YOUR BUSINESS INFORMATION

Privacy and report data.

Updated October 31, 2026

This notice covers the business planning platform operated by Bright Future Consulting LLC. It explains what stays in your browser, what is sent when you request an enabled service and which records remain after that request.

Preview planning and fictional samples

Local sample calculations in protected previews run in your browser. Draft inputs are held in page memory, not automatically saved to an account or browser storage. Download what you need before leaving or refreshing; do not rely on browser navigation to preserve or erase a draft. Local CSV, JSON and printable exports are generated in your browser; downloaded copies remain under your control. The separate sample workspace is for fictional data only.

Do not enter personal identifiers, bank account numbers, card data or confidential free text into planning fields.

Consultation messages

When you submit a consultation, your name, email address, selected service and message are sent through our website and Resend to the company mailbox at yechizhang37@gmail.com. We use these details to handle and reply to your inquiry. This form does not use AI models and does not send a confirmation email to the address you enter. Please avoid confidential financial information.

The application does not save the message body in its database. It keeps hashed request fingerprints, submission status and an email-service reference for up to twenty-four hours to prevent duplicate sending. Hashed IP and email counters expire after fifteen minutes or one hour; the shared sending counter expires after twenty-four hours. Hashing does not guarantee anonymity. The email message remains in the company mailbox and may be retained by the mail provider under its own practices. You can contact the company about access, correction or deletion of your inquiry.

Comprehensive reports, AI and source requests

Only when available and explicitly requested, a saved comprehensive report sends structured financial assumptions, data dates and source declarations, business categories and policy details to our server and to OpenAI and Anthropic. The business name is excluded from the server report and model prompts. This reduces identifying information; it does not guarantee anonymity. Review the consent beside the report button before sending.

Authenticated official-source searches send structured sector, funding-purpose and applicant filters to the source service, without the business name or financial figures. Hosting and external services may process technical request logs. Links to official websites are subject to those websites’ practices.

In protected previews with local calculations, the Pennsylvania and California funding module compares the same business and project answers used by your forecast and financing strategy in this browser tab. Local matching and download buttons do not submit those answers. The enabled comprehensive-report service instead sends the shared assumptions to the server and model providers as described above; signing in does not make that transmission automatic. An optional current-opportunity search sends the selected state and search keywords to our read-only search endpoint. The official California data service receives a fixed Business-listings query without your keywords or business profile; do not enter names or confidential information as keywords. This search does not call an AI model or require an account. Hosting services may log the search URL. Exported files remain on your device.

Sign-in cookies and security

Signing in uses a necessary session cookie to keep your account signed in. The cookie and its server-side session record expire after seven days unless invalidated earlier, for example by signing out. It is sent only over HTTPS, cannot be read by page scripts, and is not used by this application for advertising.

To limit repeated authentication attempts, the application uses hashed versions of the request IP address and email address in security rate-limit counters. These authentication counters expire after fifteen minutes. Other security counters use different windows; account and transaction records do not share this fifteen-minute expiry. Hashing does not guarantee anonymity. Hosting providers may also receive the original request IP address and technical logs.

The website’s application code does not include marketing-tracking scripts. Provider-side logging and any services injected by the hosting deployment have not all been verified; this is not a promise that every external service is tracking-free.

Accounts and retained records

When account services are enabled, account email, password hashes, session records and minimal usage or billing receipts are stored separately from report content. Passwords are salted and hashed; a recovery code is shown once. Email is not verified and cannot by itself recover an account. Keep your password and recovery code private.

Saved report content includes submitted assumptions, calculations, policy evidence, the model-reviewed explanation and its receipt. The active application copy expires after thirty days. You can request earlier deletion of that copy in your account; its minimal receipt is retained. Account closure is available there subject to outstanding balances, requests and payment-record review. Closure does not erase copies you downloaded or records already processed by a third-party provider.

The thirty-day period applies to active application storage, not all copies everywhere. Backup retention and AI-provider retention have not been verified to follow the same period. We do not promise simultaneous deletion from backups or provider systems, or zero retention by those services.

The introductory offer stores a hash of the normalized account email with the used or pending report reference. This prevents a second free place after report deletion or account closure and is retained with the offer ledger. The hash is not anonymous proof of a unique person; email addresses are not verified by this service.

Minimal transaction and anti-abuse records may remain after report deletion or account closure. These retained ledger records do not currently have an automatic deletion date. Records needed for payment reconciliation, disputes and applicable retention obligations are handled separately. For closure review, deletion questions or an explanation of retained records, contact the company or email yechizhang37@gmail.com. Do not email passwords, recovery codes or card information.

Questions and requests about your information

To ask about access, correction or deletion of retained account information, email yechizhang37@gmail.com with “Privacy request” in the subject. Describe the request and the affected service or report reference, if available. Do not attach an identity document, full report or confidential business record to the initial message.

Requests involving an account require verification through the account’s sign-in or established recovery process. Possession of an email address alone does not verify ownership. We do not ask you to email your password, recovery code, payment details or session credentials. If you cannot sign in, explain that in the request so the verification and retention limits can be reviewed.

For an eligible saved report, the account’s deletion control removes its active application content while keeping the minimal receipt. Account closure can require support review when payment history, balances or unresolved requests remain. Neither action removes copies you downloaded or independently controls provider or backup retention. Applicable privacy rights and exceptions depend on the circumstances; this notice does not waive rights available under applicable law.

Local preview drafts are not available to company support. Correct their inputs in the workspace and generate a new report. Downloaded files must be managed on the device where you saved them. See workspace help for input corrections and report exports.

Service providers

Vercel hosts the application and Upstash provides server-side account and billing storage. OpenAI and Anthropic receive only the structured data described above when you consent to an enabled AI request. Stripe hosts checkout if payment collection is enabled; the planning application does not collect card details. Payment references and status are used to reconcile credit, refunds and disputes. Their applicable service terms and privacy practices also govern their processing.

Signed-in report retrieval is restricted to the owning account. A screen marked fictional or test environment must not receive real customer information. The platform can produce incomplete or incorrect results; official references and retrieval dates do not establish current funding or eligibility. See the legal disclaimer and pricing and trial terms.