Privacy Notice

This notice covers the public Sum & Signal website, the private customer portal, and the bookkeeping service. It does not replace a bank's, payment provider's, identity provider's, or other third party's privacy notice.

1. The current dogfood boundary

• The only customer is Future Perfect LLC, operated by its owner.
• The private portal is protected by Cloudflare Access.
• Source records are uploaded as PDF or CSV files through that portal.
• The private application, Magpie accounting engine, and JayBase event store run on a Future Perfect managed Vultr host.
• Public checkout, live Stripe processing, bank connections, transactional email, and outside-customer invitations are disabled.
• No external AI or model provider receives customer financial information during dogfood.

We will update this notice before activating a disabled provider or opening the service to another customer.

2. Information we process

Public website

The public fit check processes answers long enough to return a result. The Sum & Signal application does not save those answers or ask for a name, email address, bank login, account number, statement, or payment.

The application retains only:

• the date, eligible/ineligible result, and allowlisted campaign tags as aggregate counts; and
• for abuse prevention, a coarse one-of-4,096 bucket derived from the request address, the latest rate-limit window, and a count. The raw address is not stored in that application table.

OpenAI and Cloudflare may process ordinary hosting, request, device, network, and security metadata while delivering and protecting the public site. We do not use advertising pixels or cross-context behavioral advertising.

Private portal and bookkeeping

For the owner dogfood account, we process:

• account identity, email address, business profile, onboarding answers, and access records;
• official statements, transaction CSVs, dates, descriptions, amounts, balances, account labels, and source-file metadata;
• bookkeeping rules, chart mappings, owner classifications, corrections, approvals, reconciliation results, ledger events, and close packages;
• support, export, cancellation, deletion, and other account requests, if made; and
• security, malware-scan, audit, delivery, backup, restore, health, and incident events, with financial content excluded from operational logs where practical.

Source files can contain personal information about the owner, customers, vendors, payees, or other people. We do not need online-banking passwords. Do not upload credentials, tax identifiers, health information, or unrelated personal records unless we specifically request a record through the private portal.

Payments if customer checkout later opens

Stripe is disabled for owner dogfood. If checkout later opens, Stripe will host the payment form under its own privacy notice. Sum & Signal expects to receive an email address, Stripe customer, session, and subscription references, payment status, billing events, and limited fraud or dispute information—but not the full card number. This is a planned boundary, not a statement that live payments are enabled.

3. Why we use information

We use information only as reasonably needed to:

• operate the site, return a fit result, prevent abuse, and measure aggregate outcomes;
• authenticate and authorize the owner;
• receive, inspect, malware-scan, encrypt, and organize source records;
• create, review, reconcile, correct, close, and export the books;
• preserve provenance, approvals, audit evidence, and service integrity;
• secure, monitor, back up, restore, troubleshoot, and improve the service;
• respond to account and privacy requests; and
• meet legal obligations, resolve disputes, and protect the service and others.

We do not sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

4. Automated and AI processing

Current dogfood processing uses deterministic code for access control, file inspection, bookkeeping state transitions, posting constraints, reconciliation, and close evidence. Customer files and transaction descriptions are treated as untrusted data, not instructions.

The codebase contains a disabled, review-only model boundary for possible future use. It is designed to receive minimized transaction facts and approved account labels, propose a classification or owner question, and require owner review. It cannot post, reconcile, or close the books. No external model provider is active for dogfood. Before one is enabled, we will review and disclose its data use, retention, location, subprocessors, security, and training terms.

5. Service providers and disclosures

OpenAI Sites

Hosts and maintains the public site and can process public-site content, ordinary request/device/usage metadata, and the aggregate fit-check application data.

Cloudflare

Provides DNS, TLS, edge protection, public application storage, private-portal authentication, and configured off-host backup storage. It can process request/device/security metadata, fit metrics, rate-limit state, owner email and Access session data, and application-encrypted backup objects when backup upload begins.

Vultr

Hosts the private application, encrypted source storage, control data, Magpie, and JayBase and therefore hosts the scoped private-portal and bookkeeping information described above.

Cloudflare R2 is configured as a private bucket with a western North America location hint. That hint is not a legal data-residency or jurisdiction guarantee. The application encrypts and authenticates backup objects before upload. The first complete off-host customer backup is still gated on the first canonical dogfood ledger event.

The local ClamAV scanner, Magpie, JayBase, and local monitoring tools are self-hosted components, not additional outside recipients. No bank connector, transactional-email provider, external monitor, or model provider is active for customer data during owner dogfood.

We may disclose information to confidential professional advisers, to comply with valid legal process, to investigate fraud or security incidents, or in a financing or business transfer subject to appropriate confidentiality and notice where required. Provider infrastructure can involve processing in the United States or other countries where a provider operates; this draft does not promise a particular processing jurisdiction.

6. Cookies and authentication

The public fit check does not set a Sum & Signal analytics or advertising cookie. Cloudflare may set its __cf_bmpublic-edge security cookie when its bot-management service protects a public page. Cloudflare controls that strictly necessary cookie; Sum & Signal does not use it for analytics or advertising. The Cloudflare Turnstile bot-check is not loaded while checkout is closed. If checkout opens, Turnstile's token and request/device-signal processing will be disclosed here first.

The private portal uses Cloudflare Access cookies that are necessary to authenticate the owner and maintain a protected session. They can contain signed identity and authorization information. The portal also uses a per-session anti-forgery token for forms; it is not used for advertising or analytics. Global Privacy Control does not change current site behavior because there is no sale or behavioral-ad use.

7. Retention, export, and deletion

• Fit-check answers are discarded after the immediate response.
• Aggregate fit counts remain only while useful for measuring the offer and are not used to create individual profiles.
• Coarse rate-limit state keeps the latest window and count until its bucket is overwritten or the table is purged.
• The draft target for ledgers, source records, and close packages is the service term plus 30 days.
• The draft target is seven years for agreement/payment evidence and 24 months for security/access records.
• Configured R2 lifecycle rules expire daily backup objects after 35 days and monthly backup objects after 365 days.

Legal holds, security investigations, fraud prevention, disputes, or accounting, tax, billing, and other legal obligations can delay or limit deletion of affected records. The intended portable export uses documented JSON, CSV, source-file, close-package, and append-only ledger formats with integrity evidence and does not require the original model or a proprietary bookkeeping app to read it.

8. Security

Current safeguards include HTTPS, Cloudflare Access, an explicit owner-to-tenant identity map, encrypted source and delivery envelopes, scoped credentials, private network boundaries, malware scanning, authenticated ledger history, redacted operational evidence, application-encrypted backup tooling, and tested recovery procedures. The first complete live customer backup and restore proof remains subject to the first canonical dogfood ledger event. No storage or transmission method is completely secure. If an incident creates a notice obligation, Future Perfect will notify affected people and authorities as required by applicable law.

9. Your choices and responsibilities

You may ask us to describe, access, correct, export, restrict, or delete information associated with you, or cancel the service. We verify the requester and respond as required by applicable law and the current agreement, subject to the retention exceptions above.

If a source concerns another person, the customer is responsible for having authority to provide it and for using the service lawfully. Sum & Signal is intended for business owners and is not directed to children under 18.

10. Changes and contact

We will version this notice and post a revised effective date when practices materially change. Planned features are not current data practices. Before outside-customer checkout opens, the notice will identify every active material provider and contain counsel-reviewed retention and contact details.

For a privacy question or request, email kyle@futureperfect.work. Do not send statements, account numbers, credentials, or other financial records by email; use the private portal.

Mailing address: To be added before outside-customer launch.