Privacy Policy

This Privacy Policy describes how Maverick Marketer LLC (“Company,” “we,” “us,” or “our”) collects, uses, and protects information through our websites and services, including mymaverickmarketer.com, the diagnostic platform at diagnostic.joshuamcsorley.com, and any related platforms (collectively, the “Services”).

By using our Services, you agree to the collection and use of information as described in this Privacy Policy.

Our Websites

Maverick Marketer LLC operates more than one public website. All of them are covered by this Privacy Policy.

• mymaverickmarketer.com is the company website. Client services, engagements, and paid work run through Maverick Marketer.
• joshuamcsorley.com is the personal site of Joshua McSorley, the founder of Maverick Marketer, where he publishes writing, project walkthroughs, tools, and free resources. It is not a separate company. Some resources on either site are free to access with no form at all; others ask for your email address before you download them.
• diagnostic.joshuamcsorley.com is the platform used to deliver paid diagnostic engagements. It is operated by Maverick Marketer LLC and is expected to move to a mymaverickmarketer.com address. This policy applies to it before and after that move.

Most sections of this policy apply to all of our sites. Where a section applies only to the diagnostic platform, or only to our marketing sites, we'll note that.

Our Privacy Posture

Before getting into the details, here's what we don't do:

• We do not sell, rent, lease, or trade your personal information.
• We do not share your personal information with third parties for advertising, retargeting, or any other form of cross-context behavioral profiling.
• We do not currently run third-party advertising or marketing pixels (Google Ads, Facebook Pixel, LinkedIn Insight Tag, etc.) on this site.
• We do not provide your data to AI service providers for the purpose of training their models.

Your information is collected and used only to deliver the services you've requested, communicate with you about those services, and operate our business.

Information We Collect

Information you provide directly

When you create an account, fill out forms, or communicate with us, we may collect:

• Your name, email address, company name, and job title
• Responses to intake questionnaires (Pre-Intake and Full Intake forms)
• Requests you submit through our client request forms, including the description of the work you are asking us to do
• Files and documents you upload to the platform (transcripts, reference materials)
• Messages, notes, and feedback you provide
• Payment information (processed by Stripe; we do not store your credit card number)

Information collected automatically

When you use our Services, we may automatically collect:

• Browser type, device information, and operating system
• Pages visited, time spent, and interactions with the platform
• IP address and approximate location
• Referring website or source
• Timestamps of when you view deliverables (diagnosis reports, action plans, journey maps)

Information from third parties

• Stripe: When you make a payment, Stripe provides us with transaction confirmation, payment status, and a receipt URL. We do not receive or store your full credit card number. Stripe's privacy policy governs their handling of your payment data.
• Supabase: Our diagnostic platform infrastructure is hosted on Supabase. Data stored in that platform (account information, form responses, files) is processed and stored by Supabase in accordance with their privacy and security policies.
• Notion: Our client and project records are maintained in Notion. Contact details, engagement history, and submitted requests are stored there in accordance with Notion's privacy and security policies.
• Kit (formerly ConvertKit): Our email marketing platform. If you subscribe to our list or download a gated resource, Kit tells us your subscription status and which emails you opened or clicked. Kit's privacy policy governs their handling of that data.

Information we collect when you submit a form

When you fill out a form on either of our sites (such as our contact form, a free assessment request, a client request form, or a form that unlocks a downloadable resource or tool), we collect the information you provide directly (for example, your name, email address, and any details about your business or inquiry).

Along with your submission, we automatically capture a small amount of context about your visit:

• The page you were on when you submitted the form
• The website or search result that referred you to our site (if any)
• Any campaign tracking parameters in the URL, such as UTM tags, which tell us if you arrived from a specific link we shared in an email, social post, or ad

We collect this context for two reasons: to respond to your inquiry appropriately, and to understand how people find and move through our site so we can improve it over time. This information is stored alongside your submission in our customer relationship management system, which is Notion, and is treated as part of your client or lead record.

We do not use this information for cross-site advertising or retargeting. If we ever begin doing so, we will require your explicit consent through our cookie preferences before any such tracking occurs.

You have the right to request a copy of the information we hold about you, or to request that we delete it, at any time. To make such a request, contact us at josh@mymaverickmarketer.com.

When you download a gated resource

Some of our free resources, templates, and tools ask for your email address before you can download them. When you give us your email this way:

• We use it to deliver the resource you asked for.
• We may add you to our email list and send you occasional related content and updates about what we're building.
• Every email we send includes an unsubscribe link, and unsubscribing does not affect your access to anything you have already downloaded.
• We do not pass your address to anyone else, and we do not use it for advertising or retargeting.

If you would rather not be on the list at all, email us and we will remove you.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services
• Process your payments and manage your account
• Receive, triage, and deliver the work you request under an engagement
• Deliver diagnostic services, including generating diagnosis reports, action plans, and customer journey maps
• Communicate with you about your engagement, including status updates and deliverable notifications
• Send team invitation emails on your behalf when you invite colleagues to the platform
• Improve the platform and develop new features
• Respond to your inquiries and provide support
• Comply with legal obligations

Meetings and Recordings

With your knowledge, we may record video calls held as part of an engagement and use automated notetaking tools (such as Google Gemini within Google Meet) to produce summaries, action items, and transcripts. These records are used solely to document our work together and to make sure nothing agreed on a call gets lost.

