What we collect
| Information | Why | Where | Required |
|---|---|---|---|
| Business email address | To contact you about the briefing or artifact you requested. | Booking form · artifact request | Yes |
| Name | So we address you correctly. | Booking form | No |
| Preferred briefing slot and your timezone | To schedule the briefing at a time that works for you. Your timezone is read from your browser, not asked for. | Booking form | Yes |
| Free-text note (a number you do not trust) | So the briefing is useful. Whatever you write here is what we prepare against. | Booking form | No |
| Which lever and which tool you were using | So a principal arrives to the conversation already knowing what you were looking at. | Booking form · artifact request | Automatic |
| Campaign attribution: campaign name, A/B variant, utm_source, utm_medium, referring page | To understand which messages bring people here and which do not. | Landing pages | Automatic |
| Usage analytics: pages viewed, time on page, approximate location derived from IP, device and browser type, and the site that referred you | To see which pages are read and which are ignored, so we write more of what is useful. Measurement only. | Every page | Automatic |
"Automatic" means the field is populated by the page rather than typed by you, for example, which analyzer you were reading when you opened the form.
What we do not do
- We do not use advertising cookies, remarketing tags, or ad-personalization features. Our analytics property is configured for measurement only.
- We do not sell, rent or trade personal information. There is no circumstance in which we would.
- We do not build advertising profiles of you, and we do not link your activity here to your activity on other websites.
- We do not collect payment information through this Site.
- We do not collect special-category data (health, biometric, political, religious).
Browser storage
We set no advertising cookies. The entries below are all first-party, and none of them is used for advertising. The two analytics cookies are set by Google Analytics, which we run in measurement-only mode:
| Key | Type | Purpose | Lifetime |
|---|---|---|---|
| xcf.lever.v2 | localStorage | Remembers which lever you selected so the site stays consistent as you move between pages. | Until you clear browser storage. |
| xcf.attribution | sessionStorage | Holds campaign attribution for the duration of your visit so a form submission can be traced to the campaign that brought you. | Cleared when you close the tab. |
| _ga | Cookie (first-party) | Set by Google Analytics to distinguish one visitor from another so a return visit is not counted as a new person. | 2 years. |
| _ga_7TEFVSP6F3 | Cookie (first-party) | Set by Google Analytics to hold the state of the current session. | 2 years. |
Clearing your browser storage removes both. Nothing on the site breaks if you do.
Who processes it
| Provider | Role | What they hold |
|---|---|---|
| Netlify | Website hosting and content delivery | Standard server logs, including IP address and browser user-agent, retained for security and operational purposes. |
| Google (Apps Script and Sheets) | Form submission handling and storage | The form fields listed above. Stored in a private spreadsheet accessible only to xChangeFlow personnel. |
| Google Analytics 4 | Website usage measurement | Pages viewed, session duration, device and browser type, referring site, and an IP-derived approximate location. IP addresses are truncated by Google before storage and are not available to us. |
Why we are allowed to hold it
Where the law requires a legal basis, including the UK and EU under GDPR, we rely onconsent when you submit a form, and on legitimate interests for understanding which campaigns bring people to the site. You can withdraw consent at any time.
How long we keep it
Enquiry records are retained for 24 months from your last contact with us, then deleted. Campaign attribution is retained in aggregate. Server logs held by our hosting provider follow their standard retention period.
Your rights
Depending on where you live, you may have the following rights. We honour these requests regardless of jurisdiction.
| Right | What it means |
|---|---|
| Access | Ask what personal information we hold about you. |
| Correction | Ask us to correct information that is wrong. |
| Deletion | Ask us to delete your information. We will do so unless we are legally required to retain it. |
| Objection and restriction | Ask us to stop or limit how we use your information. |
| Portability | Ask for a copy of the information you gave us in a portable format. |
| Withdraw consent | Where we rely on consent, withdraw it at any time. This does not affect processing already carried out. |
To exercise any of these, email info@xchangeflow.com. We will respond within 30 days. We will not charge you and we will not make the service worse for asking.
California residents: we do not sell or share personal information as those terms are defined under the CCPA/CPRA, so there is no opt-out to offer.
International transfers
We operate from the United States and our processors operate there. If you contact us from outside the US, your information will be transferred to and stored in the United States.
Children
This is a business-to-business site. It is not directed at children and we do not knowingly collect information from anyone under 16.
Changes and contact
Material changes to this policy will be posted here with an updated effective date. Questions, requests or complaints: info@xchangeflow.com.