, and a copy is kept with that result, linked to the random id in your browser's cookie rather than to your name or email. If you later sign in from that browser, asking for the sign-in email there or using Google, those results move into your account. If you clear your cookies, we can no longer link those results to you, and they're deleted as set out in section 8.
4. Why we use it
- To analyze the video, and to tailor the questions, scores and explanation to you.
- To keep your profile and library, and let you compare results.
- To run the free plan: count analyses, apply the limits and prevent abuse.
- To run test-mode Checkout, synchronize subscription status, show billing state and prevent duplicate events.
- To keep costs under control, for example by sharing one analysis of a video between everyone who checks it.
- To understand, as totals, how people use the app, and to improve it, including from feedback answers.
- To find and fix errors.
- To send the sign-in links you ask for and, only if you asked for it, one email if Plus launches.
- To meet legal obligations and protect our rights and our users.
How your result is made. Our AI provider reads the video, picks out the facts about the business and writes your questions and explanation. Your scores and verdict are then worked out by fixed rules from those facts and your answers, not by the AI. The result is information for you to weigh; we don't use it to make decisions about you.
5. AI processing
We use Anthropic's Claude models to analyze videos and to write the questions and explanations. For that, Anthropic receives the transcript (or the text you pasted), the video's title and channel, your profile and answers, and the analysis and scores made from them. We don't send it your name, email address, cookies or IP address.
Under Anthropic's commercial terms, it doesn't use this data to train its models. It keeps it for a limited time ([up to 30 days]), or up to 2 years if its safety systems flag it, or longer where the law requires.
6. Service providers
We share personal information only with the providers that help us run Business Fit, and only what each one needs:
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | What it doesSign-in and our database | What it receivesYour email address, sign-in records (times, IP address and browser) and, with Google sign-in, your name and picture, plus everything we store (section 2) |
| [Supabase, or the email provider set up in Supabase] | What it doesDelivers sign-in emails | What it receivesYour email address and the sign-in link |
| Vercel | What it doesHosts the website | What it receivesYour IP address, browser details and the pages you open |
| Anthropic | What it doesAI analysis | What it receivesSee section 5 |
| youtube-transcript.io | What it doesVideo transcripts | What it receivesOnly the video's YouTube id, nothing about you |
| YouTube (Google) | What it doesVideo titles and thumbnails | What it receivesOur server asks for the title and channel with the video id only. Your browser loads the video's thumbnail from YouTube's image server, so Google sees your IP address and which thumbnail you loaded |
| What it doesSign in with Google, if you use it | What it receivesWhat you agree to share on Google's sign-in screen | |
| Sentry | What it doesError monitoring, when it's turned on | What it receivesDetails of server errors, without cookies, request contents or your account details |
| Stripe | What it doesTest-mode Checkout, subscription synchronization and Customer Portal | What it receivesYour email address, our account identifier for you, the test plan/currency you choose, and billing activity handled on Stripe; Stripe keeps the test payment details entered there |
We don't sell or rent personal information. We may disclose it when the law requires (for example, a valid court order), to protect someone's safety or our rights, or to a buyer or successor if the business is sold or merged, who must handle it as this policy says.
7. Where your information is processed
Our database is hosted in [the United States], and our providers process information mainly in the United States. If you live elsewhere, including in Canada, your information is processed outside your province or country, where the courts, law enforcement and national security authorities may be able to access it under local law.
8. How long we keep it
| Information | Kept for |
|---|---|
| Transcripts from our transcript provider | Kept for30 days, then deleted. The analysis of the business made from them is kept. |
| Results you don't save to your library | Kept for30 days |
| Saved results, your profile and your account | Kept forUntil you remove them or ask us to delete your account |
| Sign-in records kept by Supabase | Kept forAs long as your account exists, and as set by Supabase |
| Results saved without an account | Kept forAt most 13 months: by then your browser's cookie has expired, so they can't be opened |
| Our private analysis of text you pasted | Kept forDeleted by our daily clean-up once no result uses it, usually within a day |
| IP address hashes | Kept for60 days |
| Records of the analyses you requested | Kept for13 months |
| Records of the app steps you reached | Kept for13 months |
| Records of AI requests (no content) | Kept for24 months |
| Your Plus “Notify me” sign-up | Kept forUntil you stop it, or delete your account |
| Local billing customer, Checkout, subscription and verified webhook records | Kept forUntil account deletion is completed after separately authorized and verified provider cancellation/customer cleanup |
| Plus usage-pool markers | Kept forDeleted with the analysis-request records they belong to after 13 months |
| Server logs | Kept forA short period set by our hosting provider |
Deleted information can stay in our database provider's backups for a short time until they're replaced. We may keep information longer where the law requires it, or to deal with a dispute or abuse.
