What we collect
The form. Your name and work email and company and the few sentences you write about what keeps getting missed. Any optional answers and any files you upload with it.
The workflow intake. Your first name and work email and company and company website and team size and industry. What you write about the workflow. Your answers to our follow up questions. Any change you ask for in the brief. Any files you upload.
The website check. When you ask us to fix your site we keep your email and your name and the site address and the list the check found.
Questions you send us before you buy and our written answers.
The project page. After the first payment you send us what the build needs. Notes on how the work runs today. Screenshots and SOPs and recordings and links and example files. The names and roles of the people who own the workflow and approve it and get its alerts and see the result. Which of your tools you shared with us and a note when one cannot be shared. Your answers to our remaining questions and to anything we ask you in writing.
The project page never asks for a password or a key. It refuses text that looks like one.
The diagnostic. Your full name and work email and company and website. Your mobile number if you give it. Your answers on the fit screens and the questions after payment. Any file or link you add.
The Deep Dive Call. Your booking details. We record the call. The recording and a written note of it stay on your record.
Payments. Card details go to Stripe. We never see your card number. We keep the receipt and the payment reference.
Email. What you write to us and what we write back.
Site use. PostHog records how visitors use 3fold.me: the pages you view and where you click and scroll and how fast pages load. It also records a replay of your visit so we can see where the site is confusing. Anything you type into a form field is masked in the replay.
Vercel Analytics counts page views without cookies.
Session replay is off on the diagnostic pages and the report. It never records what you type.
The intake sends our analytics only closed labels such as industry and team size and fit. Your answers and your brief and your files never go to analytics. Session replays hide what you type and the brief on screen.
For clients. Read only data from the tools you connect. We read only the records the agreed checks need.
How we use it
To ask the follow up questions and write the brief of your workflow and propose what we would build and check whether it fits a standard implementation.
A language model writes the follow up questions and the brief and the proposed build from your answers. A fixed rule decides the fit. The model does not.
To write your diagnostic report. A language model drafts it from your answers. Kent reviews it before it reaches you.
To email you the link to your brief and our written answers.
To build the agreed workflow from what you send on the project page. To compare your notes and files with the brief you approved and ask you only where they disagree.
To email you the link to your project page and what we still need from you and when your implementation is ready to review.
To run the checks the written plan names and to draft the messages a person on your team reviews.
To send the emails the flow describes. The diagnostic receipt. The findings email. The call booking email. Replies to your questions.
To support you while we work together.
To fix the parts of 3fold.me that confuse people. That is what the PostHog records and replays are for.
Who processes it for us
Stripe takes payments.
Supabase hosts our database and stores uploads.
Vercel hosts the site and runs the software.
Resend sends our email.
Zoho runs the call booking and the meeting room for the Deep Dive Call.
PostHog records site use and session replays on 3fold.me. Its servers are in the United States.
A language model provider reads what you write in the intake and any data you connect. It writes the follow up questions and the brief and the proposed build you see on screen. It also writes the drafts for your team. Today that provider is Anthropic.
On the project page the same provider reads your notes and the text in your PDF and text files. It looks only for places where they disagree with the brief you approved. A person reads your screenshots and spreadsheets.
A person reviews every message before it goes to anyone outside your team unless your written scope says otherwise.
Telegram carries short alerts to the founder about a new request: a first name and the company and the workflow name and the fit. A question you send us goes there too.
Telegram also carries project page updates to the founder. Which tools you shared. Your note on a tool you cannot share. The start of a written answer you send us.
Google or Basecamp or another tool only when you connect it. We read what the plan names and nothing else.
Each of these sees only what it needs to do its job.
What we never do
We never sell your information to anyone.
We never use your data to train anything.
We never share it outside the processors named above unless the law requires it.
How long we keep it
Form and intake and brief and board and upload records stay while we work together and for up to twenty four months after. Then they are deleted.
Project page records and files stay while we work together and for up to twenty four months after the work ends. Then they are deleted.
You can ask for deletion sooner. Email kent@3fold.me from the address on file and we delete your form and intake and brief and board and upload records.
That includes everything on your project page. You can remove the access you gave us inside each tool at any time.
Payment records stay as long as the law requires for tax and accounting.
PostHog site records and replays are deleted on PostHog's own retention schedule.
Security
Data is encrypted in transit and at rest with the hosts named above.
Access is limited to the founder and to the processors above.
Keys and tokens are stored encrypted. Passwords are never stored in plain text.
Cookies
3fold.me sets cookies the site needs to work such as a payment session and your language.
PostHog sets one analytics cookie. It holds a random id so PostHog can tell one visit from the next. It does not hold your name or email.
We also keep a random visitor id and the page you arrived from in your browser's local storage so we can see which page brought you here.
We do not use advertising cookies.
You can block or delete cookies in your browser. The site still works without them.
Your rights
You can ask to see what we hold about you. You can ask us to fix it. You can ask us to delete it.
Write to kent@3fold.me. We answer within ten business days.
Children
3fold.me is for businesses. It is not for anyone under eighteen.
Changes to this notice
We may change this notice. The new version is posted here with a new date.
Contact
Questions about privacy go to kent@3fold.me.
