Privacy Policy

Our Privacy Posture

Before getting into the details, here's what we don't do:

• We do not sell, rent, lease, or trade your personal information.
• We do not share your personal information with third parties for advertising, retargeting, or any other form of cross-context behavioral profiling.
• We do not currently run third-party advertising or marketing pixels (Google Ads, Facebook Pixel, LinkedIn Insight Tag, etc.) on this site.
• We do not provide your data to AI service providers for the purpose of training their models.

Your information is collected and used only to deliver the services you've requested, communicate with you about those services, and operate our business.

Information We Collect

Information you provide directly

When you create an account, fill out forms, or communicate with us, we may collect:

• Your name, email address, company name, and job title
• Responses to intake questionnaires (Pre-Intake and Full Intake forms)
• Files and documents you upload to the platform (transcripts, reference materials)
• Messages, notes, and feedback you provide
• Payment information (processed by Stripe; we do not store your credit card number)

Information collected automatically

When you use our Services, we may automatically collect:

• Browser type, device information, and operating system
• Pages visited, time spent, and interactions with the platform
• IP address and approximate location
• Referring website or source
• Timestamps of when you view deliverables (diagnosis reports, action plans, journey maps)

Information from third parties

• Stripe: When you make a payment, Stripe provides us with transaction confirmation, payment status, and a receipt URL. We do not receive or store your full credit card number. Stripe's privacy policy governs their handling of your payment data.
• Supabase: Our platform infrastructure is hosted on Supabase. Data stored in the platform (account information, form responses, files) is processed and stored by Supabase in accordance with their privacy and security policies.

Information we collect when you submit a form

When you fill out a form on this site (such as our contact form or free assessment request), we collect the information you provide directly (for example, your name, email address, and any details about your business or inquiry).

Along with your submission, we automatically capture a small amount of context about your visit:

• The page you were on when you submitted the form
• The website or search result that referred you to our site (if any)
• Any campaign tracking parameters in the URL, such as UTM tags, which tell us if you arrived from a specific link we shared in an email, social post, or ad

We collect this context for two reasons: to respond to your inquiry appropriately, and to understand how people find and move through our site so we can improve it over time. This information is stored alongside your submission in our customer relationship management (CRM) system and is treated as part of your lead record.

We do not use this information for cross-site advertising or retargeting. If we ever begin doing so, we will require your explicit consent through our cookie preferences before any such tracking occurs.

You have the right to request a copy of the information we hold about you, or to request that we delete it, at any time. To make such a request, contact us at privacy@joshuamcsorley.com.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services
• Process your payments and manage your account
• Deliver diagnostic services, including generating diagnosis reports, action plans, and customer journey maps
• Communicate with you about your engagement, including status updates and deliverable notifications
• Send team invitation emails on your behalf when you invite colleagues to the platform
• Improve the platform and develop new features
• Respond to your inquiries and provide support
• Comply with legal obligations

AI-Generated Content

Our platform uses artificial intelligence (specifically, large language models provided by Anthropic and/or OpenAI) to assist in generating diagnostic deliverables, including diagnosis reports, action plans, and customer journey maps. When these tools are used:

• Your intake form responses, uploaded transcripts, and other information you provide through the platform may be sent to AI service providers as input for generating deliverables
• AI-generated content is always reviewed and edited by Joshua McSorley before being shared with you
• We do not use your data to train AI models. Your information is processed for the sole purpose of generating your deliverables.
• AI service providers may process your data in accordance with their own privacy policies. We select providers that do not use customer inputs for model training.

How We Share Your Information

We do not sell, rent, lease, trade, or share your personal information for any commercial purpose, including advertising or marketing on third-party platforms. The only entities that receive your information are the service providers we use to run our business, listed below.

We share information with:

• Lovable: Our hosting and deployment platform for both the marketing website and the diagnostic portal. Lovable also routes transactional emails (such as contact-form notifications and account-related messages) through its built-in email infrastructure.
• Google Analytics 4: Provides aggregated, anonymized analytics about how visitors find and use joshuamcsorley.com. Configured with Google Consent Mode v2 so analytics events fire only when you've granted analytics consent through our cookie preferences. We do not enable advertising or remarketing features. Subject to Google's privacy policy.
• Microsoft Clarity: Anonymized behavioral analytics — heatmaps and session interaction recordings — that help us understand which parts of the marketing website visitors actually use, where they get stuck, and which sections never get read. Form inputs and other sensitive content are automatically masked by Clarity, so we do not see what you type. Tracking is gated by the same analytics consent that controls Google Analytics: declining the analytics category turns Clarity off immediately, even mid-session. Subject to Microsoft's privacy policy.
• PostHog: Product analytics for the marketing website — pageviews and a small set of conversion events (book-a-call clicks, free-assessment clicks, contact form submissions, blog and case study views) that help us understand which parts of the site actually move people toward booking a call. PostHog also captures Core Web Vitals (page-load timing) and rage clicks (rapid repeated clicks on the same spot, which signal a broken or confusing UI) so we can spot performance and usability issues. Gated by the same analytics consent that controls Google Analytics and Microsoft Clarity: declining the analytics category turns PostHog off immediately, even mid-session. Routed through a first-party subdomain (g.joshuamcsorley.com) so privacy extensions don't silently drop the requests — PostHog itself is still disclosed here. Subject to PostHog's privacy policy.
• Google Calendar Appointment Schedules: When you book an intro call through our booking page, the booking form is embedded from Google Calendar and your scheduling submission (name, email, time selected, optional notes) is processed by Google's calendar service. Subject to Google's privacy policy.
• Supabase: Database, authentication, and edge-function infrastructure for the diagnostic platform. Stores account information, intake form responses, and uploaded files. Used by the diagnostic platform only. Subject to Supabase's privacy and security policies.
• Stripe: Payment processing for paid diagnostic engagements. Stripe handles all credit card data; we do not store your card number. Used by the diagnostic platform only. Subject to Stripe's privacy policy.
• AI service providers (Anthropic and/or OpenAI): Generate diagnostic deliverables from your intake responses. We select providers that contractually do not train their models on customer inputs. Used by the diagnostic platform only. See the AI-Generated Content section above.
• Team members in your organization: When you or a colleague creates an account under the same organization on the diagnostic platform, team members in that organization can view shared intake form responses, shared notes, and shared files. Internal notes and internal files are not visible to your team. Diagnostic platform only.
• Legal requirements: We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Each service provider is contractually limited to processing your data only on our behalf, for the purposes described above — they cannot use your data for their own marketing, cross-customer aggregation, or resale.

