Back to home

PRIVACY & DATA

Privacy Policy

Draft prepared October 6, 2026 • Pending business and legal review

Draft notice: This policy is not yet a verified description of the site’s practices. Confirm the legal business name, privacy contact, service providers, advertising tools, retention periods, and applicable privacy rights before publishing or collecting leads.

01. Who is responsible

This policy concerns the Beautiful 168k website and its eligibility inquiry form. Website operator: [insert full legal business name and business address]. Privacy contact: [insert monitored privacy email address]. These details must be completed before this policy is finalized.

02. Information you provide

The inquiry form requests your name, email address, phone number, estimated current-year federal income tax liability range, and acknowledgment of the site’s informational disclosure. Please do not submit Social Security numbers, bank details, account credentials, or tax returns through this form. Confirm whether any other information is collected through follow-up communications.

03. How inquiry information is used

Proposed purposes, subject to confirmation: responding to your inquiry, providing requested structural overview and risk-disclosure materials, arranging relevant follow-up, maintaining inquiry records, and meeting applicable legal obligations. Confirm any marketing communications, their consent requirements, and the available unsubscribe process before adding those activities to the final policy.

04. Advertising, analytics & cookies

Advertising is planned, but the site’s tracking setup has not been confirmed. Before launching campaigns, identify any analytics tools, advertising pixels, conversion APIs, cookies, or similar technologies actually in use. The final policy should disclose the providers, information collected, purposes, and available choices. Where required, obtain consent before activating nonessential tracking. A Privacy Policy link by itself does not provide cookie consent or an advertising opt-out.

05. Providers, sharing & retention

Confirm the services used for website hosting, form submission storage, email notifications, customer relationship management, and advertising. List the categories of recipients and explain any legally required disclosures. Do not claim that information is never shared or that it is not sold or used for targeted advertising until those practices have been verified. Specify a retention period or clear retention criteria, including the process for deleting inquiry records.

06. Data Security

Implementation guidance — not a statement that these controls are currently active. Provider encryption, account permissions, integrations, deletion timelines, and email authentication must be verified. Email authentication reduces spoofing risk but does not guarantee inbox placement.

Implementing Section 6: Data Security requires setting up a secure, compliant lead pipeline from the moment an investor fills out a form to when their information reaches your team and CFO. Because you are collecting sensitive financial information (such as W-2 tax liability tiers), high-net-worth prospects expect institutional-grade data privacy.

Step 1: Secure Data Capture (Landing Page & Forms)

HTTPS & SSL Encryption: Ensure your Framer landing page has an active SSL certificate (HTTPS enabled in domain settings) so data is encrypted in transit.

Encrypted Form Inputs: Use secure form builders integrated into Framer—such as HubSpot, Typeform, Fillout, or Make/Zapier webhooks over HTTPS—which encrypt form submissions using AES-256 at rest.

No Public Spreadsheets: Avoid routing raw investor leads into a publicly accessible or unauthenticated Google Sheet without strict permission controls.

Step 2: Use a Secure, Access-Controlled CRM

Store all investor profiles and dinner RSVPs in a centralized CRM rather than email inboxes or local device files. Recommended CRMs: HubSpot (Free/Starter), GoHighLevel, or ActiveCampaign.

Role-Based Access Control (RBAC): Limit database access so that only authorized intake team members and your CFO can view contact records and financial tiers.

Two-Factor Authentication (2FA): Enforce mandatory 2FA on your CRM, Meta Business Suite, email provider (e.g., Google Workspace), and Framer accounts to prevent unauthorized access.

Step 3: Meta Lead Form & API Security (Meta Ads Manager)

If you gather leads directly inside Facebook/Instagram using Meta Instant Forms: Meta Conversions API (CAPI) / Zapier Integration: Route leads automatically from Meta into your secure CRM via an encrypted Zapier/Make integration rather than manually downloading CSV spreadsheets.

CSV Handling Protocol: If CSV files are ever downloaded from Meta Business Suite for phone screening, store them on an encrypted cloud drive (e.g., Google Workspace/OneDrive with 2FA) and delete the local file after import.

Step 4: Secure Communication Channels

Transactional SMS & Email: Use compliant automated platforms (Twilio, Klaviyo, HubSpot, or ActiveCampaign) for sending RSVP confirmations and reminders.

Email Security Protocols: Set up SPF, DKIM, and DMARC records on your sending domain. This prevents spammers from spoofing your domain and ensures your dinner invitations land directly in the primary inbox of busy executives.

Step 5: Data Retention & Cleanup Policy

Deletion Request Handling: Keep a dedicated operational inbox (admin.beautiful168k@gmail.com) monitored so that if a lead requests data deletion, you can remove them from your CRM within 30 days.

07. Your privacy choices

Depending on your location and applicable law, you may have rights to request access, correction, deletion, or other controls over personal information. The final policy must identify which rights apply, how to submit a request, any identity-verification requirements, and any applicable appeal process. Add a monitored privacy contact and appropriate advertising or tracking controls before the site begins collecting leads.

08. Security, contact & updates

Confirm the administrative and technical safeguards actually used to protect inquiry information; no online transmission or storage system can be guaranteed completely secure. Add the verified privacy contact above, document how changes to this policy will be communicated, and set an effective date after review. This draft should be reviewed by qualified counsel for the business’s actual practices and the jurisdictions it serves.