PRIVACY POLICY

Last updated: July 11, 2026

This policy explains what The Sure Foundation ("we," "us" — a trade name of The Sure Foundation Group LLC, an Arizona limited liability company) collects at thesurefoundation.co, what we deliberately do not collect, and what we do with the little we have. We built this product so that the most sensitive thing — your financials — mostly never reaches us at all.

1. The free scan: your financials stay in your browser

The free Self-Scan runs entirely on your own device. The revenue, cost, and other financial figures you type in are processed by code running in your browser and are never uploaded to, transmitted to, or stored by us. When you close the page, they're gone. We cannot see them, and we could not produce them to anyone because we do not have them.

2. What we do collect, exactly

a. Contact / lead form. If you choose to submit the contact form, we store: your name, business name, email, phone, your overall scan status (red/yellow/green), the names of your red/yellow pillars and top issue titles, which button you clicked to reach us, and a timestamp. We do not store your financial figures or dollar amounts — only the category labels above.

b. Saved reports (optional accounts). If you create an account and save a report, we store the CSV data you uploaded and a copy of your report with all dollar figures redacted. Saved reports are protected so that only your account can read your rows.

c. Paid engagements. If you buy a paid tier (e.g., the Real-Books Readout), you send us your actual accounting exports by email. Those are covered by your written engagement agreement (confidentiality, secure handling, and deletion terms), which controls for that data.

d. Email you send us. If you email info@thesurefoundation.co, we have that email.

e. Standard web logs. Like nearly every website, our hosting infrastructure keeps routine technical logs (such as IP address, browser type, and pages requested) to serve pages and maintain security. Form submissions and account features (saving reports) are processed on our servers and appear in those logs as ordinary web requests; the logs do not record your financial figures. Free-scan calculations never transit the server at all (§ 1).

f. QuickBooks Connect (optional, paid tier). If you choose to connect your QuickBooks Online account, you authorize us — through Intuit's official sign-in, on Intuit's own pages — to read your books. Unlike the free scan, this runs on our servers: with your authorization we pull your Profit & Loss and Balance Sheet reports (currently the last three full months; if we expand what we pull, we will update this policy first), run the diagnostic, and save the result to your account. What we retain: the summarized financial figures from those two reports, and a copy of your report with dollar figures redacted for on-screen display — both locked to your account like any saved report (§ 2(b)). What we do not retain: your QuickBooks login (we never see it — you sign in with Intuit, not with us) and the temporary access credentials Intuit issues us, which we use once for the pull and immediately discard. We keep no ongoing connection to your QuickBooks — we cannot pull again unless you connect again. You can also revoke the app's access at any time from your Intuit account settings, though there is nothing on our side to sever.

3. What we do NOT do

• No analytics, no ad pixels, no trackers, no marketing cookies. As of the date above, the site runs no analytics or advertising scripts of any kind. That's also why there's no cookie banner — there's nothing to consent to. If we ever add analytics, we will update this policy first and, where required, add a consent mechanism.
• We do not sell your data. Ever. We also do not share it with anyone for their own marketing.
• We do not run credit checks, enrich your data from brokers, or build advertising profiles.

4. Who touches the data we do hold (service providers)

We use a small number of infrastructure providers, each acting only on our instructions:

| Provider | Role | Location | |---|---|---| | Supabase | Database hosting for the lead table and saved reports (including QuickBooks-pulled report data) | United States | | Resend | Email delivery (e.g., sending us an alert when you submit the lead form) | United States | | Vercel | Website and server hosting; standard access logs (§ 2(e)) | United States | | Stripe | Payment processing for paid tiers — your card details go to Stripe, not to us | United States | | Intuit (QuickBooks) | If you use QuickBooks Connect (§ 2(f)), we pull your authorized reports from Intuit's API. You authenticate directly with Intuit; we never see your QuickBooks password | United States |

If we add or change providers, we'll update this table. We may also disclose information if the law genuinely requires it (e.g., a valid subpoena) — and if that ever happens, note that for free-scan financials there is nothing to disclose (§ 1).

5. How we use what we have

Only to: run the Service; respond when you contact us; deliver what you asked for (including following up on a scan you chose to share with us); invoice paid engagements; and keep the Service secure. That's the list.

6. How long we keep it (retention)

• Lead-form data: up to 24 months after our last contact with you, then deleted or anonymized.
• QuickBooks-pulled report data: same rule as saved reports — kept for as long as you keep your account, or until you ask us to delete it.
• Saved reports: for as long as you keep your account, or until you ask us to delete them.
• Paid-engagement books/files: governed by your engagement agreement — default is deletion within 60 days after the final deliverable, unless you ask us in writing to keep them.
• Email: retained in the ordinary course of the mailbox; included in deletion requests below.

7. Your choices: access and deletion

Email info@thesurefoundation.co and ask, and we will: tell you what we hold about you, correct it, or delete it — including your lead row, saved reports, and our mailbox copies — within 30 days, unless we're legally required to keep something (e.g., invoices for tax records). We extend this to everyone; we don't make you prove you live in a particular state.

8. Security

The lead table cannot be read through the public API at all (write-only by design); saved reports are locked to your account (row-level security); stored report copies have dollar figures redacted before storage; and the free scan's design (§ 1) means the most sensitive data never exists on our side. For QuickBooks Connect, the access keys (tokens) Intuit issues are held in server memory only for the seconds the pull takes, are never written to a database, a log, or a cookie, and cannot be recovered afterward — a compromise of our stored data cannot expose QuickBooks access, because no QuickBooks access exists at rest. (The separate one-time authorization code that starts the exchange appears in ordinary web logs like any page request; it is single-use, expires within minutes, and is useless without our server-held secret.) No system is perfectly secure, but our first control is not holding the data in the first place. If a breach ever affects your information, we will notify you as required by law.

9. Children

The Service is for business owners and is not directed to anyone under 18. We do not knowingly collect information from children under 13; if you believe a child has submitted information, email us and we'll delete it.

10. US-only service

The Service is operated from Arizona for United States businesses. If you use it from elsewhere, you understand your information (to the limited extent described above) is processed in the United States.

11. Changes to this policy

If we change what we collect or how we use it, we'll update this page and its "Last updated" date before the change takes effect, and give notice of material changes on the site (and by email where we have it).

12. Contact

The Sure Foundation · info@thesurefoundation.co

---

Last updated: July 11, 2026.

Questions: info@thesurefoundation.co · Terms of Use · Privacy Policy