Privacy notice

We collect only what is needed to build your match and run the product:

• Assessment answers. Your interests, skills and experience, resources, goals, work preferences, and hard constraints — used to build your profile and match it against the business opportunity library.
• Email address. Collected when you unlock your result or complete a purchase, so we can send your result link, receipt, and account access.
• Pseudonymous analytics and product events. Assessment starts and completions, result views, match selections, and similar in-product events, tied to an anonymous or account identifier rather than your name, so we can understand whether the product is useful and fix what is not.
• Payment information. Handled entirely by Stripe. We never see or store your card number, expiry, or CVC — Stripe passes us only confirmation that a payment succeeded, the amount, and a transaction reference.
• AI personalization inputs, for paid reports only. If you unlock the Full Match Report, relevant parts of your assessment answers and match results are sent to our AI provider to generate the personalized explanation of your report. This does not happen for the free result.

Each category above is used only for the purpose described next to it: building and explaining your match, letting you return to your result, processing payment, and understanding — in aggregate — whether the assessment and matches are working. We do not sell your personal data, and we do not use your assessment answers to build a profile for advertising.

We rely on a small number of processors to run the product. Each one only receives the data it needs to perform its function:

• Supabase — our database and authentication provider. Stores your assessment answers, account, and result records.
• Stripe — our payment processor. Handles checkout and card data directly; we never receive or store your full card details.
• OpenAI — generates the personalized narrative for paid Full Match Reports, using relevant assessment and match data as input.
• Vercel — hosts the website and application.

We choose processors that offer their own data-protection commitments, and we only share what each one needs to do its job.

We keep assessment answers and result data for as long as your account or result link is active, so you can return to it. Payment records are kept as long as required for accounting and tax purposes. Pseudonymous analytics events are retained only as long as useful for improving the product and are periodically reviewed for deletion. If you ask us to delete your data, we remove what we can while retaining the minimum needed to meet legal or accounting obligations.

You can ask us to access, export, or delete the personal data we hold about you. Today this is a manual process — email hello@whatbusiness.ai from the address associated with your result or account and describe what you need. We aim to respond promptly. A self-serve export and deletion flow inside your account is planned; this notice will be updated when it ships.

We describe these as practices rather than a claim of compliance with any specific law (for example GDPR or CCPA) — where local law grants you additional or different rights, those rights apply and are not limited by this notice.

Using your assessment answers to personalize your business matches and your Full Match Report is part of delivering the product you asked for, not marketing. It is separate from any marketing communications (such as product updates or tips), which we will only send if you separately opt in, and which you can opt out of at any time.

Questions about this notice, or requests regarding your data, can be sent to hello@whatbusiness.ai.

Data controller: [Company legal entity — TODO], [Registered address — TODO].