Privacy policy

Information you choose to submit

The free-checklist form may collect email address and optional first name, company, and role. The compliance-help form collects the contact and project-context fields shown in the form.

Do not submit Social Security numbers, payroll files, tax returns, employee wage records, apprentice records, or other sensitive worker information through site forms.

How submissions are handled

Valid checklist and compliance-help submissions are stored in a private lead ledger before the site attempts delivery to a configurable email-marketing or lead provider. The ledger may include the submitted contact and project-context fields, consent version and time, browser-generated visitor and session identifiers, landing page, referral and campaign information, downstream delivery state, and limited browser information used as consent evidence and for abuse prevention.

Lead records are visible only through an owner surface that requires sign-in and an explicit email allowlist. They are automatically removed after the configured retention period, which defaults to 730 days. External providers may have separate retention and deletion practices. Before public launch, the operator should name active providers here, confirm access controls and deletion procedures, and publish a support contact.

Checklist-update messages can include an opaque, signed preference link that contains no email address. A confirmed opt-out is converted to a keyed email hash and retained in a private suppression ledger so future checklist submissions are not exported for marketing delivery. The site also attempts to send the opt-out to the configured email provider and exposes any failed handoff in owner-only privacy operations. Purchase delivery and requested compliance-help follow-up remain separate workflows.

Purchases and private delivery

Stripe processes payment details; this site does not intentionally receive or store full card numbers. To verify payment, attribute revenue, and support private delivery, the site may store the Stripe Checkout Session ID, purchaser email, Payment Link ID, amount, currency, payment status, a pseudonymous site-session reference, first-touch source and campaign fields, entitlement dates, and download activity. The site-session reference contains no email address or payment credential.

Paid files remain in private object storage. Download access uses an expiring, limited-use token; only a cryptographic hash of that token is stored. A configurable transactional-email provider may receive the purchaser email, order reference, private download link, expiration, download allowance, and support address. The owner-only order desk records delivery status and attempts and can resend or reset access. Purchase and delivery records should be retained only as long as needed for fulfillment, support, accounting, fraud prevention, and applicable legal obligations.

Analytics and links

The site uses first-party, pseudonymous identifiers stored in the browser to understand visits, traffic sources, resource use, checklist conversions, Starter Kit interest, calculator completion, and help-request conversions. The event ledger does not intentionally store names, email addresses, IP addresses, payroll data, or project records and automatically removes events after 180 days.

Event data may also be delivered through a configurable analytics webhook. The owner-only analytics dashboard requires ChatGPT sign-in plus an explicit email allowlist. External government, payment, email, analytics, and provider links are governed by the destination's policies.