Privacy Policy

Who we are

ConsultNow is operated as an individual business by its founder (see the Imprint for full legal details). Our service is accessible at consultnow.io, ai.consultnow.io, and app.consultnow.io. For privacy enquiries contact us at support@consultnow.io.

Data we collect

• Email address, when you request a sign-in link, purchase a report or module, or contact us. Used to authenticate, deliver your order, and (for assessments) send follow-up emails if you have not completed a purchase.
• IP address hash, we hash your IP with SHA-256 before storing. The raw IP is used transiently for rate-limiting and never written to persistent storage.
• Assessment answers and workspace text, the 24 binary choices you make in the AI Opportunity Score, and any text you enter in your workspace profile. These are used to generate your personalised AI readiness report.
• Payment data, handled entirely by Stripe. We never see or store your card number. We receive confirmation of payment and a Stripe session identifier.
• Usage events, first-party, server-side events such as quiz started, quiz completed, report viewed. No cookies, no cross-site tracking.

Lawful basis (GDPR Article 6)

• Contract performance (Art. 6(1)(b)), processing your email and assessment data is necessary to deliver the service you requested (report generation and delivery).
• Legitimate interest (Art. 6(1)(f)), server-side event logging, rate-limiting, abuse prevention, and operational monitoring. These interests are proportionate and do not override your rights.

Retention

Data processors (sub-processors)

We share your data only with the following processors under written Data Processing Agreements and EU Standard Contractual Clauses (SCCs) where required:

• Stripe, Inc. (United States), payment processing. Stripe Privacy Policy.
• Anthropic, PBC (United States), AI report generation. Your assessment answers are sent to the Claude API to produce your personalised report. Data is processed under Anthropic's API data retention policy.
• Resend, Inc. or Twilio Inc. (SendGrid) (United States), transactional email delivery (sign-in links, reports).
• Cloudflare, Inc. (Global), edge network, Workers runtime, CDN, and D1 database hosting. Data stored in Cloudflare D1 is located in the EU by default.

Transfer mechanism for data sent to US-based processors: EU Standard Contractual Clauses (Module 2 Controller-to-Processor).

Cookies and tracking

We use exactly two cookies:

• cn_session, HttpOnly, Secure, SameSite=Lax. Session authentication token. Set only when you sign in. Expires with the session.
• cn_admin, HttpOnly, Secure, SameSite=Strict. Admin session token. Set only when an administrator signs in to the admin panel.

We do not use analytics cookies, advertising cookies, or any third-party tracking scripts. The assessment uses navigator.sendBeacon to send first-party usage events to our own API, no cookies, no third-party involvement.

Your rights (GDPR)

If you are located in the EU or EEA you have the following rights:

• Right of access, request a copy of personal data we hold about you.
• Right to rectification, correct inaccurate data.
• Right to erasure, request deletion of your data (subject to legal retention obligations).
• Right to restriction, ask us to restrict processing while you exercise another right.
• Right to data portability, receive your data in a machine-readable format.
• Right to object, object to processing based on legitimate interest.

To exercise any of these rights (Data Subject Access Request, DSAR), email support@consultnow.io. We will respond within 30 days.

Changes to this policy

We may update this policy from time to time. Material changes will be notified by updating the "last updated" date above. Continued use of the service after the change constitutes acceptance.