Market-validation privacy notice

What this test collects, and why.

Last updated: August 18, 2026. This notice covers only the limited MV3 Replay market-validation test. It does not cover a released product.

Current status: this is a limited public market-validation test for a proposed product, not a released service. Form responses are transmitted only after an explicit submission and retained for the periods below; optional interaction events are sent only after the visitor chooses “Allow analytics.” MV3 Replay is the public project identity, the operator is located in Quebec, Canada, and no payment is requested or accepted.

Who is responsible

Project: MV3 Replay (product-validation project)
Privacy lead / Responsable de la protection des renseignements personnels: Privacy Lead
Email: privacy@mv3replay.com
Operator location: Quebec, Canada

The personal name and home address of the person holding this role are not published. Questions, privacy requests, and complaints can be sent to the monitored email above.

Information used in a public validation test

During this limited public validation, the site uses only the following information:

• Information you submit: email address; proposed plan; price response; role; team-size range; commercial status; release-frequency range; extension surfaces tested; and current testing method.
• Optional limited test events: only after you choose “Allow analytics,” the pages or concept steps reached, selected message variant, viewport category, and server time.
• Limited attribution: allowlisted source, campaign, and exact-keyword labels contained in the landing URL. Form answers and email addresses are not sent back to an advertising platform.
• Short-lived identifiers: after your analytics choice or form request, a random identifier is stored in the current tab’s sessionStorage. If analytics are allowed, it is stored with raw events for up to 30 days; if the form is submitted, it is also stored with that response for up to 7 or 180 days. A condensed session record may remain for up to 365 days. Confirmation and response-management tokens are stored only as hashes.
• Abuse prevention: the server transiently inspects the user-agent and may use Cloudflare’s bot score. It may process a network address transiently to rate-limit requests. The application does not write the user-agent, bot score, network address, or its derived rate-limit value to the validation database. Cloudflare may process connection and security logs under its own terms.

Information intentionally excluded

Do not submit extension source code, manifests, credentials, customer data, production secrets, payment information, or confidential business information. The proposed validation does not use advertising pixels, browser fingerprinting, persistent cross-visit identifiers, full referrer URLs, or stored full user-agent strings. No payment is requested or accepted.

Purposes

The information is used only to measure demand for the described concept, compare the two pre-registered messages, count non-duplicate responses, confirm that a response came from the submitted email address, prevent abuse, and answer privacy requests. It is not sold, used to build advertising audiences, or used for automated decisions about an individual.

No marketing: No newsletter, promotional follow-up, sales outreach, or product announcement is sent. The single email is requested explicitly in the form and contains only confirmation, export, and deletion links. Sending must be disabled if its content or purpose changes.

Service providers and processing location

The operator is located in Quebec, Canada. The limited English-language advertising test targets only Canada and the United States. The working privacy assessment covers those target locations and the described cross-border processing.

Infrastructure: Cloudflare Workers, D1, and Email will host the page, protect requests, store validation responses, and send the requested confirmation. Cloudflare and its subprocessors may process information outside Quebec and Canada, including in the United States and other listed regions. Cloudflare’s current Data Processing Addendum and subprocessor list are linked here for transparency and must be reviewed again before any material expansion of the test.

Advertising: Google Ads is planned only to deliver search advertisements and add allowlisted campaign labels to the landing URL. This site has no Google advertising pixel and does not send email addresses, form answers, or conversion events to Google. Google’s own processing of ad interactions is governed by its notices.

Retention and deletion

The public backend is configured to apply the following schedule:

• the browser-held copy of the session identifier ends with the browser-tab session; server-held copies follow the separate 7-, 30-, or 180-day limits below, and only a condensed digest may remain for up to 365 days;
• confirmation tokens expire after 24 hours, and unconfirmed submissions are deleted within 7 days;
• raw funnel events are deleted within 30 days;
• confirmed email addresses and questionnaire responses are deleted on a verified request, if the concept is abandoned, or no later than 6 months after submission, whichever comes first;
• a minimized session-level deduplication record, without email address, network address, exact time, full referrer, or full user agent, is treated as protected information and deleted no later than 12 months after its source event; and
• aggregate statistics that no longer relate to an identifiable person may be retained.

Safeguards

The implementation uses encrypted transport, an application-encrypted email field at rest, hashed confirmation and management tokens, a single-use confirmation token, strict field allowlists, rate limits, production-only secrets, export and comprehensive deletion controls, and automatic retention jobs. The management token remains usable for export or deletion until the linked responses are deleted. No safeguard can eliminate every risk; collection must be disabled if these controls fail.

Your choices and rights

Analytics are optional and disabled until you choose. The purchase-interest validation form is also optional. Its confirmation email contains a private management link for structured JSON export and deletion. To correct an answer without contacting anyone, delete the response and submit a corrected one. You may also request access, correction, withdrawal, deletion, or make a complaint at privacy@mv3replay.com. Identity may be verified using the submitted email address or management token. Applicable legal exceptions may limit a request.

You may also contact the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada. This notice is informational and is not a promise of legal compliance or legal advice.

Changes

Any material change to the information collected, its purposes, providers, processing locations, or retention will be described here before the change takes effect. If a new use requires consent, it will be requested separately.

Avis de confidentialité — validation de marché

Ce que ce test recueille, et pourquoi.

Return to the concept / Retour au concept