Privacy Policy

Information you provide

Depending on the feature you use, you may provide your name, business email, company, role, phone number, industry, company-size or revenue range, systems in use, operational priorities, requested meeting time, and free-text assessment, contact, or booking responses.

If you subscribe to the Intelligence Brief, we collect your email and any optional name or company information. Marketing consent is separate from permission to respond to an assessment, contact request, or strategy-session request.

If you use the Public Signal Scan, the domain you enter is used to inspect public DNS records, publicly available website source, and ordinary response headers. The scan action does not save that domain as a lead unless you separately submit a form. TAG's hosting and DNS providers and the target website may receive ordinary technical request logs.

Information collected with a submission

When you submit a form, we may record the page on which you arrived, referring URL, conversion path, and campaign parameters such as UTM source, medium, campaign, term, and content. We also keep the consent wording and policy version shown with the form.

For abuse prevention and consent evidence, the application derives a one-way SHA-256 hash from the request IP address and may retain the browser user-agent with the consent record. The application does not store the raw IP address in its lead database. Our hosting provider still receives network information needed to deliver and secure the site.

If you submit a single-page form without JavaScript, the site sets a host-only, HTTP-only receipt cookie for up to ten minutes. It is used only to prove that the receipt or booking state shown after the POST came from this site; it is not used for advertising or cross-site tracking.

Website analytics and performance

Our first-party pageview ledger stores only the route visited and a timestamp. It does not store the query string, raw IP address, user agent, cookie identifier, or form contents with that pageview.

On Vercel deployments, Vercel Web Analytics and Speed Insights measure visits and real-user performance. Vercel states that Web Analytics does not use third-party cookies and uses a privacy-preserving visitor hash that is not intended to track a visitor across days. Speed Insights collects performance measurements that are not presented to us as an identified visitor profile.

PostHog product analytics is optional and operates only when its public project key is configured. When enabled, this site sends named events and limited properties such as route, CTA placement, assessment step, selected-system count, or an enumerated failure reason. PostHog is configured with memory-only persistence, no autocapture, no session recording, masked text and attributes, and no person profiles. Form contents, names, email addresses, phone numbers, company names, and free-text answers are not intentionally sent to PostHog.

The TAG site does not intentionally set advertising cookies. Third-party sites reached through an external link may use their own technologies under their own notices.

How we use information

• Respond to inquiries and provide the assessment, Public Signal Scan, requested brief, or strategy-session workflow.
• Create internal qualification and opportunity briefs from submitted business information.
• Send service messages, confirmations, internal alerts, and the Intelligence Brief when separately requested.
• Measure page usage, conversion stages, reliability, and website performance without intentionally placing form contents in analytics tools.
• Protect the site, prevent abuse, troubleshoot failures, comply with law, and establish or defend legal claims.

Service providers and disclosures

We use service providers only for functions needed to operate the site. The provider actually used can depend on deployment configuration.

• Vercel: website hosting, delivery, security and operational logs, Web Analytics, and Speed Insights.
• Supabase: managed database storage for leads, assessments, consent, attribution, booking requests, email ledgers, and conversion events.
• Microsoft 365 and Microsoft Graph: transactional email and calendar availability or booking when configured.
• Resend: alternative transactional email delivery when selected instead of Microsoft Graph.
• PostHog: optional, limited product analytics when configured.
• Cloudflare public DNS: public DNS lookups made by the Public Signal Scan; the target website also receives the scan request.

When information may be shared

We do not sell personal information or share it for cross-context behavioral advertising. We may disclose information to the service providers above, to professional advisers under appropriate duties, to comply with law or valid legal process, to protect people and systems, or as part of a merger, financing, reorganization, or sale subject to appropriate safeguards.

Retention

Our current retention targets are: lead and submission records while the relationship is active and generally up to 24 months after the last meaningful interaction; newsletter subscription records, including their current consent wording and policy version, until unsubscribe and generally up to 12 months afterward; lead-submission consent evidence for up to seven years; and attribution, email-delivery, conversion, and pageview ledgers generally up to 24 months. Providers may keep security logs, backups, and delivery records under their own retention schedules.

These periods are targets, not a representation that every record is deleted automatically on a fixed day. The application does not currently run an automated retention purge. TAG uses manual deletion and periodic review while that control is being implemented, and may retain information longer when reasonably required by law, a dispute, fraud prevention, or security needs.

Your choices and rights

You may ask to access, correct, delete, or obtain a copy of personal information associated with you, withdraw consent, or object to or restrict certain processing where applicable. We may need to verify your identity and may retain information when an exception or legal obligation applies.

Every Intelligence Brief email includes an unsubscribe link. Unsubscribing stops future marketing messages but does not prevent service communications about a request you made.

Security

We use measures intended to reduce risk, including server-side validation, access controls, encryption in transit, restricted database access, data minimization, and redaction of sensitive log fields. No website, transmission, or storage system is completely secure, and we cannot guarantee that information will never be lost, misused, or accessed without authorization.

International processing

TAG is based in the United States. Our providers may process information in the United States and other countries where they or their subprocessors operate. Those countries may have different privacy laws. Where required, we rely on provider agreements and lawful transfer mechanisms designed to protect transferred information.

Children

This business-to-business website is not directed to children under 18, and we do not knowingly request personal information from them. If you believe a child submitted information, contact us so we can review and remove it as appropriate.

Changes to this policy

We may update this policy as our services, providers, or legal obligations change. We will post the revised policy here and update its effective date. If a change materially affects information already collected, we will provide additional notice when required.

Contact us

To ask a privacy question or exercise a right, email support@ubntag.com. Please do not send sensitive personal information by email unless we ask for it through an appropriate channel.