Privacy

2.What this website collects

An email address if you give one, and what the request itself carries.

• What you type. Your email address on the form, the answers to the optional questions after it about your ERP, your buying group, what you distribute, how you track rebates today, whether your supplier deals have levels or a flat rate and which of the two leaks costs you more, the numbers you put into the calculator, and whatever you write on the contact page. There is no phone field on either form.
• What arrives with the request. Your IP address, your browser user agent string, the page you landed on, and the page that sent you.
• Campaign parameters in the URL when there are any: utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid from Google Ads and msclkid from Microsoft Ads.

Two keys go into your browser’s local storage, and you can open the storage tab and read both of them. The one called nd_attribution holds those campaign parameters for 30 days, so that an ad click which turns into a signup a week later is not counted as somebody who arrived out of nowhere. The one called nd_internal_traffic is set only if you visit with internal=1 in the URL, which is how our own visits are kept out of the numbers.

Everything a form collects is written to the server log for the page before it is sent anywhere, so that a delivery failure at one of the two email providers cannot lose a message somebody took the trouble to write.

3.The measurement, named

Every tool by name, and exactly what each one gets.

PostHog

Product analytics and session recording, on its United States cloud. A session recording is a replay of clicks, scrolls and pointer movement on the page.

The masking, exactly

Email and password inputs are masked in those recordings. Sliders and dropdowns are not, because watching somebody drag the purchase slider is the most useful thing this site tells us.

Google Analytics 4 and Google Ads

Page views and conversions, so that a click we paid for can be tied to a signup.

Microsoft Advertising UET

The same for Bing, which a good part of this audience still uses. The tag loads from bat.bing.com.

All three read or set identifiers in your browser. This site shows no cookie banner today. Your browser has its own site data controls, which stop all three, and both advertising platforms carry an opt out of their own.

• Google Analytics opt outA browser add-on from Google that stops Analytics on every site.
• What Google does with data from sites that use its services
• Microsoft personalised advertising and how to opt out

4.What the product does with your files

Three files, the people you invite, and nobody else.

You send three kinds of file: your supplier agreements, your purchase export, and the statements your suppliers or your buying group send you. The product reads them and produces the findings, the claim packet, the claim ledger, the audit file and your accrual position.

Only the people you invite into your account can see any of it. Your files are encrypted in transit and at rest and held on servers in the United States.

People here read your agreements during the first pass, and afterwards when you ask us to look at something. The first pass is run that way on purpose, and it is the reason it takes days rather than minutes.

We do not sell your files, pool them with another customer, use them to train a model, or send them to your supplier or your buying group.

6.How long any of it is kept

Files while your account is open, plus the export window. Leads for two years.

Your product files stay while your account is open. After you cancel, export stays available for 30 days, and then we delete your files and the findings on them.

Deleting removes them from the live service. A copy that survives inside a backup goes when that backup does, and it is never restored into the product.

Form messages and waitlist leads sit in one inbox and in the request log behind the form. We delete a lead that went nowhere within 24 months.

The analytics and advertising platforms keep what they collect on their own schedules, which are set inside their products and described on the pages linked above.

8.Selling, sharing, and what those two words mean here

We sell nothing. Advertising is a different question and this is the honest answer.

We do not sell your files, your email address or anything else about you.

We do run Google and Microsoft advertising, and both platforms receive a signal when somebody signs up. Several state privacy laws treat that as sharing for advertising, so it is named here rather than argued about.

Turning it off is one setting in your browser or one opt out at each platform, both linked in the measurement section above, and neither one changes what the product does for you.

9.Email we send you

We write to the address you leave. Say stop and we stop.

The address you leave gets the answer to what you sent, the upload link when it is your turn, and a note when a slot opens. That is what it is for.

Say stop in one line and we stop writing.

11.If your data is exposed

You hear from us within 72 hours of us finding out.

If your files or your account details are exposed, we write to the account owner within 72 hours of finding out, with what we know at that point, and we write again as we learn more.

Early and incomplete beats late and tidy, and this is the one place where that trade is worth stating in advance.

12.Changes to this page

Dated, and the changes that matter arrive in writing.

This page carries the date it last changed. If we add a company that touches your files, or change what we do with them, the account owner gets it in writing at least 30 days before it applies.