Last updated 24 October 2026

Privacy

This explains what The Profit System collects when you use our website and the free Profit Leak Scan, why, and what we do with it. The short version: we read your books once to build your report, we disconnect, we never store your transactions, and we keep only your finished report, encrypted, so you can reopen it.

Who we are

The Profit System ("we", "us") is the data controller for the information described here. The Profit System is a trading name of Profit Systems Group Ltd, a company registered in England and Wales, company number 16819756, registered office 3 Childwick Green, Childwickbury, St. Albans, Hertfordshire, AL3 6JJ. Contact: hello@profitsyst.com.

What we collect

What	Why	How long
Your first name, email and business name, from the scan form	To show you your scan, follow up about it, and book a call if you ask for one	Until you ask us to delete it, or 24 months without contact
Your phone number, from the scan form	So our team can call you to walk you through your report	With your contact details, as above
Your answers to the scan form's two questions: what you use for your books, and roughly how much your business sells a year	To check the scan can read your books, and to know which plan might fit	With your contact details, as above
Your first name and email, and its two tick boxes (whether you use QuickBooks Online, and whether your business sells more than the figure it shows), from the form that opens the live dashboard demo	To email you the link back to the demo and a few follow-ups about it, and to know which plan might fit	With your contact details, as above
The headline totals from your scan (profit and cash figures) and your organisation's name	So we can prepare for a call you book	As above
Your finished scan report: the totals, findings and monthly figures shown on screen, including the names of the few customers or suppliers a finding mentions	So you can reopen your report, so each business gets one free scan, and so we can prepare for a call you book	12 months, then deleted automatically. Sooner if you ask
The country, region and city your connection comes from (worked out by our host from your IP address; the IP address itself is not kept)	To show prices in your currency and to know which market a lead is in	With your contact details, as above
The link or campaign that brought you to the scan (for example utm_source=linkedin)	To know which of our posts and ads work	With your contact details, as above
For visitors in the United States who arrive from a link with campaign tags (for example one of our ads): those tags, and the ad's click reference if it has one, remembered in your browser so they still count if you look around before you start the scan, try the live dashboard demo or buy	To know which of our posts and ads work, even when you don't act on the first page you see	30 days in your browser; once you start the scan, try the live dashboard demo or buy, with your contact details, as above
Visit measurement, for visitors in the United States: our own pages note how each visit goes, such as how long a page is in use, how far you scroll, which of our buttons you tap, which boxes of our forms you reach (never what you type) and how you use the live dashboard demo, with a random number for the visit kept in your browser tab until you close it. Once you've given us your email on one of our forms, we link your later visits to it in our own records, so our team can see what you've looked at	So we can see which of our ads and pages work. The same switch below, or Global Privacy Control, turns it off	6 months
Whether you opened the booking window or booked a call	To know whether to follow up	As above
Which links you click in the emails we send you, and when, and, in the browser you open one in, who that email was for	To know what's useful to you, and when a call would help, and so our checkout and follow-up emails know you on that device too	As above; in that browser, 90 days
After you've tried the live dashboard demo: whether you played with it, and whether you went on to our pricing page	So our follow-up emails fit how far you got	With your contact details, as above
Your answer if we ask what's stopping you (a one-tap question on the live dashboard demo's offer and on our pricing page), and any words you add to it, with the page and the ad you came from	To understand what stops people, and make our pages and offer better	With your contact details, as above, if we know them; otherwise 6 months
The questions you ask Penny, the super intelligence who knows all things finance and growth, in the live dashboard demo: which of her questions you tap, or which one your own words matched (not your words), and, when she can't answer a question you type, your words as you typed them (with any email address or long number taken out), with the page and the ad you came from	To see what business owners want to know, and to teach Penny to answer it	With your contact details, as above, if we know them; otherwise 6 months
Your replies to our emails: what they're about and your words	To answer you, and to see what people ask us	With your contact details, as above
The plan we suggest for your business, worked out from your scan report	To show it on your report and on our pricing page, and so our team knows which plan fits if you get in touch	With your contact details, as above
What you choose on your report in the 24 hours after your scan, such as the move you'd start with, opening a plan or emailing yourself your report, and, if you open checkout, which package you opened and how you reached it, up to 12 months after your scan. Never your figures	To know what interested you, and whether to follow up	With your contact details, as above
A link to your report, emailed to you after your scan	So you can open your report on another device. Anyone with the link can open the report, so share it with care	The link works for 12 months, while your report is kept
If you open checkout or buy a package: your name, email, mobile number, business name and billing address, taken by Stripe at checkout (we never see your full card details), with the plan your scan suggested and the choices above	To take your payments, send your receipts and get you set up, and to call or text you about your setup	For as long as you're a client, then as long as the law requires us to keep accounting records
Texts and calls between us: what you text or say to our number, our replies, any voicemail you leave, and which of our texts and voice notes reached you	To answer you, and to help you get set up	With your contact details, as above
Basic technical logs (time, browser type, errors)	To keep the service working and secure	Up to 30 days

