What this site knows about you

Who is responsible

Vaultfish is operated by Digital Gravity, LLC. "We", "us" and "our" on this page mean Digital Gravity, LLC, which decides what this site collects and why. Reach us about anything on this page through the contact page.

What gets measured

Three analytics tools run here: Google Analytics, Humblytics and PostHog. They count pageviews, referring sites, device and browser type, approximate location, which buttons and links get used, and whether a form was sent. None of them receives what you type into the contact form.

Google Analytics sets analytics cookies so it can tell a return visit from a new one, unless we ask first and you have not said yes (see cookies below). Until then it runs in its consent-denied mode: no cookies, and Google receives cookieless pings. Advertising storage, ad personalization and Google Signals are off for everyone. Google states that Analytics does not log or store IP addresses, and that EU, Swiss and UK traffic is processed on servers in those regions.

Humblytics is cookieless. Per its documentation it stores nothing on your device and recognizes return visits within a single day using a one-way hash of your IP address and device characteristics, which resets every 24 hours. The raw IP address is discarded immediately.

PostHog records pageviews, clicks, form submissions and session recordings, which are replays of how a page was used. Recordings mask everything you type, and the contact form is excluded from capture. PostHog stores an identifier in a cookie and in your browser's local storage. Where we ask first and you have not said yes, it keeps that identifier in the page's memory instead, forgets it when you leave, and records no sessions. Its requests travel through this site's own address (/ingest) to PostHog's US servers. Visitors stay anonymous until they send the fit check or the introduction form. At that point PostHog links your earlier activity on this site to your CRM contact ID, so we can see which pages led to the form. Your name and email are not sent to PostHog.

Your browser tab also keeps the page you landed on, any campaign tags in the link (utm_source and similar) and the outside site that sent you, in session storage.

The fit check and introduction forms send those along with your answers. They are cleared when you close the tab.

Cookies and your choice

Whether we ask first depends on your browser's time zone, because this site has no server that looks up where you are. If the time zone is in Europe, or reads as UTC the way many privacy browsers report it, a small banner asks before any analytics cookie is set. Everywhere else the cookies are on from the first page, and you can switch them off below.

Google Analytics sets cookies whose names start with _ga. PostHog sets one whose name starts with ph_ and keeps a copy in local storage. Nothing is set for advertising.

Decline, or ignore the banner, and no analytics cookie is set. Google Analytics still receives cookieless pings in its consent-denied mode. PostHog still records visits with a temporary identifier that lives in the page's memory, and records no sessions. Your answer stays in your browser's local storage as vf_consent, and if you switch to the light theme, that choice stays there as theme. Neither leaves your device.

Humblytics sets no cookies, whatever you choose.

You can change your answer at any time. Declining after you accepted also deletes the cookies listed above.

What we never collect

Any advertising identifier, and anything you type outside the contact form, the fit check form and the introduction form. The rights check keeps your answers in your browser and sends nothing, except that analytics notes the result category when you finish.

There is no newsletter, so nothing on this site signs you up for one. If a newsletter starts, this page will say where your address goes before any signup form appears.

Forms, booking and chat

The contact form. Messages pass through Vercel, Cloudflare Turnstile and Resend. The site keeps no database for them: your message becomes one email and is used only to reply to you. Contact messages are never sent to analytics and never added to a mailing list.

The fit check and the introduction form. They ask for your name, work email, company, company website, an optional role and phone number, your answers to the readiness questions, the score they produce and the path you pick.

An introduction also carries the details of the person you are introducing, which you confirm you have permission to share.

These forms pass through Vercel, Cloudflare Turnstile and GoHighLevel, the CRM where we read and answer them. If the CRM is unavailable, the same details arrive by email through Resend.

Booking. After you send the fit check, a booking calendar from GoHighLevel loads on the page. Your name and email are passed to it so the booking attaches to your record. GoHighLevel's own privacy policy governs what it stores about a booking.

Chat. The "Ask a question" chat loads from GoHighLevel only when you click it. Messages you send there are stored in the same CRM. The chat may use an AI assistant trained on this site's pages, and you can ask for a person at any point.

Email. If you email a vaultfish.com address instead, Cloudflare Email Routing forwards it to our inbox.

Who processes your details

These companies handle your details on our behalf, each for the one job listed.

Vercel

Hosts the site and passes form submissions on to the CRM and to email.

Cloudflare

Runs Turnstile, the spam check every form needs, and forwards email sent to our vaultfish.com addresses to our inbox.

GoHighLevel

The CRM that holds fit check answers, introductions, bookings and chat messages.

Resend

Delivers contact form messages by email, and a copy of a fit check result or introduction when the CRM is unavailable.

Google Analytics

Counts visits. Where we ask first, it sets no cookies until you accept.

Humblytics

Counts visits without cookies.

PostHog

Product analytics and masked session recordings, through this site's own address.

Introductions and referral fees

We share your details with a company only when you tick that company's box, and we send the introduction ourselves, by email, after you have talked.

Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. How we are paid.

How long we keep it

We keep CRM records while we are in touch and for up to 24 months after the last contact, then delete them. PostHog events and recordings are removed when you ask and otherwise expire under the retention settings of our PostHog project.

Seeing or deleting your details

To see or delete everything we hold about you, send a request through the contact form with the email you used. We remove your CRM record, your PostHog person and any email copy within 30 days and tell you when it is done.

Your choices

The cookie settings button under cookies and your choice changes your analytics answer at any time.

Standard tracker blockers and browser privacy settings work as expected here, and the site stays fully readable with them switched on. The exceptions are the forms, which need the Turnstile spam check to load before they can send. If it is blocked, everything else still works.

Changes and questions

When the setup changes, this page changes with it and the date at the top moves. If something here looks off, tell us through the contact page. A person reads every message.