Recordings and transcripts are stored in our own business systems and are not shared outside our service providers. You may ask us not to record a call, or to delete a recording or transcript, at any time.

AI-Generated Content

Our platform uses artificial intelligence (specifically, large language models provided by Anthropic and/or OpenAI) to assist in generating diagnostic deliverables, including diagnosis reports, action plans, and customer journey maps. When these tools are used:

• Your intake form responses, uploaded transcripts, and other information you provide through the platform may be sent to AI service providers as input for generating deliverables
• AI-generated content is always reviewed and edited by Joshua McSorley before being shared with you
• We do not use your data to train AI models. Your information is processed for the sole purpose of generating your deliverables.
• AI service providers may process your data in accordance with their own privacy policies. We select providers that do not use customer inputs for model training.

How We Share Your Information

We do not sell, rent, lease, trade, or share your personal information for any commercial purpose, including advertising or marketing on third-party platforms. The only entities that receive your information are the service providers we use to run our business, listed below.

We share information with:

• Lovable: Our hosting and deployment platform for both the marketing website and the diagnostic portal. Lovable also routes transactional emails (such as contact-form notifications and account-related messages) through its built-in email infrastructure. As the host, Lovable collects its own usage telemetry about requests to the sites it serves, and it sets two first-party cookies on your browser (__dpl and session-id) that identify the deployment and your browsing session. This is built into the hosting platform. It is added to the page when the page is served, and it sits outside our cookie preference controls, which govern only the analytics tools we configure ourselves. Subject to Lovable's privacy policy.
• Notion: Our client relationship and project management system. Stores contact details, company records, engagement and project history, meeting summaries, and requests submitted through our client request forms. Notion request forms are submission-only: clients cannot view other clients' records or requests. Subject to Notion's privacy policy.
• Google Analytics 4: Our only analytics tool. It gives us aggregated reporting on how visitors find and use the site: pages viewed, how people arrived, and a small number of conversion events such as contact form submissions. We do not enable advertising or remarketing features, and we do not use it to track you across other websites. On mymaverickmarketer.com the Google tag is not loaded at all until you grant analytics consent, so if you decline or ignore the banner, Google receives nothing from your visit. Subject to Google's privacy policy.
• Google Fonts: Our sites load typefaces from Google's font service. This happens on every page load, before any cookie choice, because the fonts are part of how the page renders. No cookie is set, but your browser's request reveals your IP address to Google. Subject to Google's privacy policy.
• Kit (formerly ConvertKit): Our email marketing platform. Stores the email address and any name you provide when you subscribe or download a gated resource, along with tags describing which resources or topics you engaged with, so that what we send you is relevant. Used to send newsletters and resource delivery emails. Every message includes an unsubscribe link. Subject to Kit's privacy policy.
• Google Workspace, including Gmail, Google Calendar, Google Meet, and Google Drive: Our business email, calendar, video conferencing, and file storage. Direct correspondence with us, including any information you send us by email and any documents you share with us, is processed and stored by Google. When you book an intro call through our booking page, the booking form is embedded from Google Calendar and your scheduling submission (name, email, time selected, optional notes) is processed by Google's calendar service. Calls held over Google Meet, and any recordings, transcripts, or automated notes produced from them, are processed by Google. Subject to Google's privacy policy.
• Supabase: Database, authentication, and edge-function infrastructure for the diagnostic platform. Stores account information, intake form responses, and uploaded files. Used by the diagnostic platform only. Subject to Supabase's privacy and security policies.
• Stripe: Payment processing for paid engagements. Stripe handles all credit card data; we do not store your card number. Subject to Stripe's privacy policy.
• AI service providers (Anthropic and/or OpenAI): Generate diagnostic deliverables from your intake responses, and assist with drafting and analysis in the course of delivering engagements. We select providers that contractually do not train their models on customer inputs. See the AI-Generated Content section above.
• Team members in your organization: When you or a colleague creates an account under the same organization on the diagnostic platform, team members in that organization can view shared intake form responses, shared notes, and shared files. Internal notes and internal files are not visible to your team. Diagnostic platform only.
• Subcontracted specialists: Some engagements are delivered by Maverick Marketer together with named specialist contractors (for example, a design and front-end development lead). Where a specialist works on your engagement, they receive only the information needed to do that work, and are bound by the same confidentiality obligations we are.
• Legal requirements: We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Each service provider is contractually limited to processing your data only on our behalf, for the purposes described above: they cannot use your data for their own marketing, cross-customer aggregation, or resale.

