We don’t
sell your data.

When you use 4FRNT’s free assessment, we collect the URL you paste, anything you tell the scan during the conversation, and (if you provide it) your name, email, and phone number.

We also keep abuse-prevention counters keyed to your IP address; our system deletes these within 30 days. Our hosting provider (Vercel) keeps standard request logs under its own retention policy.

• Generate your business assessment.
• Email you the report if you asked us to.
• Reach out about the strategy call if you booked one.
• Improve the scan’s prompt based on patterns we see across conversations.

That’s it. We do not sell, rent, or share your data with third parties for marketing. We do not run retargeting ads off your conversation.

Thirteen vendors process data on our behalf:

• Anthropic — runs the AI that powers the scan. They process your conversation under their own privacy policy. They do not train models on your data.
• Supabase — stores your conversation history in a database hosted on AWS US-East.
• Vercel — hosts the website and runs server-side code.
• Resend — sends transactional email (your report, and account emails if you buy a plan). They process the email address you give us, only to deliver those messages.
• ScraperAPI — fetches JavaScript-rendered pages of the site being scanned (the URL you submit).
• Google (Places API) — public business-listing data used for ratings and local benchmarks.
• Apify — reads public social profiles when a scanned site links them.
• Cloudflare (Turnstile) — checks in the background that the scan and its chat are being used by a person, with nothing for you to click; it sees your IP address and browser signals, and Cloudflare also uses those signals to improve its own bot detection. How Cloudflare handles that data is set out in its Turnstile Privacy Addendum.
• Perplexity — powers the AI-search visibility check; receives the scanned business’s name, category, and city (never your contact details).
• Stripe — processes payment if you buy a plan. Your card details go directly to Stripe; we never see or store them.
• ElevenLabs — turns report and chat text into speech when you use the listen feature; receives that text, nothing else.
• Yelp (Fusion API) — receives the scanned business’s name and location to find its public review listings.
• Meta (Ad Library) — for paid clients only: receives the business name to sample publicly listed competitor ads.

Each is contractually bound to protect your data and, apart from the Cloudflare use noted above, to process it only for our purposes.

You can email hello@4frntlabs.com to:

• Get a copy of everything we have about you.
• Have it permanently deleted (we’ll confirm within 14 days).
• Correct anything that’s wrong.
• Opt out of any future communications.

If you’re a healthcare practitioner asking about HIPAA: 4FRNT is not a HIPAA business associate. Don’t share PHI (patient information) with the scan. Use generic operational descriptions instead.

We set a few first-party cookies, each needed for the service to work and none used for advertising:

• a conversation cookie that keeps your scan and chat yours for 7 days;
• a returning-visitor cookie that lets a later chat in the same browser remember the earlier one, for up to 90 days;
• if you are a client, a sign-in cookie for the portal that lasts 30 days.

Your browser also keeps, in its own storage, your scan result, a reference to your conversation, and a note of how you first arrived (the page you landed on and any campaign tag in the link); that note is saved with your conversation if you start the chat. The site stops using these after 7 days and clears them on a later visit; you can clear them sooner in your browser settings. Cloudflare’s Turnstile check may keep its own data in your browser to do its job, as its addendum (linked above) describes. For traffic measurement we use privacy-respecting, cookieless analytics (Vercel Web Analytics) that records aggregate visits and where they came from without cookies and without any personally identifying information. We do not use advertising or retargeting pixels on customer-facing pages, and we do not sell or share your data. The admin dashboard uses one signed cookie for authentication.

4FRNT is for business owners. We don’t knowingly collect data from anyone under 18.

If we materially change this policy, we’ll email anyone whose email we have, and we’ll update the date at the top. Old versions are kept in our git history if you want to audit them.

Email hello@4frntlabs.com. We reply within 72 hours, usually faster.