Privacy & cookies

Updated October 23, 2026

We collect your checkout email, Stripe payment reference, business details, social links, competitors, service information, support messages, and research evidence to fulfill your assessment.

Stripe handles card information; FIX/LIST does not store card numbers.

Intake and order records are stored server-side, and reports are held in private storage.

The owner review dashboard and draft PDFs are restricted to the authorized operator. Customers may access their own released report after payment verification. Customer access expires 365 days after purchase.

Cookies and third parties

A necessary, secure, HttpOnly cookie called fix_order provides access to your paid intake for up to 365 days. It uses SameSite=Strict. Hosting sign-in may also use necessary authentication cookies for protected areas. The hosting provider also sets security cookies, including the Cloudflare __cf_bm bot-management cookie, to help protect the service.

We count homepage views, checkout views and checkout-link clicks in daily first-party totals. These counters do not store visitor identifiers, browsing histories or advertising profiles and are not unique-visitor measurements. Payment conversions come from verified orders. The application does not include advertising pixels or marketing cookies. Rate limiting uses a short-lived hourly hash of request network information to reduce abuse. Optional advertising or cross-site tracking would require a policy update and applicable controls before it is enabled.

Fonts are requested from Google Fonts; your browser sends normal request information to that provider. Stripe checkout runs on Stripe’s site and follows Stripe’s cookie and privacy practices. Browser cookie settings can restrict storage, but doing so may affect paid intake or sign-in.

We do not sell your intake information or use it for advertising.

When a verified customer-facing sender is enabled, we send a transactional welcome email after a paid order. It confirms scope, intake requirements and timing; it contains no finished report. Provider acceptance is logged separately from report delivery.

Your approved report is delivered to the checkout email after human review. Digital tools assist with public evidence collection and preparation. The owner personally reviews the findings and sends the final report. The owner may download the approved PDF from the private dashboard and send it through Gmail; replies go to the sending Gmail inbox and are not synced into the dashboard.

Public sources may be consulted to research your business.

Do not submit passwords, confidential customer records, medical information, or other sensitive personal data.

Use the support form to request correction or deletion; payment and tax records may need to be retained.

Report and intake data remain until fulfillment and any support needs are complete, or until an applicable deletion request is handled.

This policy will be updated if our practices change.