Collect the signal. Minimize the person.

1. Status and scope

This notice covers the Demand First pre-launch website and, only after the production gate is deliberately opened, the founding fit-review queue. It does not yet describe an automated demand-testing platform, billing system, or live marketplace because those systems have not been launched.

The site is intended for adults acting in a professional or entrepreneurial context. It is not designed for children, and Demand First should not knowingly collect children's data.

2. Data the beta may collect

Experiment submissions

An idea description, intended audience, problem, selected markets, charging model, expected price if supplied, applicant role, prior B2B build experience, decision window, purchase authority, funding readiness, founding-offer acknowledgement, email address, terms acknowledgement, and submission time.

Opportunity Lab

The noindexed prototype may record controlled page and interaction events. It does not currently expose an opportunity-access email form, payment, reservation, claim, or rights transfer.

Behavioral and technical context

Page and interaction events, an anonymous session identifier, campaign message variant, fixed founding-offer variant, broad device/viewport class, referrer host, landing page, and first- and last-touch campaign parameters such as UTM source, medium, campaign, and content.

3. How data is intended to be used

• review and respond to genuine beta submissions;
• measure whether repeat B2B builders invest effort in the founding offer;
• compare campaign-level positioning and the fixed founding-offer funnel at an aggregated level;
• protect the forms and service from abuse;
• maintain records of founding-offer selection and terms acknowledgement; and
• meet legal obligations that apply to the eventual operator.

Email collected for a founding fit review should be used to respond to that request. Broader marketing should require a separate, unbundled choice where applicable.

4. Behavioral analytics boundaries

The analytics design should answer funnel questions without copying sensitive form content into an analytics provider. Raw idea text, problem text, custom audience descriptions, email addresses, authority or funding answers, and arbitrary search strings must not be included in behavioral events.

Step events may contain safe categories or coarse measures such as text-length buckets, selected market codes, monetization type, controlled applicant segment, step number, validation-error count, and the fixed offer variant. Automatic session recording and broad autocapture should remain disabled.

Campaign message continuity and privacy-safe application progress may use limited first-party browser storage. Any storage or analytics requiring consent in a visitor's jurisdiction must remain off until the appropriate choice has been obtained.

Behavioral analytics is also disabled by a separate production master switch until the operator has approved the controller, purposes, legal bases, consent posture, processors, retention, and international-transfer treatment. While that switch is off, Vercel Web Analytics, Speed Insights, Plausible, Google Analytics, first-party behavioral events, and server completion events do not run.

The current prototype uses one first-party campaign message-variant cookie for up to 30 days. It contains no name, email, submitted idea, or browsing history. Opportunity-price assignment is paused, the current proxy creates no price-cohort cookie, and the paused Opportunity Lab keeps no cross-session view history or repeat-interest record.

Google Analytics 4 is optional and remains completely unloaded unless the production master switch is approved and a visitor then chooses “Allow Google Analytics” in the analytics prompt. When enabled, it receives query-free page views, standard technical context, and the same controlled, non-text intent events described above, and may set Google's first-party analytics cookies. A visitor can reopen Analytics settings from the footer and stop future Google Analytics collection. The submitted idea and contact record remain separate.

5. Service providers and disclosure

Data may be processed by vetted providers needed for hosting, secure form storage, analytics, email delivery, abuse prevention, and operational support. The final provider list, processing locations, and contractual safeguards must be published before collection begins.

The intended launch stack includes Vercel for hosting, aggregated Web Analytics, and performance measurement; a managed PostgreSQL or controlled webhook service for submissions; and optionally Plausible for richer privacy-conscious funnel analysis. Google Analytics 4 can optionally be enabled after an explicit visitor choice for free funnel and acquisition analysis. Behavioral analytics and contact records are deliberately kept separate.

Submitted email addresses and raw idea descriptions must not be sold as opportunity data or exposed in the prototype lab. The founding sprint is intended to keep project-specific evidence outside a future market; access, aggregate learning, publication, and retention require the written scope and separately agreed Demand Test terms.

6. Retention and security

Personal data should be retained only for the documented beta purpose, legal obligations, and a defined deletion window. Raw submissions should be kept out of URLs and analytics payloads, protected in transit and at rest, and limited to people who need them for beta operations.

No internet service can promise absolute security. Demand First must document retention periods, access controls, deletion routines, incident handling, and backup treatment before production collection.

7. Your choices and rights

Depending on location, a person may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, and to withdraw consent where consent is the basis used. Withdrawing consent does not invalidate prior lawful processing.

A verified request channel and identity-check process must be available before launch. People should also be able to unsubscribe from optional marketing without affecting an experiment request.

8. International use

Demand First is intended for a global audience. If personal data moves outside a person's country or the European Economic Area, the operator must identify an applicable transfer basis and disclose relevant safeguards. The specific arrangements are not yet finalized.

9. Contact and complaints

Before public collection, this section must identify the legal operator, postal address, verified privacy contact, relevant representative where required, and how to complain to an applicable supervisory authority.