Privacy notice

Draft pending founder and legal review. This notice describes real operating practice, but it has not yet been approved by a lawyer and must not be treated as final.

What we collect

When you send a diagnostic request we collect the company domain, your work email address, your name, your company and your role, the question you ask, and whether you opted in to occasional insights. We also record first-party attribution: the page you arrived from, any campaign parameters in the link, and a first-touch value in a cookie set by this site.

When you request one of our gated downloads, we collect the same details as a diagnostic request: the company domain, your work email address, your name, your company and your role, any question you add, and whether you opted in to occasional insights. We also record which download you asked for, and the same first-party attribution.

We use a keyed hash of your IP address for abuse control, to limit repeated requests, and we never store the address itself. The same hash is stored with each request we accept, diagnostic or download alike, and is kept with it for the same 24 months.

When a request passes our abuse checks, diagnostic or download alike, we try to read the public homepage of the company domain you give. If we can, we store its page title and description with the request for the same 24 months, and include them in the notification we receive.

When you book a call, we collect your name, your work email address and your company, the time you chose and your time zone, any buying question you add, and whether you opted in to occasional insights. We also record the same first-party attribution as a request, and store the same keyed hash of your IP address.

Your calendar invite and your booking confirmation carry a private link that cancels the booking. Anyone with the link can cancel it, so keep it to yourself.

When you subscribe to our newsletter, from a sign-up box or by ticking the box on a request or a booking, we collect your email address, where you signed up, the exact wording you agreed to, the version of this notice you were shown and a keyed hash of your IP address.

Nothing is sent until you confirm. We email you a link, and your subscription starts only when you use it. A link you do not use expires after seven days, and an unconfirmed sign-up is deleted 30 days after that. We are not sending newsletter issues yet; when we start, only confirmed subscribers will receive them.

When you request a gated download, the file downloads straight away and Resend emails you a private link to the same file. The link works for seven days and is tied to your request, not to your email address. Anyone with the link can use it until it expires, and it stops working if your request is deleted.

We set the first-touch cookie, ap_first_touch, only if you allow analytics, and only when you send a request or book a call. It holds the campaign details of that first request: the campaign tags in the link, the page you came from and the page you landed on, so that a later request can be tied to the campaign that first brought you to us. Without analytics consent we set no such cookie, and we still keep the campaign details sent with each request.

If you accept analytics, we also keep one small note in your browser's session storage, which is not a cookie. It records the first page you landed on after you chose, the site that sent you if there was one, and any campaign tags in the link you used. The note stays in that browser tab and is cleared when you close the tab or withdraw your choice. If you do not accept, we store nothing on your device. Either way, when you send a request, book a call or sign up to the newsletter, your browser sends us the page you are on, any campaign tags in its link and the site that sent you, so that we can see which page or campaign brought you to us; if you accepted, it also sends the note. We use these for nothing else.

How we use it

We use the request to reply to you and to prepare a diagnostic. If you opted in, we may send occasional insights, and you can opt out of those at any time. We do not sell your details.

We use a download request to release the file to you and to tell us who asked for it. We may follow up with you about the download, and if you ask us not to, we will not. If you opted in, we may also send occasional insights, and you can opt out of those at any time.

We use a booking to hold the time, send you the calendar invite and a confirmation, prepare for the call and let you cancel it. To prepare, we look up any earlier diagnostic requests, download requests and bookings made with the same email address. If you opted in, we may also send occasional insights, and you can opt out of those at any time.

Every newsletter email carries a one-click unsubscribe link, and your mail app can unsubscribe you directly. Unsubscribing takes effect at once.

If you accept analytics, we use Google Analytics 4 to count visits, the pages viewed and four actions: a diagnostic request, a gated download request, a booked call and a newsletter sign-up. We send Google the address of each page and of the page you came from, with everything removed except campaign tags, and we never send your name, email address, company or anything you type into a form. Google Analytics does not run on the sign-in pages, inside the signed-in app or on any page reached through a private link. Google also records the type of device and browser you use and your approximate location. Google acts as our processor under its data processing terms. We have turned off Google Signals and the setting that shares Analytics data with other Google products, and we do not use a User-ID. Google Analytics deletes visit-level data after 14 months; the summary counts in our reports are kept for longer. For visitors in the UK, the EU and Switzerland, Google uses your IP address only to work out an approximate location and does not store it. Google may process this data in other countries, including the United States, under the transfer safeguards in its data processing terms.

Who processes it

Supabase provides the managed database that stores the request. Resend delivers the notification to us and the acknowledgement to you. Cloudflare Turnstile provides abuse control and receives a challenge token, not your form answers.

When a download request arrives, Resend delivers a notification to us that names the download, the details you gave and the homepage title and description we read, and an acknowledgement of your download request to you.

Google hosts our booking calendar. The calendar event holds your name and email address as a guest, your company in its title, any buying question you add, your private cancel link and the Google Meet link, and Google sends you the invite and any cancellation. Resend delivers your booking confirmation to you, and a notification of the booking to us with the details you gave, your attribution and any earlier requests made with the same email address. Supabase stores the booking in the same managed database as a request.

Resend delivers the confirmation email and, when we start sending, any newsletter issue. Supabase stores your subscription and consent records in the same managed database as a request, and Cloudflare Turnstile checks the sign-up box for abuse.

