Privacy notice

01 — Scope

This notice applies to the OmniLabs Systems Site, accessed via the Revenue Leak Scan diagnostic front door and related public pages, and to any submission made through the Request Scan form on those pages.

The Request Scan form currently runs in mock mode in every environment — local, preview and deployed. A submission is validated in the browser and written to the local browser console only. No payload is transmitted, forwarded, or stored anywhere.

The sections below describe the contracted behaviour that would apply if the server-side endpoint were enabled. Enabling it is a separate, reviewed decision that has not been taken.

02 — Data we may collect

The Request Scan form is contracted to accept the following fields and nothing else:

• businessWebsiteUrl — the public URL to be reviewed.
• workEmail — a reply channel.
• businessType — a routing taxonomy (high-ticket / local / B2B / agency / other).
• checkFirst — an optional free-text hint indicating what the operator would like the scan to check first.
• publicOnlyConsent — an explicit acknowledgement of the public-signal scan boundary.

When the form is submitted, the page also records standard acquisition context so we can route and reply to the request:

• UTM parameters from the URL (utm_source, utm_medium, utm_campaign, utm_content, utm_term) when present.
• The landing page URL the form was submitted from.
• The HTTP referrer header value, when the browser provides one.
• The browser user-agent string (server-side, alongside Cloudflare's coarse country flag).
• A server-generated request reference and submission timestamp.

The canonical contract for this form lives in src/lib/request-form.ts and is the single source of truth for the submission payload. The receiving endpoint (/api/request-scan) builds the record it would forward from that contract alone — any field outside it is discarded and never forwarded.

03 — Data we do not collect

The form does not request, and the prototype does not accept:

• phone numbers,
• any patient, medical, clinical, or other protected health information,
• internal-system credentials (CRM, ad accounts, analytics, payment processors, etc.),
• billing or payment information,
• self-reported revenue, traffic, or conversion numbers,
• government identifiers, financial accounts, or any other sensitive personal data.

Operators should not submit any of the above through the form. If a future iteration of the form needs to collect anything beyond the contracted fields, a new privacy notice will be written and reviewed before that change ships.

04 — Public-signal scan boundary

The external Revenue Scan reviews publicly observable signals only — information that is already visible to anyone on the open web at the URL the operator submits.

Internal impact (CRM behaviour, PPC quality, call handling, customer lifecycle, booking funnel completion, follow-up timing, paid media performance, internal staff workflows) cannot be verified from public signals alone. Verifying any of those areas requires explicit access to internal CRM, booking, call, PPC, analytics, or follow-up data — which is out of scope for this prototype and not requested by this form.

05 — How submitted data would be used

Once a production endpoint is approved, submitted data would be used only to:

• review the public surface of the submitted website,
• reply to the submitted work email with a diagnostic conversation proposal,
• route the request by business type for internal triage.

Submitted data would not be used to send unsolicited marketing, enroll the operator in any list or sequence without explicit consent, or be sold or licensed to any third party.

06 — Storage and retention

Submissions are forwarded to an internal intake destination immediately on receipt and retained only as long as needed to reply to the request and complete a diagnostic conversation. After that, submissions are archived or deleted. We do not maintain a separate long-lived marketing database from this form.

If you would like a submission to be deleted earlier, reply to the message we send back and request deletion. We will confirm in writing once the record is removed.

07 — Third parties

The site does not embed analytics, advertising pixels, chat widgets, or third-party tracking. Public pages do not automatically load fonts, scripts, images, or other assets from separate third-party domains; the web fonts are self-hosted and delivered with the site.

The site is served from Cloudflare Pages. When you submit the Request Scan form, the form's payload is sent to a Cloudflare Pages Function (/api/request-scan), which validates the submission server-side and forwards a sanitized copy to an internal intake destination over HTTPS. Cloudflare receives standard request metadata (IP-derived country, user-agent string) in the process of serving the request; the payload itself is not used by Cloudflare for any other purpose.

08 — Contact and updates

For privacy questions — including requests to access, correct, or delete a submission — reply to the address we use to respond to your request. Material changes to this notice will be recorded here with an updated "last reviewed" date in the page footer.