Data Retention

• Account information: We retain your account information for as long as your account is active or as needed to provide Services.
• Diagnostic data: Intake form responses, diagnosis reports, action plans, journey maps, notes, and files are retained for the duration of our engagement and for a reasonable period afterward (typically 2 years) to support follow-up engagements or reference.
• Payment records: Transaction records are retained as required by applicable tax and accounting laws.
• You may request deletion of your account and associated data at any time by contacting us at the email address below. We will delete your data within 30 days of a verified request, except where retention is required by law.

Data Security

We implement reasonable technical and organizational measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission (HTTPS/TLS)
• Row-level security policies that restrict data access based on your role and organization
• Authentication-based access controls
• Secure payment processing through Stripe (PCI-DSS compliant)

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Cookies and Tracking

Our diagnostic platform (diagnostic.joshuamcsorley.com) uses essential cookies to maintain your login session and remember your preferences. We do not use advertising or marketing cookies on the diagnostic portal.

Our marketing website (joshuamcsorley.com) currently uses three analytics tools to understand how visitors find and use the site: Google Analytics 4 (for aggregated site metrics), Microsoft Clarity (for anonymized heatmaps and session interaction recordings, with form inputs automatically masked), and PostHog (for a small set of conversion events like booking clicks and form submissions). All three tools fire only when you've granted analytics consent through our cookie preferences, and none of them tracks you across other websites.

Our cookie consent banner also includes a marketing category, reserved in case our business model later expands to include paid advertising or remarketing. We are not currently using any marketing or advertising cookies. If we begin to, our cookie preferences are configured so that the choice you've already set will be respected automatically — we will not silently start tracking you. You can review or change your consent at any time using the cookie preferences in the banner.

We honor Google Consent Mode v2: if you decline analytics consent, Google Analytics receives no events from your visit, even on subsequent page navigations within the same session.

Your Rights Regarding Your Information

Depending on where you live, you may have specific legal rights regarding the personal information we hold about you. We honor the following rights for all visitors to our site, regardless of jurisdiction, because we believe good privacy practice shouldn't depend on where you happen to live.

The right to know. You can request a copy of the personal information we hold about you, including what we've collected, where it came from, and who we've shared it with.

The right to correct. If any information we hold about you is inaccurate, you can ask us to correct it.

The right to delete. You can ask us to delete the personal information we hold about you. We'll do so promptly unless we're required to retain certain records for legal, accounting, or tax reasons (for example, invoices from a paid engagement). In those cases, we'll explain what we're retaining and why.

The right to opt out of marketing. You can opt out of any marketing communications from us at any time by clicking the unsubscribe link in any email we send you, or by contacting us directly.

The right to adjust cookie preferences. You can change your cookie consent settings at any time by clicking “Cookie Preferences” in the footer of our site.

The right to non-discrimination. We will not deny you services, charge you different prices, or provide a different level of quality because you exercised any of these rights.

For California residents: Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), you have additional rights including the right to limit the use of sensitive personal information and the right to opt out of the sale or sharing of personal information. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

For visitors from the European Union, United Kingdom, or other GDPR jurisdictions: You have the additional rights to object to processing, restrict processing, and data portability. You also have the right to lodge a complaint with your local data protection authority if you believe we have mishandled your information.

Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete that information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the platform or sending an email to the address associated with your account. Non-material changes take effect immediately. Material changes take effect 30 days after notice.

How to Contact Us About Your Data

If you'd like to exercise any of the rights described above, or if you have questions about how we handle your information, contact us at:

Email: privacy@joshuamcsorley.com

We'll respond to data requests within 30 days. If we need more time (for example, because a request is unusually complex), we'll let you know within those 30 days and explain the expected timeline.

To verify your identity before processing a request, we may ask you to confirm information that matches what we already have on file (for example, the email address you used to submit a form). This protects you from someone else requesting or deleting your data.

If you're not satisfied with how we've handled a request, you have the right to escalate. California residents can contact the California Privacy Protection Agency. EU residents can contact their national data protection authority. UK residents can contact the Information Commissioner's Office (ICO).