We keep a copy of your diagnostic request, download request, booking or newsletter sign-up in our own CRM, a contact management system we run ourselves, so that we can follow up with you. Our own database stays the record, and the CRM holds a copy. The CRM is hosted in the EU, on servers we rent from Oracle Cloud Infrastructure in Amsterdam. Each request reaches it through Cloudflare, which carries the secure connection to the CRM and also stores its encrypted backups in the EU. Oracle and Cloudflare act as our processors under their data processing terms. Both are based in the United States; for any access from there we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or otherwise on the UK International Data Transfer Addendum to the EU standard contractual clauses.

For a diagnostic request or a gated download request, the CRM holds your work email address, your name and your company, any question you add, which download you asked for and the campaign details sent with the request. For a booked call, it holds your name, your work email address and your company, any buying question you add, the time you chose with your time zone, the Google Meet link and the campaign details sent with the booking, and we mark the call as cancelled if you cancel. It never holds your private cancel link. For the newsletter, it holds only your email address once you confirm, and a note when you unsubscribe. We never send the CRM your IP address, or the company domain and homepage details of a diagnostic request. Requests, bookings and sign-ups made under an earlier version of this notice are never added to the CRM.

The CRM is the one system in which we keep track of enquiries to each of the businesses run by the same owners, to follow up with you and to see which of our pages and campaigns led to your enquiry. It is shared with those other businesses, Forward Matter and Co-Signal, and each request shows which business it came from. If you have already contacted one of those businesses with the same email address, your Answer Position request is linked to the same contact record.

When you send a diagnostic request or book a call, we email the details, with a link to your record in the CRM, through Resend to our business mailbox and to the two founders' own Gmail mailboxes, provided by Google. A short alert with your name, and the page you wrote from or the time you booked, also goes to our private team chat on Discord. Download requests and newsletter sign-ups raise no team chat alert.

How long we keep it

We keep diagnostic requests and their attribution for 24 months from the date you submit them. After that they are purged by a scheduled job. Where we are required to keep something for longer for a legal reason, we will say so before we do it.

We keep download requests and their attribution for 24 months from the date you submit them, the same as diagnostic requests, and the same scheduled job purges them.

We keep a booking and its attribution for 24 months after the date of the call, and a scheduled job then deletes it. That job does not touch the calendar event: the event stays in our booking calendar until we remove it, and we remove it if you ask. Cancelling a booking deletes its calendar event.

We keep a record of each consent you give, confirm or withdraw: when, where, the wording you saw and the notice version. We keep it while you are subscribed and for 24 months after your most recent consent record, for example when you withdraw or when a sign-up you never confirmed lapses, so we can show what you agreed to, and a scheduled job then deletes it. We keep a withdrawn subscription for the same 24 months so that we do not email you again.

We delete our records from the CRM within one month of deleting our own: when our scheduled job deletes a request, a booking or a newsletter record at the end of its retention period, or when we act on a request to erase your details. If the same contact also holds an enquiry to another of the businesses that share the CRM, we delete only the Answer Position requests, bookings and sign-ups and leave the rest to that business. The CRM's encrypted backups are deleted after 90 days.

Business outreach

We may email people at businesses about our services. We use their work contact details, taken from the company's own website, from Companies House and from email finding and checking services, and our lawful basis for this is legitimate interests. If you reply saying no thanks, or email us at hello@answerposition.com to ask us to stop, we stop emailing you and we stop for all our businesses. We keep these details for 180 days after our last email to you, unless you reply.

Your rights

You can ask for a copy of everything we hold about your email address, or ask us to erase it, by writing to hello@answerposition.com. Erasure deletes your requests, downloads, bookings, subscription and consent records, and we keep only a one-way fingerprint of your address to show that the request was honoured. We cannot recall emails already delivered, and we remove a calendar event or processor records where we can.

Cookies and similar technologies

This site sets the cookies below. Necessary cookies are always on. Analytics cookies are set only if you accept them, and you can change your choice at any time with Cookie settings in the footer.

We ask before we set any analytics cookie, and Google Analytics does not load until you have chosen. Accept all and Reject all sit side by side and are equally easy to use, and nothing is switched on in advance. We keep your choice in the ap_consent cookie for six months and then ask again, and we also ask again if we add a new kind of cookie that needs your consent. Our two sites, answerposition.com and bdiscoverable.com, each ask separately. You can change your choice or withdraw your consent at any time with Cookie settings in the footer of every page of our public site. If you withdraw, Google Analytics stops on this site and we delete its cookies and the first-touch cookie from your browser. Withdrawing does not recall data already sent to Google.

This site no longer uses HubSpot's tracking code. If your browser still holds a HubSpot cookie from an earlier visit, we delete it.

Each time you make or change a cookie choice we keep a record of it: a random consent ID, the choices you made, whether you chose in the banner or in Cookie settings, the versions of the banner and of this notice you were shown, the time and which of our sites you were on. The record holds no name, email address or IP address, and the consent ID is not linked to any of them. We keep each record for 24 months so that we can show how consent was given, and a scheduled job then deletes it. Once you have made a choice, Cookie settings shows your consent ID; quote it to hello@answerposition.com if you want a copy of the record or want it erased.

This version

This notice is version 2026-11-03.1. We record that version with your consent, so we can show you exactly which notice you agreed to.