Privacy Policy

Contact details you submit (name, email, company), usage analytics on this website, and, only within a contracted audit, read only marketing and revenue data you explicitly grant access to.

• To respond to enquiries and deliver contracted audits.
• To give you the specific materials you request (e.g. the sample report) and to follow up on that request. No automatic newsletter enrolment.
• To improve this website via aggregated, anonymized analytics.
• With your consent, or in the United States unless you opt out, to measure our advertising and to show MarginFix ads on Facebook and Instagram to people who visited this site.

Audit files are maintained in MarginFix’s local working environment. Anonymized audit information is processed through the Claude API to assist analysis. Client data is not used for model training. A senior auditor reviews and approves every finding.

Access is read only and is revoked at your readout. Audit data is shared only with the processors listed in this policy, under contract, and is never sold. Working data is deleted from our systems within 30 days of engagement close, on the schedule below. Details, including the subprocessor table, are on the data security page.

• Audit access: revoked at the readout; any follow on work needs a new authorization.
• Audit working data (raw exports, working files, prompts, drafts and our copy of the final report): deleted from our active systems within 30 days of engagement close, after your copies are delivered. Close means delivery or readout, or cancellation; a written extension names its purpose and its deletion date.
• Backups: audit content is kept out of routine backups where we can; where a backup exists it is purged by 90 days after close, access to it is restricted, and deletions are reapplied after any recovery.
• Provider copies: governed by the provider terms and their deletion mechanisms; deleting our copy does not by itself delete a provider’s.
• Enquiries that do not become engagements: deleted after 12 months without meaningful contact, or earlier on request.
• Contracts, NDAs, invoices and payment records: kept for seven years, subject to the requirements that actually apply to us; raw datasets and report content are never part of this record.
• Disputes and legal holds: only the necessary records, access restricted, reviewed periodically and deleted when the reason ends.

Deletion requests: write to audits@marginfix.ai. We acknowledge within two business days, verify your identity in proportion to the request, and aim to complete within 30 days, subject to the deadlines and lawful exceptions above. We keep a minimal log of each deletion (engagement reference, categories, date, reviewer and any exception), never a copy of what was deleted. Where audit data is processed on a client’s behalf, individual requests are routed through that client where appropriate.

You may request access, correction, export or deletion of your personal data at any time: audits@marginfix.ai. California residents: under the CCPA/CPRA you may also opt out of “sale” or “sharing” of personal information (we do not sell it for money, but the advertising and analytics technologies described below may count as “selling” or “sharing” under these laws. Outside the United States they run only after you accept optional cookies. In the United States they run by default, and the “Do not sell or share my personal information” link in the footer opts you out on that browser; choosing Reject or withdrawing consent in Cookie settings does the same elsewhere; if your browser sends a Global Privacy Control signal, we treat it as that opt out, so the advertising tags stay off even if you accept and only analytics runs), and you will never be discriminated against for exercising these rights. Residents of Virginia, Colorado, Connecticut and other states with comprehensive privacy laws (VCDPA, CPA, CTDPA and successors) hold equivalent rights of access, correction, deletion and opt out; the same email honors them all, regardless of your state. EU/EEA visitors retain their GDPR rights, including lodging a complaint with a local supervisory authority.

Outside the United States, on your first visit, a consent banner lets you accept or decline nonessential cookies, with equal prominence for both choices. Essential cookies (session, security, consent memory) always run. Analytics and advertising technologies load only after you consent, and you can change or withdraw your choice at any time via the “Cookie settings” link in the footer. We record your consent (choice, timestamp, banner version) as the CCPA and GDPR require; your choice is stored for 12 months.

Visitors in the United States see no banner: the analytics, session recording and advertising technologies listed below run by default. Some US state privacy laws treat this advertising use as “selling” or “sharing” personal information. You can opt out at any time with the “Do not sell or share my personal information” link in the footer, which turns analytics and advertising off on that browser and keeps your choice for 12 months. If your browser sends a Global Privacy Control signal, we treat it as an opt out of advertising automatically, and you see the banner instead. To tell which applies, we look up your country once and keep only “US” or “not US” in an essential cookie for seven days.

On our landing pages we also count page loads, per day, per page and per campaign, so we can tell whether an advertising campaign brought anyone here. This count uses no cookie and stores nothing on your device. It keeps a number, not your IP address, a click identifier or anything else that points to you, so it runs without the banner.

