Privacy / lead processing notice
Clear context, limited use.
This operational notice describes the current enquiry and business-lead system. A legally reviewed policy, retention schedule, lawful-basis assessment, and verified privacy contact must replace or supplement it before production discovery is enabled.
Directly supplied information
Project, contact, callback, and free-audit forms collect only the visible fields, consent state, submission timing used for spam protection, originating page, allowlisted campaign attribution, and validated Lab context. Raw IP addresses are not stored by the rate limiter; a keyed hash is used.
Public business information
If production discovery is approved and enabled, Kurbs may retain limited professional/business contact information and opportunity evidence explicitly published on an eligible business website, original public source, or returned by an authorized provider. Kurbs does not use this system to identify anonymous visitors, access private pages, or guess personal contact details.
How it is used
Information is persisted so Kurbs can prepare a requested audit, review and respond to enquiries, create or merge an internal lead, prevent duplicates, assign follow-up, respect suppression, and send transactional messages. It is not a contract, guaranteed engagement, or permission for automated bulk outreach.
Free website audit
The supplied public website is checked by a bounded, non-intrusive quality auditor. It checks availability and visible page signals; it does not exploit vulnerabilities, scan ports, or access private systems.
Optional marketing
Marketing consent is separate, optional, and unchecked by default. Enquiry or audit submission does not automatically subscribe a visitor to marketing.
Providers and provenance
Transactional messages use the configured email abstraction, initially Brevo. Optional Brave discovery and Hunter verification remain server-side. Lead evidence records its original source so the team can assess legitimacy and honor source restrictions.
Opt-out, suppression, and retention
Kurbs Control can mark a business contact Do Not Contact and suppress its normalized email, phone, or domain from future active discovery. A production retention period, request process, and verified privacy contact are not yet approved; public discovery must remain disabled until these and the final policy receive review.