Privacy Policy

1. What we collect

Account information

When you or your business has a Potcake account: your name, email address, a securely hashed password (we never store the password itself), the businesses your login can see, and sign-in times.

Business information you give us

Your business name, website addresses, competitors, the buyer questions to check, logos, social profile links and notes, plus anything you add to your action plan. This is information about a business, but it can include names or contact details if you choose to enter them.

Data from services you connect

If you connect a service such as Shopify, Google Analytics, Google Search Console, Google Ads, Google Merchant Center, Klaviyo, Meta, TikTok or Pinterest, Potcake reads it with read-only access and saves totals only: for example revenue, order counts, visits, searches, list sizes and campaign results. Potcake does not store your customers’ names, email addresses or postal addresses. The keys or sign-in tokens you give us for these connections are kept on our server and used only to read that data. You can disconnect a service at any time.

Website and AI analysis

Potcake reads the public pages of the websites you ask it to check, and saves the answers AI assistants give to your buyer questions. These come from public sources and describe businesses, not individuals.

The Potcake tag

If you add the Potcake tag to your website, it counts page views and visits that arrive from AI assistants, and counts leads such as forms sent or booking links clicked. It sets no cookies and stores no IP addresses, device identifiers or personal information about your visitors, and it never reads what a visitor types into a form.

Forms on our public pages

The free website check asks for your name, company, website and work email. The Extended Team contact form asks for your name, work email, company, website, team size and a message. For both we also record the date and your IP address to prevent abuse and enforce limits (for example one free check per business every 60 days).

Payments

Subscriptions are paid through Stripe. Your card details go directly to Stripe; we receive only what we need to manage your subscription, such as your plan, billing status, billing email and the last four digits of your card.

Technical information

Our servers keep standard logs (IP address, browser type, pages requested and time) to keep the service secure and working.

Business prospect research

When M38 Partners provides prospect research to a client, Potcake may gather publicly available business information about companies and, through Hunter.io, publicly listed work email addresses for people at those companies.

2. How we use it

• To provide Potcake: run checks and audits, build reports and action plans, and show results to the people you give access to.
• To email you your results, account notices, password and invite links, and billing messages.
• To reply to free check and Extended Team requests. If you request a free check, M38 Partners may email you about your results.
• To keep the service secure, prevent abuse and enforce plan limits.
• To fix problems and improve Potcake. Where we study usage, we use aggregated or de-identified information.
• To meet legal, tax and accounting obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

3. AI services

To check how AI assistants describe your business, Potcake sends your buyer questions and the business information needed to answer them (such as your business name, website and competitors) to AI providers through their business APIs: OpenAI (ChatGPT), Anthropic (Claude), Perplexity and Google (Gemini), and to SerpApi for Google’s AI Overviews and AI Mode. Potcake also uses Anthropic’s Claude to write parts of reports, FAQs and plans from your results. These providers process the data under their own API terms. Please don’t put personal information about your customers into buyer questions or notes.

4. Who we share it with

We share personal information only with the service providers that help us run Potcake, only for that purpose, and with people you invite to your account.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger, sale or reorganization of our business, in which case this policy continues to apply.

5. Cookies

Potcake uses essential cookies and similar storage to keep you signed in, to secure the service, and to remember your choices. On our public pages only, and only if you accept, we use Google Analytics to understand visits and purchases; Google Signals and ad personalization are off, and it never runs inside account dashboards. We use no advertising cookies. Details are in our Cookie Policy.

6. How long we keep it

• Account and business data: while your account is active. After you cancel, we delete it within 90 days unless you ask us to delete it sooner or the law requires us to keep it.
• Free check and contact requests: up to 2 years, so we can follow up and apply the free-check limit, unless you ask us to delete them sooner.
• Billing records: as long as tax and accounting law requires (generally 7 years).
• Backups: daily server backups are kept for 14 days, then overwritten.
• Server logs: up to 90 days.

7. Security

Potcake is served only over encrypted HTTPS connections. Passwords are stored as one-way hashes, access to our servers is restricted to M38 Partners staff who need it, and each customer can see only its own business data. No system is perfectly secure; if a breach affects your personal information, we will notify you as the law requires.

8. Your choices and rights

You can ask us to tell you what personal information we hold about you, give you a copy, correct it, or delete it. Account holders can also download their business data from within Potcake. You can unsubscribe from marketing emails with the link in any of them; account and billing messages will still be sent while you have an account.

Depending on where you live, including California and other US states with privacy laws, you may have additional rights, such as to opt out of the sale or sharing of personal information (we don’t sell or share it), to limit use of sensitive information (we don’t collect it), and not to be treated differently for using your rights. To make a request, email together@m38partners.com. We will confirm your request and answer within 30 days, or within the time your local law allows. You may use an authorized agent; we may ask for proof of their authority and verify your identity.

9. Children

Potcake is a business service for adults. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

10. Where data is processed

Potcake is run from the United States, and your information is stored and processed in the United States. If you use Potcake from another country, you understand your information will be transferred to the United States.

11. Changes to this policy

If we change this policy we will update the effective date above. For material changes, we will tell account holders by email or in Potcake before the change takes effect.