Visit counts: we count visits to each page with Vercel Web Analytics, so we know which pages help. It sets no cookies, stores nothing on your device, never records who you are, and can't follow you to other sites.

Measuring our ads: Meta's pixel and Conversions API

For visitors in the United States, we may use Meta's pixel on our pages and Meta's Conversions API on our server. Anywhere else, including the UK and the EU, neither runs, and nothing about you is sent to Meta.

What Meta gets: which of our pages you visit; when you start the free scan or sign up to try the live dashboard demo, and whether it's a business we work with (never your answers themselves), when you open the demo's form, play with the demo, see its offer, look at our plans and pick one, when your report is built, when you tell us you've booked a call, when you open checkout and when you buy a package (which package and the price); your browser type and IP address; Meta's own cookie IDs, and the ad you clicked if you came from one; and, once you've given us your email or opened a link in one of our emails, a hash of it (a scrambled copy Meta can only use to match an account it already knows) and a hash of the reference number we give your scan or demo sign-up.
What Meta never gets: your books, your transactions, your password or any figure from your report. Meta's pixel never loads on the pages where you connect your books, see your report or land after paying.
What we keep for it: if you open checkout, your browser type, Meta's cookie IDs and the page you came from are saved with your payment at our payment provider, Stripe, so we can tell Meta about the purchase once it's paid. They stay with that payment record. Never your IP address.
Why: to see which of our Facebook and Instagram ads bring people to the scan, a call or a package, so we stop paying for the ones that don't, and to show our ads again to people who've visited, in a way that fits how far they got (for example, not showing the demo again to someone who has tried it).
Who: Meta Platforms, Inc. We and Meta are joint controllers for collecting this data and sending it to Meta (Meta's Controller Addendum). Meta then uses it under its own privacy policy (facebook.com/privacy/policy).
How to opt out: use the switch below, or turn on Global Privacy Control in your browser (Brave and DuckDuckGo have it on already), and neither runs for you. You can also block or clear cookies, change which ads you see in your Facebook or Instagram ad preferences, or email us to object and we'll stop sending Meta anything with your email.

Measuring our ads in ChatGPT: OpenAI's pixel and Conversions API

For visitors in the United States, we may also use OpenAI's pixel on our pages and OpenAI's Conversions API on our server, to see which of our ads in ChatGPT work. Anywhere else, including the UK and the EU, neither runs, and nothing about you is sent to OpenAI.

What OpenAI gets: which of our pages you visit; when you start the free scan or sign up to try the live dashboard demo, and whether it's a business we work with (never your answers themselves), when you book a call with us, when you open checkout and when you buy a package (which package and the price); your browser type, your IP address and the country you're browsing from; OpenAI's own reference for the ad you clicked (oppref), if you came from one of our ads in ChatGPT, and the random browser reference its pixel keeps (obref); our pages' addresses (when our server sends one, it keeps only our ads' tags in it); and, once you've given us your email, a hash of it (a scrambled copy OpenAI can only use to match an account it already knows) and a hash of the reference number we give your scan or demo sign-up.
What OpenAI never gets: your books, your transactions, your password or any figure from your report, and our server never sends OpenAI your name, phone number or address. OpenAI's pixel never loads on the page where you connect your books, the page that shows your report, the page that says your books are disconnected, or the page you land on after paying.
What OpenAI's own script may add: OpenAI's pixel may itself spot contact details you type into a form on our pages, such as your email address or phone number, and send OpenAI only a scrambled copy of them (a SHA-256 hash), never the details themselves. OpenAI calls this automatic advanced matching, and turns it on for new pixels.
What we keep for it: if you open checkout, your browser type, OpenAI's two references and the page you came from are saved with your payment at our payment provider, Stripe, so we can tell OpenAI about the purchase once it's paid. They stay with that payment record. Never your IP address.
Why: to see which of our ads in ChatGPT bring people to the scan, a call or a package, so we stop paying for the ones that don't.
Who: OpenAI, which runs the ads in ChatGPT. OpenAI then uses this data under its own terms and privacy policy (openai.com/policies/privacy-policy).
How to opt out: the same switch below, or Global Privacy Control in your browser, turns OpenAI's off as well as Meta's. You can also block or clear cookies, or email us to object and we'll stop sending OpenAI anything with your email.

Measuring our ads in Google search: Google's tag

For visitors in the United States, we may also use Google's tag (Google Ads) on our pages, to see which of our ads in Google search work. Anywhere else, including the UK and the EU, it doesn't run, and nothing about you is sent to Google for our ads.

What Google gets: which of our pages you visit, and when you start or send our scan form or the live dashboard demo's form; when you send either, whether it's a business we work with (never your answers themselves), with a reference number of ours that tells Google nothing about you; your browser type and IP address; Google's own reference for the ad you clicked (gclid, or gbraid or wbraid from some iPhone and app clicks), if you came from one of our ads in Google search; and a hash of the email address and phone number you give us (a scrambled copy Google can only use to match an account it already knows). Google calls this last part enhanced conversions.
What Google never gets: your books, your transactions, your password or any figure from your report, and never your email address or phone number themselves: our page scrambles them before Google's tag sees them. Google's tag never loads on the page where you connect your books, the page that shows your report, the page that says your books are disconnected, or the page you land on after paying.
What we keep for it: Google's reference for the ad you clicked, with the details you give us on the scan form, so we can later tell Google whether that ad led to a finished scan, a call or a purchase. Never your IP address.
Why: to see which of our ads in Google search bring people to the scan, so we stop paying for the ones that don't. We don't use it to show you our ads again elsewhere.
Who: Google LLC. For the scrambled email address and phone number, Google acts for us, as our processor, under the Google Ads Data Processing Terms. For the rest, Google is a separate controller under the Google Ads Controller-Controller Data Protection Terms, and uses it under its own privacy policy (policies.google.com/privacy; how Google uses data from sites like ours: policies.google.com/technologies/partner-sites).
How to opt out: the same switch below, or Global Privacy Control in your browser, turns Google's off as well as Meta's and OpenAI's. You can also block or clear cookies, change which ads you see in Google's My Ad Center, or email us to object and we'll stop sending Google anything with your email.

Recordings of how a visit goes: Microsoft Clarity

For visitors in the United States, we use Microsoft Clarity to record how a visit goes on our pages, so we can see what's confusing and fix it. In most states it starts when the page opens.

In California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania and Washington, and wherever we can't tell your state, we ask first: "May we record this visit?" There, nothing of Clarity's loads, and nothing is recorded, before you say yes, or ever if you say no.

What it records: how you move through our pages: where you scroll, move and tap, what you see on the screen, the page and the ad you came from, your kind of device and browser, and roughly where you are (from your IP address, which Clarity doesn't keep).
What it never records: anything you type: every form and box on our pages is hidden from it. On this website it never runs on the free scan, where you connect your books and see your report, or on profitsyst.com/welcome.
Who: Microsoft Corporation, which runs Clarity for us under its privacy statement and the Clarity terms. Clarity keeps recordings for 30 days, and its heatmaps and summaries for up to 13 months.
Your visits together: once you've given us your email on one of our forms, we note in our own records which recordings and visits are yours, so our team knows what you've already seen. On this website, Clarity is never told who you are.
Changing your mind: Global Privacy Control in your browser, or the switch below, means we never ask and never record, wherever you are, on this website or in your dashboard. Where we ask, a no is kept, and clearing this site's cookies means we'll ask again.

In your dashboard

Once you've started with us, we also use Clarity in your dashboard (dashboard.profitsyst.com), from the page where you create your login, to see where setting up or using it gets in your way, so we can fix it. It runs for clients whose device is set to a United States time zone, never for our own team, and never with Global Privacy Control, the switch below or a no to recordings on this website.

What it records there: where you scroll, move and tap, and which screen you're on. Everything on the screen is hidden from it except our own words on the screens before your books are read: creating your login, your welcome, connecting your books, and the progress while we read them. Your figures, your books and the names in them, and anything you type, are never recorded.
Filed under your login: Clarity is given a one-way code made from your email address, never the address itself, so our team can find your recordings when we're helping you. Your earlier visits to this website from the same browser join them.

Your privacy choices

Why we're allowed to use it

To run the scan and show you your report: because you asked us to, and our legitimate interest in providing the free tool.
To follow up about your scan or a call: our legitimate interest in replying to people who've shown interest. After a scan, that means your report by email, a few follow-up emails about it from our team, each with a link to unsubscribe, and a call if you gave us your number. You can tell us to stop at any time.
To provide paid services: to perform our contract with you.
To text you about your setup: because you agreed to it when you gave us your mobile number at checkout, and to perform our contract with you. Reply STOP to any text and we stop.
To keep records the law requires: legal obligation.
To measure our ads (United States visitors only): our legitimate interest in knowing which ads work, on Facebook and Instagram (Meta), in ChatGPT (OpenAI) and in Google search (Google). You can opt out at any time, as above.

We don't send marketing newsletters unless you've opted in.

Your accounting data

When you connect QuickBooks Online, you sign in on Intuit's own page and approve the connection. We never see or store your password.

What we read: your profit and loss by month, your balance sheet, sales invoices, supplier bills, the card, bank and cash payments recorded in your books, and bank account balances, for up to the last 12 months, plus your organisation's name, country and currency.
What we do with it: build your report, once, in memory. If your business has already had its free scan, we disconnect without reading anything and show you the report you already have.
What we do not do: we do not create, change or delete anything in your books, we have no access to your bank account and can't make payments, and we do not save your transactions, invoices, bills or contact lists anywhere.
Disconnecting: as soon as your report is built we revoke the connection. The access key is discarded. You can confirm this in your QuickBooks connected apps settings.
Your report: it opens in your browser. We keep one copy of the finished report, encrypted with AES-256 before it is saved, in private storage in London (Vercel Blob, region lhr1). It is stored under a code that cannot be traced back to your organisation's ID, and only this website's server holds the key. A cookie lets the browser you used reopen it. It is deleted automatically after 12 months.
Who sees it: you, and our finance and growth team at Profit Systems Group Ltd, who receive a summary of your report so they can prepare for a call.
Keeping the form for people: to stop automated spam we check that your email's domain can receive email, and we may use Cloudflare Turnstile, which checks your browser is operated by a person.

Text messages

What we text. If you give us your mobile number at checkout, we use it to text you about getting set up: a welcome, voice notes from our team about your next step during your free days, and our replies when you text us. We may also call you on it if your setup needs it.
Who sends them. Twilio delivers our texts and calls for us, as our processor. When you text or call our number, Twilio passes it to our team.
What we never do. We never sell your mobile number. The mobile number you give us at checkout, and your agreement to get texts, are never shared with third parties or affiliates for marketing or promotional purposes.
Stopping them. Reply STOP to any of our texts and we stop texting you. Reply HELP for help, or email hello@profitsyst.com. Message and data rates may apply. Our terms say how our texts work.

Who we share it with

We don't sell your data. We use a small number of providers to run the service: our website host and report storage (Vercel), Intuit when you connect your books, Google Workspace, where we keep contact details and receive lead summaries, Cloudflare Turnstile for spam protection, Resend, who deliver the emails we send you (your report, and our follow-ups about it), our booking calendar (Google Calendar or Calendly) if you book a call, and Stripe, who take our payments, if you buy a package, and Microsoft Clarity, which records how a visit goes (in some states only if you say yes when we ask) and how our clients use their dashboard. They process data only on our instructions. If you buy a package, Twilio delivers our texts and calls, also only on our instructions.

To write part of the emails we send you once you've started a package, we use Anthropic's Claude. It gets what you came to us for, what you told us and chose, how soon you started and where you are with setting up, never your books, your name or your contact details, and Anthropic uses it only on our instructions.

For visitors in the United States, we may also send Meta, OpenAI and Google the details in the three "Measuring our ads" sections above. Each uses them under its own terms as well as ours. Some US state laws call that "sharing": the switch under those sections, or Global Privacy Control, opts you out.

Where it's stored

Some of our providers, including our website host, may process data outside the UK, for example in the United States. Where they do, we rely on the UK's approved safeguards, such as the UK International Data Transfer Addendum or the UK-US data bridge.

Cookies

We use essential cookies and a remembered currency choice. For visitors in the United States we may also use Meta's, OpenAI's and Google's advertising cookies, a cookie of our own that remembers the ad that brought you, and, while we record a visit, Microsoft Clarity's. Full details are in our cookie policy.

Your rights

You can ask us to see, correct or delete the details we hold about you, or to stop contacting you, at any time. Email hello@profitsyst.com. You can also ask for a copy of your data in a portable format, or object to how we use it. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or to your local data protection authority if you're outside the UK.

Changes

If we change how we handle your data we'll update this page and the date at the top.