Privacy notice

What we collect

Only what follows.

The free assessment. The domain you type. If you choose to enter an email address to receive the full report, that address and — if you give it — your business name. These are stored in our database so we can produce the report and follow up on it.

The Wolfpack Bet application. Your business name, domain, name, email address, and the seven partner-fit answers you submit. We store the answers, provisional score, route, and consent version so a person can verify the application. The score is not an approval or an automated decision.

The contact form. Your name, email address, message, and the arrival information described below. These are emailed to us and are not stored as a contact-form record in our database.

How you arrived. If you reach this site from an ad or a tagged link, we keep the tracking parameters for the length of your visit and attach them to anything you submit: the advertising click identifiers Google, Meta and Microsoft add to a link (gclid, gbraid, wbraid, fbclid, msclkid), the standard campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the site that referred you, and the first page you landed on. Arrive without any of those and nothing is recorded.

Site interactions. We record a short allowlist of actions such as starting or completing an assessment, opening contact or pricing, successfully delivering a form, and beginning checkout. The record includes the page path without its query string, the action result, and campaign source, medium, and name when available. It does not include names, email addresses, messages, full referring URLs, or advertising click identifiers.

Abuse protection. When you submit an assessment, contact message, or Wolfpack Bet application, we turn the network address supplied by our host into a salted one-way hash and store that hash in a short-lived rate-limit record; assessment and application attempts also include the submitted domain. We do not store the address itself. These records are automatically pruned after roughly 48 hours.

How we use it

A submitted domain is used to prepare the assessment you asked for. Wolfpack Bet answers are used to route a human diligence review. Contact details are used to reply to you and, if you become a client, to run the work. We record what happened with each enquiry — whether it became a job and what it was worth — because that is how we judge whether our own advertising is working.

We do not sell or rent personal information, and we do not add you to marketing lists you did not ask for.

What we send back to Google

This is the part most privacy notices leave out, so it gets its own heading.

When an enquiry that arrived from a Google ad becomes actual paid work, we upload that fact to Google Ads: the click identifier from your original visit, the date, and the value of the job. That is how an ad platform learns which clicks turn into real customers rather than merely counting form submissions — the same closed loop we build for our clients.

Your name, your email address and your message are never part of that upload. It happens only for work that was actually won, and only when the visit carried a Google click identifier to begin with.

Cookies and tracking

This site sets no cookies at all. The arrival information described above and the domain currently typed into the assessment form are held in your browser’s session storage. The browser discards that storage when you close the tab, and only this site can read it.

There is no Google Analytics, no advertising pixel, no tag manager and no third-party tracking script anywhere on this site. Nothing here follows you to other websites.

The limited interaction events described above are sent only to this site’s own endpoint and stored in our database. They are used to find broken conversion paths and understand aggregate demand, not to build a cross-site profile.

Who else touches it

The companies that run the plumbing, each seeing only what it needs: Vercel hosts the site, Supabase stores the database, Resend delivers our email, and Stripe processes care-plan payments — we never see or store your card details. Google Ads receives only what is described above.

If we contacted you first

We sometimes assess a business’s website before approaching them. That assessment is one ordinary request for the public homepage — the same thing any visitor’s browser does, under a user agent that identifies us — and it reads only what the page already serves to everyone. We do not crawl past the homepage and we do not attempt anything private.

What we keep in that case is the domain, the result of that check, and any contact details a person here typed in by hand. We do not scrape contact information. If we approached you and you would rather we held nothing, say so and we will delete the record.

How long we keep it, and how to get rid of it

We keep enquiry and application records for as long as they are relevant to the conversation or the work, and client records for as long as we need them to run and account for that work. Short-lived rate-limit identifiers are removed after roughly 48 hours, and first-party interaction events are removed after roughly 13 months. We have not published a fixed expiry date for business records, because claiming a retention schedule we do not actually enforce would be worse than saying this plainly.

Ask and we will tell you exactly what we hold about you, or delete it. One email is enough — no form, no account.

Questions

Email hello@wolfpackfrontdesigns.com or call (516) 640-1474.