Privacy Notice

Form fields and email-contact consent

The form asks for your name, business name and email address. It also includes an optional “What would you like to improve?” message and an optional time-sensitive checkbox. Please don’t include patient or health information.

The required consent checkbox is not preselected. Its wording is:

I agree that Legacy Business Automation may contact me by email about this inquiry.

This wording covers email contact about the inquiry, not SMS, phone contact or a separate marketing subscription. The form has no phone-number field.

Inquiry handling

Submitted inquiries are saved with the form fields, the consent wording and time, the date received, and the inquiry’s conversion status and conversion date when applicable. Inquiry details go to the private Owner inbox. When a new inquiry is saved, the Owner receives a short email alert saying a new inquiry arrived, with a link to the Owner inbox; the alert does not include the form fields. No GoHighLevel connection is configured.

The server checks required fields, email format, consent and text lengths, trims text, and rejects unexpected fields. Saved email addresses are lowercased.

The form also runs server-side anti-abuse checks. When the form opens, the website issues a short-lived signed token that contains a server-side timestamp and a random value; the token contains no form fields. When a request is sent, the server checks the token’s signature, verifies how long the form was open using the timestamp inside the token rather than any time reported by the browser, rejects a filled-in hidden field, and refuses requests that were completed too quickly or whose token has expired. These checks are intended to deter basic automated submissions, but they cannot prevent all spam.

This form uses Cloudflare Turnstile to help detect automated requests. When the check runs, your browser connects to Cloudflare. Cloudflare may process technical signals such as your IP address, browser information, and connection characteristics to assess requests and improve Turnstile’s bot detection. Before accepting a submission, the server sends Cloudflare a verification token; that token does not contain the form fields. If the check cannot be verified, the request is not accepted. For details, see Cloudflare’s Turnstile Privacy Addendum.

At present, only the Owner role is assigned, and the inbox page and server-side read actions are Owner-only. Database rules also allow accounts assigned a staff role to read inquiries, but no staff role is currently assigned. Only the Owner can mark inquiries converted or delete them. Visitors cannot list or read stored inquiries, mark them converted, or delete them.

Configured inquiry retention

• Unconverted inquiries are scheduled for deletion 90 days after they were received.
• Converted inquiries are scheduled for deletion 12 months after they were marked converted. The conversion date is recorded automatically.
• The Owner can delete an inquiry sooner.

The automatic deletion job is configured to run daily at 03:15 UTC. These periods describe inquiry records in the website’s database; they do not establish how long hosting logs or backups are kept.

Website services

The website uses a managed database and sign-in service for the Owner area. Owner account confirmation and password-reset emails are separate from the Owner inquiry alert.

The Owner email alert is sent through the website’s managed email service and contains no inquiry details. The inquiry submission handling has no GoHighLevel connection and does not send inquiry details to GoHighLevel.

The website loads fonts from Google Fonts. Its error-handling code also supports technical error reporting. This notice does not claim that visiting the website involves no processing by hosting or other website services.

Contact

For questions about this notice or inquiry handling, contact Legacy Business Automation at: