Privacy notice

IfOnly provides software that lets businesses ask visitors what would make them buy, and contact those visitors later with their consent. This notice explains what data is processed and why.

Who is responsible

For visitor requests, the business that owns the request page decides why and how your data is used; IfOnly processes it on that business’s behalf. For business accounts, IfOnly is responsible. [Legal entity and contact details to be added.]

Data we process

• Business accounts: name, work email, password (stored hashed by our authentication provider), workspace settings and billing status.
• Visitor requests: the request text, optional budget, timing and first name, the page it was submitted from (with sensitive URL parameters removed), and the contact channel you chose.
• Consent records: what you agreed to, when, and any later unsubscribe or withdrawal.
• Delivery records: whether a notification was accepted, delivered, failed or clicked.

Why

• To let the business see your request and, if you consented, notify you about it.
• To verify your contact details and honour unsubscribes and suppressions.
• To operate, secure and bill the service.

What we don’t do

• We don’t sell personal data or share it between businesses.
• We don’t link your email and phone number unless you confirm both through a secure flow.
• We don’t include personal contact information in analytics.

Service providers

We use providers for hosting and database, email delivery, WhatsApp messaging and payments. They process data only to provide their service. [List of providers and transfer safeguards to be completed.]

Your choices

Every request comes with a private management link where you can view or withdraw it, unsubscribe from that request or from the business entirely, and delete your contact information. WhatsApp recipients can also reply STOP.

Retention

Requests are kept while the business’s workspace is active, unless you withdraw or delete them sooner. Deleting your contact information removes it from active tables and cancels queued messages; copies held by delivery providers are subject to their own retention limits. [Retention periods to be confirmed.]