Privacy

In force from 10 September 2026.

The short version. This site loads no third-party scripts, sends nothing to an analytics or ad-tech company, and sets no cookies at all. What it collects is what you type into the order form, which ad or link brought you here, and how far down this page you read — that last one measured by our own server, storing nothing on your device and attaching nothing that identifies you. That goes to one place: a message to the person who writes your report. Your card details never touch this site — Stripe collects them directly. If you buy, our server tells Meta that a sale happened, using a one-way hash of your email rather than the address itself.

1. Who is responsible

The data controller is Volodymyr Holovachov, a sole trader registered in the United Kingdom, trading as Adracle.

8 Cedar Court, West Way, Oxford, OX2 0JE, United Kingdom · stan@99rabbits.com

2. What is collected, and why

What	When	Why
Your email address	Order form, and again at Stripe’s checkout	To send your receipt and your report, and to reply to you
Your brand or site, your three competitors, your target market, and anything you add in the optional box	Scoping form, after payment	It is the order — without it there is nothing to analyse
A payment reference we generate (`adr_…`) and, after checkout, Stripe’s session id	Automatically	To match your scope to your payment without keeping a database
Campaign tags in the link you arrived on (utm_source and similar) and the referring page	Automatically, on arrival	To know which ad or link works. Not linked to anything you do later on other sites
How far down this page you scrolled, and how long it was in front of you	Automatically, once, as you leave the page	To tell an ad that brings people who never read the page from an offer that fails to convince — they need opposite fixes. Anonymous: nothing is stored on your device, and nothing links this to another visit
The country your request came from	Automatically, added by our host	To know which markets respond

No card details are collected by this site. They are entered on Stripe’s own page. We never see or store a card number.

The order form contains one hidden field that a person never sees. Anything submitted in it is treated as automated spam and discarded without being delivered anywhere.

3. Who else sees it

Five companies receive some part of it, and no one else — the first four as processors acting on our behalf, Meta only as described:

Vercel — hosts the site and runs the form endpoint. Their request logs briefly hold the technical details of your visit.
Stripe — takes the payment and emails your receipt. Stripe collects your card details and email directly and is the merchant of record’s payment processor.
Telegram — this is the unusual one, so it is spelled out. When you submit either form, the contents are sent as a message to a private Telegram chat, so that a person is told immediately rather than a queue being polled. That message contains your email and your scoping answers.
99rabbits — writes the analysis under contract.
Meta — only if you buy, and only then. When a payment succeeds, our server sends Meta a one-way SHA-256 hash of your email address, the amount and the currency, so that we can tell which ads produced sales. It is sent from our server, not from your browser: nothing belonging to Meta runs on this page, and a hash is not an address. Nothing at all is sent for people who do not buy.

Nothing is sold or rented, and nothing goes to data brokers. There is still no ad-tech on this site — the one thing an advertising platform receives is the purchase hash described above, sent by our server after you have bought something.

Some of these process data outside the UK and EEA. Where they do, they do so under the transfer safeguards in their own terms.

4. Storage in your browser

No cookies are set by this site. Two entries are written to your browser’s sessionStorage, which is per-tab and is cleared when you close it:

adracle_order — your email and payment reference, so the screen after checkout does not have to ask you for them again.
adracle_attribution — the campaign tags from the link you arrived on.

The reading measurement in §2 deliberately touches none of this. It reads no cookie and no sessionStorage entry, and it writes nothing — it takes the campaign tags from the address bar instead. That is a design constraint rather than an accident: storing or reading anything on your device for that purpose would require your consent, and this page would need a cookie banner. It does not.

Both stay in your browser until they are sent with your order or the tab is closed. Stripe sets its own cookies on Stripe’s pages, under Stripe’s policy.

5. Legal basis

Performing our contract with you — your email, your scoping answers, and the payment reference. We cannot deliver a report without them.
Our legitimate interests — being alerted that a checkout has opened, knowing which ad brought you, knowing whether this page was read or abandoned, and telling Meta that a sale happened so that the advertising can be judged. The interest is running a small business that answers people quickly and does not waste money on ads that do not work. It is balanced against you by collecting no behavioural profile, running no third-party trackers on this site, storing nothing on your device for the reading measurement and attaching no identifier to it, sending Meta a hash rather than your address and only once you have bought, and never combining this with data from anywhere else.
Legal obligation — keeping records of a sale for tax and accounting.

6. How long it is kept

Order and payment records — six years after the end of the relevant tax year, which UK law requires.
Your report and our correspondence about it — the same period, so a question years later can still be answered.
The Telegram notification — until deleted from that chat. Ask and it will be deleted.
Host request logs — a short period set by Vercel, not by us.
Campaign tags — kept only inside the notification above; there is no separate analytics store.

7. Your rights

You can ask for a copy of what we hold, ask for it to be corrected, ask for it to be deleted, ask us to restrict or stop using it, and ask for it in a portable form. Where we rely on legitimate interests you can object, and we will stop unless there is a compelling reason not to.

Write to stan@99rabbits.com. There is no ticketing system between you and a person here.

If you are unhappy with how we respond, you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to the supervisory authority where you live.

8. Changes

If what we collect or who receives it changes, this page changes in the same release, and the date at the top moves. It is not a document that gets updated later.