With your consent, or in the United States unless you opt out, we use the following third party technologies. Each receives usage data (pages viewed, events such as estimator use or booking steps, approximate location, device information) and sets cookies or similar identifiers:

• Google Analytics 4 (Google Ireland Ltd.): site analytics. IP addresses are truncated/not logged by GA4 design; we have a data processing agreement with Google and do not enable Google Signals without separate consent. Opt out any time via cookie settings or the Google Analytics opt out add on.
• Google Ads (Google Ireland Ltd.): conversion measurement for our search ads. When you request an audit or book a call, our Google Ads tag reports it to Google, which links it to an ad click if you came from one of our ads, so we can tell which ads work. Google also receives a hashed copy of the email address you enter in the request form (turned into a one way code in your browser before it is sent) and uses it only to match the request to an ad click. We do not send Google your name or phone number, and we do not use Google Ads to show ads to past visitors. Loaded only after you accept optional cookies (in the United States, unless you opt out); you can withdraw consent at any time through Cookie settings. Manage your Google ad settings at myadcenter.google.com.
• OpenAI Ads (OpenAI): conversion measurement for our ads in ChatGPT. If you accepted optional cookies (or, in the United States, did not opt out) and reached us from one of our ChatGPT ads, our server reports your audit request or call booking to OpenAI through its Conversions API, together with the ad click reference and a hashed copy of the email address you entered (turned into a one way code before it is sent), so we can tell which ads work. No OpenAI code runs on this site, we do not send OpenAI your name or phone number, and nothing is sent if you did not accept optional cookies, or opted out in the United States. You can withdraw consent at any time through Cookie settings.
• Microsoft Clarity (Microsoft Ireland Operations Ltd.): session analytics, aggregated heatmaps and session replays with form input masking. Loads only after you consent to analytics (in the United States, unless you opt out); opt out any time via cookie settings.
• Meta Pixel (Meta Platforms Ireland Ltd.): advertising measurement for our campaigns on Facebook and Instagram, and retargeting: if you visited this site, Meta may show you MarginFix ads there. Loaded only after you accept optional cookies (in the United States, unless you opt out). You can withdraw consent at any time through Cookie settings. Meta may also receive these events through its Conversions API, a server connection Meta sets up for us under its Business Tools Terms. It carries the same usage data as the pixel, only after you accept optional cookies (in the United States, unless you opt out); we do not send Meta your name, email address or phone number. We operate under Meta’s data processing terms. Manage ad preferences at facebook.com/adpreferences.
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Co.): B2B ad measurement and retargeting: if you visited this site, LinkedIn may show you MarginFix ads there. Loaded only after you accept optional cookies (in the United States, unless you opt out). Data is pseudonymized by LinkedIn and aggregated for reporting. Opt out at LinkedIn guest controls.

The legal grounds we rely on to process data, per processor.

These providers may transfer data to the United States under the EU to US Data Privacy Framework and/or Standard Contractual Clauses. We do not sell personal data for money. Outside the United States we do not load any of these tags before consent; in the United States they load unless you opt out. A current list of all subprocessors is available at audits@marginfix.ai.

If you accept optional cookies, or in the United States unless you opt out, the Meta Pixel lets us build website audiences: groups of past visitors, held by Meta, such as people who viewed our pricing page, so that Meta can show them MarginFix ads on Facebook and Instagram. These audiences use only the usage data described above, never your name, email address or phone number, and Meta drops each visit from them after at most 180 days. Choose Reject, withdraw consent through Cookie settings, or in the United States opt out, and you are no longer added. You can also manage your ad preferences at facebook.com/adpreferences.

We do not currently build matched advertising audiences from your contact data. If we ever do, it will happen only with your consent, using hashed contact data, and you will be able to object at any time at audits@marginfix.ai; we would then suppress your data from every audience list.

For clients in the United States, your data is handled by MarginFix LLC, a Delaware limited liability company (file number 10817253)
Mailing address: 447 Broadway, 2nd Floor Suite #3606, New York, NY 10013, USA

For everyone else: MARGIN FIX AI S.R.L., trading as MarginFix
Registered in Romania: CUI 55037040, trade register J2026041724002, since June 29, 2026
Registered seat: Strada Profesor Mirescu 162, Gulia, Tărtășești, Dâmbovița, Romania
Mailing address: 447 Broadway, 2nd Floor Suite #3606, New York, NY 10013, USA
VAT Number: 55037040

Privacy requests: audits@marginfix.ai · General: audits@marginfix.ai

Company details also appear in the Terms and Conditions.