Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you interact with our Services, you may provide:

• Contact Information: name, email address, phone number, and business information when subscribing to our list, downloading a guide, joining the Small Business MBA, or buying a plan, audit, build, or engagement
• Assessment Data: business operations data, revenue information, team size, and operational challenges submitted through the Operator Readiness Assessment
• Engagement Information: scheduling details, intake responses, and notes from Visibility Plans, the Visibility Audit, the Full Website Build or Rebrand, fractional engagements, The Operator Build, and the AI Marketplace
• Payment and Billing Information: billing address, business name, website, and invoice details when you buy a Visibility Plan, the Visibility Audit, the Full Website Build or Rebrand, a fractional engagement, The Operator Build, or an AI Marketplace agent. You enter card details on Stripe's secure form; they go to Stripe, and we never see or store your full card number
• Communications: emails, support requests, and feedback submitted to inquiry@notebookofacoo.com
• Client Operating Data (fractional clients only): financial reports, team structure, customer mix, sales data, and operational metrics shared under written NDA during an active engagement

1.2 Information Collected Automatically

When you access our Services, certain information is collected automatically:

• Device and Technical Data: IP address, browser type and version, operating system, device identifiers, screen resolution
• Usage Data: pages viewed, time spent on each page, links clicked, navigation paths, and referring URLs
• Analytics Data: aggregated behavioral data collected via Google Analytics (G-Z4DC1V02CJ) including session duration, bounce rate, and traffic sources
• Cookies and Similar Technologies: session identifiers, preference storage, and tracking pixels (see Section 4)
• General Location Data: country and region inferred from IP address. We do not collect precise GPS location.

1.3 Information from Third Parties

We may receive information from third-party services integrated with our platform, including our payment processor (Stripe), our email provider (Resend), and advertising and analytics platforms when you interact with our content. We handle all third-party data in accordance with this Privacy Policy.

Assessment answers. If you take the Operator Readiness Assessment we store the answers you gave, the score and archetype we calculated, what we recommended to you as a result, the page you came from, and the date you took it. We keep this so your result is reproducible, so we can show you how your score moves if you take it again, and so we send you the guide that matches your stage.

Your record with us. We keep one record for each person we have had contact with, and a timeline of what they did: assessment taken, guide requested, workshop registered, question asked, purchase made, and the emails we sent. That record holds a stage, such as lead, member or client, set automatically from those actions and adjustable by our staff. We use it to know where a conversation stands and to avoid sending you something you have already had. Our staff can see this record, including the IP address associated with your activity. We keep it while you have a relationship with us and for three years afterwards, then delete it. You can ask for a copy, or ask us to delete it, at any time using the contact details below.

Qualification check. Where you complete a qualification check for the National Board of Operations Professionals, we collect the answers you provide about your professional experience, together with your email address if you choose to give it. We use this to develop the certification standard and to notify you about candidacy. We do not disclose individual responses to employers or third parties.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing, operating, and maintaining our website and Services
• Processing payments and invoices for Visibility Plans, the Visibility Audit, the Full Website Build or Rebrand, fractional engagements, The Operator Build, and the AI Marketplace
• Delivering the assessment results, free guides, and matched nurture sequence
• Personalizing recommendations based on your assessment results and operator archetype
• Sending transactional communications such as call confirmations, receipts, and engagement updates
• Sending educational and marketing communications including the Notebook of a COO newsletter and new podcast episode notifications. You can opt out at any time.
• Conducting fractional COO engagements: analyzing client operating data under NDA, producing audits, and installing operating systems
• Analyzing usage patterns to improve the Services and create new content
• Preventing fraud, unauthorized access, and abuse of the Services
• Complying with applicable laws and regulations
• Enforcing our Terms of Service and other agreements

3. How We Share Your Information

We do not sell your personal information. We may share your information only in the following limited circumstances:

3.1 Service Providers

We share information with trusted third-party vendors who perform services on our behalf and are contractually bound to protect your data, including: Stripe (payment processing), Resend (all transactional and follow-up email), Railway (hosting for our API, member app and database), InMotion Hosting (hosting for our website and member app), Bunny (encrypted offsite backups of our database), Google Analytics and Google Tag Manager (analytics), and Meta and TikTok (advertising measurement).

3.2 Legal Requirements

We may disclose your information when required by law or when we reasonably believe disclosure is necessary to comply with legal process, protect the rights or safety of our users or the public, enforce our Terms of Service, or prevent fraud or security threats.

