Privacy Notice

1. Who We Are

The M2M Growth Map is operated by Paul Hopewell. If you have any questions about this notice or your data, you can contact Paul directly at:

Email: ph@paulhopewell.com

2. What Data We Collect

When you use the diagnostic tool, we collect the following information:

• Name — provided when you choose to receive your results by email
• Email address — provided when you opt in to receive your results and follow-up
• Diagnostic answers — your responses to the 30-question assessment, used to calculate your M2M level, lens scores, and growth bottleneck
• Session metadata — a hashed version of your IP address (not stored in raw form), browser user-agent string, and session start/completion timestamps, used for analytics and debugging

3. How We Use Your Data

Your data is used exclusively for the following purposes:

• To calculate your M2M Growth Map level, lens scores, and primary bottleneck
• To display your personalised results page
• To send you your results by email if you choose to provide your email address
• To suggest relevant follow-up, including the AI Growth Audit, based on your diagnostic profile
• To improve the diagnostic tool by analysing aggregated, anonymised response patterns

4. Legal Basis for Processing

We process your data on the basis of your consent. You give this consent by actively checking the consent checkbox when you submit your email address. You have the right to withdraw your consent at any time (see Section 7).

Session metadata (hashed IP, timestamps) is processed on the basis of our legitimate interest in maintaining and improving the service. This data cannot identify you directly.

5. Where We Store Your Data

All data is stored in a secure SQLite database on a private server hosted at Hetzner in Nuremberg, Germany (EU). The server is protected by:

• SSH key-based access only (no password login)
• Regular security updates
• Encrypted connections (TLS/HTTPS) for all data in transit
• Database-level access restricted to the application process only

6. Data Retention

We retain your personal data for a period of 12 months from the date you complete the diagnostic. After this period, all personally identifiable information (name, email address) is anonymised. Diagnostic answers and scores may be retained in anonymised form for aggregate analysis and product improvement.

7. Your Rights

Under UK and EU data protection law (UK GDPR / GDPR), you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct any inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (the “right to be forgotten”)
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal
• Right to object — object to processing based on legitimate interest
• Right to lodge a complaint — complain to the Information Commissioner's Office (ICO) if you believe we have not handled your data properly

To exercise any of these rights, please email ph@paulhopewell.com. We will respond within 30 days.

8. Third-Party Sharing

We do not share your personal data with any third parties. Your diagnostic answers, your name, and your email address stay within the M2M Growth Map system and are visible only to Paul Hopewell for the purposes described in Section 3.

The only external service involved is Resend (for sending confirmation emails), which processes the email address ephemerally and does not store it. Resend is GDPR-compliant and their privacy notice applies to that specific data transmission.

9. Cookies

This site uses a single essential session cookie to keep your diagnostic in progress as you move through the questions. This cookie:

• Is strictly necessary for the service to function
• Contains no personal information — only an anonymous session identifier
• Expires when you close your browser (session cookie)
• Cannot be used to track you across websites

No tracking cookies, analytics cookies, advertising cookies, or third-party cookies are used. We do not use Google Analytics, Facebook Pixel, or any similar tracking service.

10. Changes to This Notice

We may update this privacy notice from time to time. If we make significant changes, we will note the updated date at the top of this page. Continued use of the service after changes take effect constitutes acceptance of the updated notice.

11. Contact

If you have any questions, concerns, or requests regarding your data, please contact:

Paul Hopewell
Email: ph@paulhopewell.com