Privacy policy.

What we collect

• Anonymous analytics via Vercel Analytics and Google Analytics 4 (page views, referrers, country, device class). No personally identifying information.
• Email + name when you submit a prep-center claim form, listing-suggestion email, or contact form.
• DNS-TXT verification tokens when you go through our DNS-based listing claim flow. These tokens are random strings stored against your claim and discarded after verification completes.
• Cookies for session continuity if you sign in to manage a claimed listing (Supabase Auth + magic-link email).
• A first-party attribution cookie set on your first page view, which stores the page you landed on, the domain of the site that referred you (the domain only, not the full address), and any campaign tags in the link. It expires after 30 days, holds no identifier for you, is not readable by any other site, and is not shared with anyone. If you later submit a match request, those three values are stored with it so we know which pages bring sellers to us.
• Referral links.If you arrive through a prep center's referral link, we record which center's link it was. It is saved with the form that link opens (a match request, or an application to list your own center) when you submit it, and it is not part of the attribution cookie. That center's dashboard on this site shows a row for each match request that came through its link, with the date and whether it qualified for a credit. If you tell us you signed with another center on your shortlist, it can also show that, but not which center. For an application, it shows a row once the center you applied to list is published. It never shows your name, email, company or requirements.

What we don't collect

• Behavioral tracking for advertising. We don't run ads.
• Cross-site cookies, device fingerprints, or third-party trackers beyond GA4.
• Card numbers. Operator subscriptions and one-off purchases run through Stripe Checkout and Stripe Elements, so card details go straight to Stripe and never touch our servers or our database. We store only Stripe's identifiers and the resulting subscription state.
• Phone numbers (unless you voluntarily provide one in a claim or contact form).

Third parties we share with

• Vercel - hosts the site; sees request metadata.
• Supabase - database + auth; stores claim records.
• Resend - delivers transactional emails (magic-link sign-in, claim verifications).
• Google Analytics 4 - aggregated traffic analytics.
• Stripe - processes operator payments and subscriptions. Stripe receives the billing details you enter on its own checkout surface.
• OpenAI- we send text to OpenAI's API for the following. When you submit a match request, the name, email, company, company website and answers you typed into the form are sent to check that the request comes from a real seller, and your answers and company website (without your name or email) are sent to rank which verified centers fit it. Nothing an AI model writes is sent to you about your match request: the acknowledgement and your shortlist are assembled from your form answers and our own center data. Email sent to hello@fbaprepfinder.com or in reply to our emails (the sender's name and address, the subject and the message text) is sent to sort it, to draft a reply and to check that draft before it goes out, so a reply from us may be drafted with AI help. Public Reddit posts we monitor (the post text, the subreddit and the author's username) are sent to judge whether the author is looking for a prep center, and for a post that is, the post text and subreddit (without the username) are sent again to draft a suggested reply that a person may edit and post. Requests go out with OpenAI's option to keep the response for later retrieval switched off.
• Google (Gmail API) - our hello@ mailbox sends and stores correspondence with buyers and operators.
• MillionVerifier - receives an email address on its own to check the mailbox exists before we write to it, so a reply does not bounce.
• Slack - new match requests and operator events, including the submitter's email address, post to private internal channels so a human sees them quickly.
• The prep centers we match you with - only if you choose the option on the match form asking them to contact you directly, and only the Featured centers on your own shortlist (a Featured center pays for placement on the site, not for your details; we are not paid per introduction). They receive your name, email, company and company website. The other centers on your shortlist get your requirements with nothing that identifies you. Choose the other option and every center is told your requirements with nothing that identifies you. For visitors in the United States the first option is selected when the form opens and you can switch it in one click; everywhere else neither option is selected and you pick one. We store which of the two you were shown. To withdraw afterwards, email hello@fbaprepfinder.com and we will stop passing your details on, and stop showing them in those centers' dashboards. We cannot unsend an email a center already received, so we will also tell you which centers have them.

We do not sell, rent, or trade your data. We share only what's necessary to operate these specific services, plus the introductions you asked for.

Our public API and AI assistants

We publish a read-only Model Context Protocol endpoint at /api/mcp/, plus JSON dataset endpoints. These let an AI assistant search our verified directory and cite it. They serve only information that is already public on this site.

• They require no sign-in and collect no personal data. There is deliberately no tool that accepts your name, email, or phone number. If you want a hand-matched shortlist, you fill in the form on this site, where this policy governs.
• They return no operator contact addresses, only links back to the profile page.
• Results are ordered by fit and verification recency. Paid placement is not applied on this surface, and no click from an assistant is billed to an operator.
• As with any web request, our host receives standard request metadata such as IP address and user agent. We use it to rate-limit abuse, not to profile you.

The data is published under CC BY 4.0. You are free to reuse it with attribution to fbaprepfinder.com.

How long we keep things

• Approved claims and live operator accounts: kept indefinitely so operators can continue to manage their listing. You can request removal at any time via the operator dashboard or by emailing us.
• Rejected or duplicate applications, and rejected or revoked claims: contact fields (email, phone, name) are anonymized 24 months after the rejection. The row itself stays so we can answer "did you ever consider X?" honestly, but the personal data is removed.
• Match requests (the "get matched" form): contact fields are anonymized once the match is closed or after 24 months, whichever comes first.
• Operator audit log: kept for the life of the listing as a record of who changed what. Removal of the listing also removes the audit rows.

We anonymize older records periodically as we scale. Write to hello@fbaprepfinder.com any time to request earlier deletion of your own data.

Contact

Questions or requests (deletion, access, correction): hello@fbaprepfinder.com. We respond within 7 days.