9. Cookies and browser storage
| Name | What it's for | How long |
|---|---|---|
bf_anon | What it's forA random id that links your results and free analyses to this browser, and lets us count app steps as totals | How long1 year, or until you sign out (unless results you made here without an account still need it) |
bf_signin | What it's forWhere to return after signing in and, for an email link, the address it was sent to | How long1 hour, or until you finish signing in |
sb-… | What it's forKeeps you signed in (set by Supabase) | How longUntil you sign out, and at most 400 days |
bf_merge | What it's forYour account's id, so the profile kept in this browser can move into the account you signed in to from it | How longUntil a page loads your account's profile after it has moved in (or finds your account already has its own), or you sign out, and at most 400 days |
bf_unaccepted | What it's forThe id of an account signed in to from an email link this browser didn't ask for: the browser stays signed out until you confirm the account is yours | How longUntil you confirm it, sign in again from this browser, or sign out, and at most 400 days |
businessfit.profile | What it's forYour profile while you're not signed in (browser storage) | How longUntil you sign in from this browser (asking for the sign-in email here, or with Google), when it moves to your account, or until you clear your browser's site data |
bf_step_… | What it's forStops one app step being counted twice (browser session storage) | How longUntil you close the tab |
We use these to make the app work and to count, as totals, how it's used. We don't use advertising or third-party analytics cookies. You can clear them in your browser at any time; that signs you out, and we can no longer link earlier results made without an account to you.
10. Security
We protect your information with safeguards suited to how sensitive it is, including:
- encryption in transit (HTTPS);
- a database that only our server can reach, with no public access to its tables;
- results that can be opened only from your account, or from the browser that made them;
- IP addresses in our own records stored only as hashes made with a secret salt;
- an internal usage report, open only to named accounts, that shows totals and no personal details.
No system is perfectly secure. If a breach of your information creates a real risk of significant harm to you, we'll tell you, and the authorities, as the law requires.
11. Your rights and choices
- See or get a copy of your information: email us.
- Correct it: edit your profile, or email us.
- Delete it: “Remove” in your library deletes that result straight away. You can clear any profile field, and stop Plus emails with “Stop notifying me” on your profile page. To delete your account and everything linked to it, email us.
- Withdraw consent: you can stop an optional use, such as the Plus email, at any time. Some uses are needed to run the service, so stopping them may mean you can't use it.
We reply to requests within 30 days. Before we act on one, we confirm it comes from you by sending a one-time code to your account's email address, which you send back to us. We send a copy of your information only to that address. If you used Business Fit without an account, first sign in from the same browser (asking for the sign-in email there, or with Google), so your results move into your account, then email us. Otherwise we can't tell which records are yours, and they're deleted as set out in section 8.
If you have a concern, please contact our privacy officer first. You can also complain to the privacy regulator where you live, such as the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your state's attorney general in the United States.
12. Children
Business Fit is for adults: you must be 18 or older to use it. We don't knowingly collect information from anyone younger, and we delete it if we learn we have. If you think a child has used Business Fit, please contact us.
13. Creators and other people in videos
We analyze public videos, which can name or describe their creators and other people. For each video we keep its title and channel name, the transcript for 30 days (see section 8), and our analysis of the business it describes, which can include the figures the creator stated, a summary of their claims, and the general location the video gives.
The analysis rates claims only on the information available in the video. It isn't a judgement of anyone's honesty. If you're a creator and want us to review an analysis of your video, contact us at shawn@parkdale.digital.
14. Changes and contact
We'll update this policy as Business Fit changes. The date at the top shows the current version, and we'll give notice on the site before a significant change takes effect. Our terms of use explain the rules for using Business Fit.
Questions or requests: shawn@parkdale.digital, or Parkdale Digital, [Mailing address].