3.3 Business Transfers

If Notebook of a COO is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

3.4 With Your Explicit Consent

We may share your information with third parties when you have given us your explicit consent, for example if you agree to be featured as a fractional client case study. You may withdraw consent at any time by contacting us.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies. The types we use include:

• Strictly Necessary Cookies: required for the website to function. These cannot be disabled.
• Analytics Cookies: help us understand how visitors use the site. We use Google Analytics for this purpose. Analytics data is aggregated and anonymized.
• Preference Cookies: remember your settings, language preferences, and choices.
• Marketing Cookies: measure the effectiveness of our marketing campaigns.

You can control cookies through your browser settings and by opting out of specific tracking. For Google Analytics opt-out, visit tools.google.com/dlpage/gaoptout.

5. Data Security

We implement industry-standard technical and organizational security measures including SSL/TLS encryption for all data transmission, encrypted storage of passwords and sensitive account data, payment data handled exclusively by PCI-compliant processors (Stripe, we do not store full card numbers), access controls limiting data access to personnel who require it, and regular review of data collection and storage practices.

However, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Active newsletter subscriptions are retained until you unsubscribe. Closed engagements: basic records may be retained for up to 7 years for legal, tax, and accounting purposes. Payment records are retained as required by financial regulations. Fractional client engagement records (including operating data shared under NDA) are deleted 90 days after engagement end unless the client requests longer retention.

7. Your Privacy Rights

Depending on your location and applicable law, you may have rights to access, correct, delete, or receive a portable copy of your personal information; opt out of marketing emails at any time using the unsubscribe link in any email; object to processing for direct marketing; or request restriction of processing in certain circumstances.

To exercise any of these rights, email us at privacy@notebookofacoo.com. We will respond within 30 days. We may need to verify your identity before processing your request.

8. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@notebookofacoo.com and we will promptly delete that information.

9. International Data Transfers

Notebook of a COO is based in the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using our Services, you consent to the transfer and processing of your information as described in this Privacy Policy. We implement appropriate safeguards, including standard contractual clauses where required, to ensure your information is protected during international transfers.

10. Third-Party Links and Services

Our Services may contain links to third-party websites and platforms, including our podcast on Spotify and Apple Podcasts, our YouTube channel, and social media platforms. We are not responsible for the privacy practices of these third parties. This Privacy Policy does not apply to any third-party sites or services. We encourage you to review the privacy policies of any third-party services you interact with through our content.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we have collected and disclosed, the right to delete your personal information, the right to correct inaccurate information, and the right to non-discrimination for exercising your CCPA rights.

We do not sell personal information for money. We do use advertising pixels from Meta and TikTok and analytics from Google, which means information such as device identifiers and the pages you view may be shared with those companies for cross-context behavioural advertising. California law treats that as sharing, and you may opt out of it.

To opt out of sharing: use our Do Not Sell or Share My Info page. It takes one click, needs no account and no form, and it takes effect immediately in that browser. If your browser sends the Global Privacy Control signal we treat you as opted out already, with nothing for you to do.

To exercise any other California privacy right, including asking what we hold, asking for a copy, asking us to correct it or asking us to delete it, email privacy@notebookofacoo.com. Those rights need us to check who you are first. We will respond within 45 days as required by law.

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or applicable local laws. Our legal bases for processing your data include performance of a contract (delivering Services you have purchased), legitimate interests (improving our Services, fraud prevention), compliance with legal obligations, and your consent (for marketing communications).

You have the right to withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with your local data protection supervisory authority. To exercise your GDPR rights, contact privacy@notebookofacoo.com.

13. The AI Marketplace

13.1 What We Access

When you connect a tool to your agent, we access the data in that tool only to run your agent: to draft, follow up, answer and report the way your playbook says. We never ask for your passwords; you connect tools through secure invites or sign-in permissions you can revoke at any time.

13.2 The People Your Agent Contacts

Your agent handles your customers' and prospects' details on your behalf. For that data we act as your service provider: we use it only to run your agent, never for our own marketing, and we never sell it. Your agent says it is AI, and it honors every opt out.

13.3 Your Intake and Your Playbook

Your intake answers and the playbook written from them are stored in the Small Business MBA and used to set up, train and report on your agent.

13.4 When Your Agent Stops

Our access to your tools ends when your agent stops. We delete the data we copied from your tools within 30 days, except what the law requires us to keep and your invoices.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on this page with a new "Last Updated" date, and for significant changes, we will send a notification to your registered email address. Your continued use of the Services after changes are posted constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team: