Exactly what we do with what you tell us
You are about to hand us real numbers about your business, so here is the whole picture in plain English: what we collect, where it goes, how it is protected, and how to make us delete it.
Last updated July 28, 2026
The short version
- We use what you tell us to build your roadmap and to have a real person follow up about it. That is it.
- We do not sell, rent or trade your information, and we never share your phone number with anyone else for their marketing.
- Your answers go into our own business tools so our team can help you. They are not published, and they are not shared with other brands.
- Every business number on the quiz is optional and a range is fine. You can skip all of it and still get your roadmap.
- Want it gone? Email growth@xfactr.io and we will delete it.
What we collect
Your contact details
- First name
- Email address
- Phone number
To send you the roadmap you asked for and to have a strategist follow up about it. These are the only fields we require.
About your brand
- Brand name
- Product category
- Hero product or best seller
- Website
So the roadmap is written about your actual brand and product instead of a generic example.
About your business performance
- Total monthly revenue (a range)
- TikTok Shop status and monthly GMV (a range)
- Creator outreach and weekly content volume
- Whether you run paid ads, and monthly ad spend
- Your best seller's price and rough profit margin
- Your biggest bottleneck and your 6-month goal
This is what makes the roadmap and the per-order profit breakdown specific to you. Ranges are fine, everything in this group is optional, and you can skip any of it and still get your roadmap.
Anything you type in the notes
- Free-text notes and 'other' answers
So the strategist on your call already knows what you are stuck on. Please do not put passwords, card numbers or anything you would not want in an email into this box.
Collected automatically
- IP address
- The page URL you submitted from
- Browser and device information, via the cookies below
IP address is used to rate-limit the form against bots and is not used to build a profile of you. The rest is standard web analytics and ad measurement.
Where it goes
Your submission is sent to the business tools we run on. These are the only places it goes. Each one is a company XFACTR has an account with, and each processes your information on our behalf.
If you book a call, the calendar invite and meeting link are created on our Google Workspace account and emailed to you.
How it is protected
Concrete measures that are actually in place on this page. We are a growth agency, not a security vendor, so we are not going to claim certifications we do not hold. Here is the real list.
Everything moves over HTTPS
This page and every submission are served over TLS, and the domain is sent with HTTP Strict Transport Security so a browser will not connect to it insecurely.
Our keys never reach your browser
The credentials that connect this funnel to the systems above are held as server-side environment variables. They are not in the JavaScript your browser downloads, and every call to a third party is made from our server, never from the page.
We never ask for anything sensitive
There is no account, no password, and no payment on this page. We do not collect card details, bank details, government ID numbers, or health information, so there is none of it here to lose.
The form is validated and encoded
Every field is checked and length-limited on our server, and every value is escaped for wherever it is going, so text you type is always treated as text and never as a command in the tools that receive it.
The site stores nothing in your browser
We set no cookies of our own and keep nothing about you in your browser's local storage. Nothing you type is held on this device after you leave.
Bot and abuse controls
Submissions are rate-limited per visitor and screened with a hidden honeypot field, so automated traffic cannot flood the form.
The website lookup is locked down
If you give us your website we fetch it server-side to tailor your roadmap. That fetcher is restricted to public internet addresses, follows a limited number of redirects, and caps how much it will read.
Browser-level hardening
The page is served with security headers that block it from being embedded in another site, stop content-type sniffing, limit what is shared in the referrer, and switch off camera, microphone and location access.
Access is limited to our team
The tools your information lands in are XFACTR company accounts. Access is limited to the XFACTR team members who work with you.
No system is perfectly secure, and we are not going to pretend otherwise. If you ever spot something wrong with this page, email growth@xfactr.io and we will look at it straight away.
Phone calls and texts
We ask for your number because a strategist texts or calls you about the roadmap you just requested. That is a real person on our team, not an automated system, and it is about your roadmap and working with XFACTR.
Message and data rates may apply and message frequency varies. Reply STOP to any message to opt out, or just tell whoever contacts you to stop, and we will. Reply HELP for help, or email growth@xfactr.io.
Your phone number and your consent to be contacted are never shared with anyone else for their marketing. We do not sell, rent or share it. Opting out of texts does not stop you getting your roadmap.
Cookies and ad tracking
This page runs the Meta Pixel and Google Tag Manager. They tell us that someone who clicked one of our ads reached this page and filled the form in, which is how we know which ads are worth running. They set cookies and receive standard browser and device information.
Your quiz answers themselves are not sent to Meta or Google. They receive that a step happened, not what you picked. Your revenue, GMV, margin, ad spend and notes stay in our own systems.
Sharing information with ad platforms this way can count as “sharing for cross-context behavioural advertising” under some US state privacy laws. To opt out, you can block cookies in your browser settings, turn on a Global Privacy Control signal, adjust your ad preferences directly with Meta and Google, or email us at growth@xfactr.io and we will action it for you.
How long we keep it
We keep your submission in our CRM and internal tools for as long as we are working with you or there is a live conversation about doing so, and after that for as long as we need it for our own business records and legal obligations. We are not going to quote you a fixed number of days we do not enforce.
If you want it gone sooner, ask. See below.
Your choices
Email growth@xfactr.io from the address you submitted, or reply to any message from us, and you can. We will confirm within 30 days.
- Ask for a copy of what we hold about you
- Ask us to correct it
- Ask us to delete it, and we will remove it from the systems listed above
- Stop calls, texts or emails from us
Depending on where you live you may have additional rights under laws like the CCPA or the GDPR. Ask us and we will honour them. We will not treat you differently for exercising any of this.
The formal documents
This page is the plain-English explanation of what happens on this funnel. Our full legal terms live on the main site and govern in the event of any conflict.
Questions about any of this go to growth@xfactr.io. XFactr LLC operates in the United States.