Data Retention

• Account information: We retain your account information for as long as your account is active or as needed to provide Services.
• Email subscribers: If you are on our email list, we retain your address until you unsubscribe or ask to be removed. Unsubscribed records are retained only as long as needed to make sure we do not email you again by mistake.
• Email correspondence: Emails you send us, and our replies, are retained in our business email system as a record of what was discussed and agreed.
• Client and engagement records: Contact details, project records, meeting summaries, and request history are retained for the duration of our engagement and for a reasonable period afterward (typically 2 years) to support follow-up engagements or reference.
• Diagnostic data: Intake form responses, diagnosis reports, action plans, journey maps, notes, and files are retained for the duration of our engagement and for a reasonable period afterward (typically 2 years).
• Payment records: Transaction records are retained as required by applicable tax and accounting laws.

You may request deletion of your account and associated data at any time by contacting us at the email address below. We will delete your data within 30 days of a verified request, except where retention is required by law.

Data Security

We implement reasonable technical and organizational measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission (HTTPS/TLS)
• Row-level security policies that restrict data access based on your role and organization
• Authentication-based access controls
• Secure payment processing through Stripe (PCI-DSS compliant)

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Cookies and Tracking

Google Analytics 4 is the only analytics tool we run. We do not use session replay, and we do not record your screen or your mouse movements.

The four cookie categories

Our cookie banner groups everything into four categories:

• Essential. Always on, and not something you can switch off, because the site cannot work without it. This covers the cookies that keep you logged in to the diagnostic platform, the cookies the hosting platform sets to serve the page, and the record of the cookie choice you make here.
• Analytics. Google Analytics 4, described above.
• Personalization. Reserved for remembering preferences such as settings you have chosen. Nothing uses it today.
• Marketing. Reserved in case we ever run advertising or remarketing. Nothing fires in this category today. We are not running any advertising pixels, and if that changes, the choice you have already saved will be applied to it. We will not quietly start tracking you.

When analytics runs

On mymaverickmarketer.com, analytics does not run until you allow it. The Google tag is not added to the page until you grant analytics consent, so declining the banner, or simply ignoring it, means Google receives nothing at all from your visit. If you accept and later change your mind, analytics stops immediately, in the same session, and your choice is remembered on future visits.

We apply Google Consent Mode v2, with every optional storage type set to denied until you decide otherwise.

How your choice is stored

On mymaverickmarketer.com we save your cookie choice in your own browser's local storage, under the name mm-cookie-consent. It stays on your device. It is not sent to us as a cookie and it is not shared with anyone. You can review or change your choice at any time using the Cookie Preferences link in the footer.

Things that load before you choose

Two things reach your browser before any cookie choice is possible, so we want to name them plainly:

• The hosting platform sets the __dpl and session-id cookies and collects its own usage telemetry, as described in the Lovable entry above. These are part of serving the site and are not controlled by the banner.
• Our typefaces load from Google Fonts, which sets no cookie but does reveal your IP address to Google as part of the request.

Your Rights Regarding Your Information

Some of these rights are the law where you live. Others are not. We offer all of them to every visitor anyway, because good privacy practice shouldn't depend on where you happen to live.

The right to know. You can request a copy of the personal information we hold about you, including what we've collected, where it came from, and who we've shared it with.

The right to correct. If any information we hold about you is inaccurate, you can ask us to correct it.

The right to delete. You can ask us to delete the personal information we hold about you. We'll do so promptly unless we're required to retain certain records for legal, accounting, or tax reasons (for example, invoices from a paid engagement). In those cases, we'll explain what we're retaining and why.

The right to opt out of marketing. You can opt out of any marketing communications from us at any time by clicking the unsubscribe link in any email we send you, or by contacting us directly.

The right to adjust cookie preferences. You can change your cookie consent settings at any time by clicking “Cookie Preferences” in the footer of our site.

The right to non-discrimination. We will not deny you services, charge you different prices, or provide a different level of quality because you exercised any of these rights.

For California residents: Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), you have additional rights including the right to limit the use of sensitive personal information and the right to opt out of the sale or sharing of personal information. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

For visitors from Europe and the United Kingdom: We are a Connecticut business serving clients in the United States, and we do not operate under the GDPR. We are not going to claim otherwise. What we will do is honor the rights listed above for you the same as for anyone else: ask us what we hold, ask us to correct it, ask us to delete it, and we will do it. If you are in Europe and something here concerns you, email us and we will deal with it directly.

Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete that information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the platform or sending an email to the address associated with your account. Non-material changes take effect immediately. Material changes take effect 30 days after notice.

How to Contact Us About Your Data

If you'd like to exercise any of the rights described above, or if you have questions about how we handle your information, contact us at:

Email: josh@mymaverickmarketer.com

We'll respond to data requests within 30 days. If we need more time (for example, because a request is unusually complex), we'll let you know within those 30 days and explain the expected timeline.

To verify your identity before processing a request, we may ask you to confirm information that matches what we already have on file (for example, the email address you used to submit a form). This protects you from someone else requesting or deleting your data.

If you're not satisfied with how we've handled a request, you have the right to escalate. California residents can contact the California Privacy Protection Agency. EU residents can contact their national data protection authority. UK residents can contact the Information Commissioner's Office (ICO).