Privacy policy
Status: placeholder draft, October 27, 2026. Operator: [COMPANY LEGAL NAME] (placeholder, not set), using the brand App Villain. Mailing address: [PHYSICAL ADDRESS] (placeholder, not set). Contact email: hello@appvillain.com (placeholder, mailbox not set up).
What this page covers
This page covers the pilot application form on this marketing site. App Villain CRM is in pilot and is not for sale. This site is not the CRM product, and it does not hold your client list.
What the form collects
If you submit the application, we store these fields:
- Full name
- Business name
- Work email
- Website, if you enter one
- Trade or industry
- Team size
- Tools you use today for clients and leads
- Approximate monthly software spend, if you select one
- What you would most like to own, and any optional detail
- How you'd want to run it, if you select one
- Biggest follow-up or client-tracking headache, if you write one
- Whether you are open to a 20-minute research call
- That you consented to be contacted about the pilot
- The time the application was received
- The browser's user agent string, shortened if it is very long
We also store a SHA-256 hash of your network address combined with a secret that stays on the server (IP_HASH_SALT). We do not store the network address itself. The hash is used only to slow down repeated submissions. If that secret has not been set, we do not store a network address at all.
The form includes a hidden fax field that people do not see. If that field is filled in, we treat the submission as automated, we do not store the application, and we do not keep what was typed there.
What we do not collect
- No third-party analytics, advertising, or tracking pixels
- No fonts or scripts loaded from another site
- No payment card data. Applying is free.
- No account password. This form does not create a login.
The public pages do not set their own cookies. The savings calculator runs in your browser and does not send those numbers to us. The admin area may sit behind Cloudflare Access, which sets its own login cookies for the operator. Those cookies are not used on the public application form.
Where it is stored
Applications are stored in a Cloudflare D1 database named appvillain-pilot, in the Cloudflare account that hosts this site. The table is called applications. A separate request_log table stores the time and the network-address hash used for rate limiting, and old rows there are deleted after about two days. Cloudflare is the hosting provider. Their subprocessors apply to that service. We do not sell this information and we do not use it for ads.
We use the application to decide whether a pilot conversation is a fit and to contact you about that. We do not use it to train a public model.
How long we keep it
Applications are kept so we can review them during this validation phase, then deleted. Counsel has not set a fixed retention period yet. That period will be added when this placeholder is replaced.
How to request deletion or a copy
Email hello@appvillain.com (placeholder, mailbox not set up) with the subject "Deletion request" or "Access request" and the email address you used on the form. When that mailbox is live, we will delete the matching rows from the applications table, or send you a copy, and reply. Until the mailbox exists, that address is not a working inbox.
The operator can also delete a row directly. From a machine that holds the Cloudflare credentials:
npx wrangler d1 execute appvillain-pilot --remote --command "DELETE FROM applications WHERE email = 'person@example.com'"
Replace person@example.com with the address on the application. That command removes the stored application. It does not remove a network-address hash that may already have aged out of request_log.
Children
This site is for people who run a small business. It is not directed at children.
Changes
This text is a placeholder. The version that replaces it, after attorney review, will be dated. The form will keep linking here.