Privacy policy

Who we are

Fulcrum SaaS Inc. ("Fulcrum", "we") is the data controller for personal data described in this notice. We are registered at 250 Steele Street, Suite 375, Denver, CO 80206, United States.

For any privacy question, or to exercise the rights set out below, write to privacy@fulcrumsaas.com .

Two different roles

Fulcrum handles personal data in two distinct capacities, and it matters which one applies to you.

• As a controller - for visitors to this website. We decide what is collected here and why. That is what this notice covers.
• As a processor - for shoppers on a customer's store. When a retailer runs Fulcrum, we process their shoppers' data on their instructions and under our agreement with them. That retailer's own privacy notice governs it, not this one.

What we collect on this website

Information you give us

When you submit a form on this site, we collect what you type into it: your first and last name, work email, company, store URL, ecommerce platform, an approximate monthly traffic range, and any message you write. We also record that you ticked the consent box, and when.

Information collected automatically

• A hashed IP address. We never store your raw IP. It is combined with a secret salt and hashed one way with SHA-256 before it reaches anything we keep, which lets us rate-limit abuse without holding an identifier that points back to you.
• Your browser's user-agent string , and how long the form was open before you sent it.
• Referral and campaign information - the page you submitted from, the site that referred you, and any UTM or click-ID parameters in the URL when you first arrived. These are held in a first-party cookie called fulcrum_attribution that is discarded when you close the tab, and read only when you submit a form.
• An anonymous visitor identifier - fulcrum_csid , set by our own tracking and read when you submit a form. See our cookie policy .

How a submission is stored

This is worth stating plainly, because it decides the answers further down this page. There is no lead database. When you submit a form, the server composes an email containing what you sent and delivers it to a shared Fulcrum inbox. That email is the only record of your submission. Nothing is written to a data warehouse, and there is no separate system to query, export or reconcile.

What we do not collect here

This website does not take payments, so we hold no card or bank details from it. It has no user accounts and no login. It sets no advertising cookies, and no analytics cookies unless you accept them. We do not knowingly collect data from anyone under 16.

Why we process it, and on what basis

Purpose	Data	Lawful basis (UK/EU GDPR)
Responding to a pilot or pricing request	Form fields	Steps taken at your request prior to entering a contract (Art. 6(1)(b))
Following up about Fulcrum by email	Name, work email, company	Consent (Art. 6(1)(a)), which you may withdraw at any time
Preventing spam and automated abuse	Hashed IP, user-agent, challenge token, submission timing	Legitimate interests - keeping our systems usable (Art. 6(1)(f))
Knowing which campaigns and pages produce enquiries	Referral and campaign parameters, the page you submitted from	Legitimate interests - understanding our own marketing (Art. 6(1)(f))
Understanding which pages and campaigns work	Google Analytics identifiers and the pages you viewed	Consent (Art. 6(1)(a)), given through the cookie banner and withdrawable there
Keeping records of consent and enquiries	Consent flag and timestamp	Legal obligation and legitimate interests (Art. 6(1)(c), 6(1)(f))

Who we share it with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. Two service providers touch a form submission, and a third receives website analytics if you accept it. Each is under contract and each processes only what its function requires.

Provider	What it does	Where
Twilio SendGrid	Delivers the notification email that is the only record of your submission	United States
Cloudflare	Turnstile, the challenge that tells people from bots on our forms, and only where it is switched on	United States and global network
Google Analytics 4	Aggregate website analytics, and only where you have accepted it	United States

Everything else about this site runs on servers we operate. There is no advertising network and no data warehouse in the path, and no analytics provider at all unless you accept analytics cookies.

We may also disclose personal data where we are legally required to, or to establish or defend legal claims. If Fulcrum is acquired or merged, data may transfer to the acquiring entity; you will be told before that happens and before any new notice applies to you.

International transfers

Fulcrum is based in the United States and our providers process data there. Where we receive personal data from the UK, the EEA or Switzerland, those transfers rely on the European Commission's Standard Contractual Clauses together with the UK Addendum, and we assess each provider's safeguards before using it. You can request a copy of the relevant clauses from privacy@fulcrumsaas.com .

How long we keep it

Because an enquiry exists only as an email, retention here means how long that email stays in the inbox and in the mailbox's backups.

Record	Retention
Enquiry emails from people who do not become customers	24 months from your last contact with us
Enquiry emails from people who become customers	For the life of the relationship, then 7 years for tax and contractual records
Consent flag and timestamp	Held inside the same email, so as long as we rely on the consent, plus 3 years
Hashed IP and anti-spam signals	Held inside the same email and nowhere else, so they follow that email
Web server and application logs	30 days
The attribution cookie in your browser	Until you close the tab
The analytics cookies in your browser	Up to 24 months, and only if you accepted analytics

Your rights

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time without affecting what we did before you withdrew it.

Exercise any of these by emailing privacy@fulcrumsaas.com . We respond within 30 days, and we will not charge you or treat you differently for asking. If we cannot identify you from what you send, we may ask for enough information to verify the request, and we will not use it for anything else.

One practical consequence of holding no lead database: we answer an access request by searching the shared inbox for your email address, and we meet an erasure request by deleting the emails we find. That is the whole of it.

Region-specific rights, including California and Colorado consumer rights and the right to complain to a supervisory authority, are set out in full on our GDPR and CCPA page .

Cookies

Apart from the analytics cookies you can accept or decline, this site sets only first-party cookies that keep it working, and no advertising cookies. What each one does, how long it lasts, and how to clear it are covered in the cookie policy .

Security

This site is a single Go server that renders every page and handles its own forms in the same process. Your browser posts a form back to the page it came from; there is no separate forms service and no cross-origin request. Traffic to the site and its forms is encrypted in transit.

Enquiry data is not written to a database, which removes a stored copy that would otherwise need protecting. Credentials, including the salt used to hash IP addresses, are held in the server's environment rather than in code or configuration files, and access is limited to the people who need it. No system is perfectly secure, and we do not claim otherwise, but we would rather describe what we do than make a general assurance.

Changes to this notice

When this notice changes we update the date at the top. If a change materially affects how we use data you have already given us, we will contact you directly rather than rely on you noticing.