Privacy.
Sell to America is run by 3FOLD LLC, 1413 Ave Ponce de León, Ste 401, San Juan, PR 00907, United States. 3FOLD LLC is the data controller. This page says what we collect, why, where it goes, and how to get it back or delete it. Plain language on purpose.
The short version
We collect your email to sign you in. We store the business work you save. When you run an AI tool, your input and profile go to our AI provider to produce the reply. We never sell your data. We use no advertising trackers, pixels or session replay. You can export or delete everything from your account page.
What we collect and how long we keep it
| Data | What | How long |
|---|---|---|
| Account | Email address, account id, sign-in dates, membership status | While your account exists. Deleted when you delete the account. |
| Saved work | Business profile, chosen American, offer, drafts, worksheets, quiz results, actions and outcomes | While your account exists. Guest drafts stay in your browser only. |
| AI requests | The text you submit, your profile, and the opportunity you selected | Sent to the AI provider for the reply. A completed reply is cached for 24 hours so a repeat does not cost an action. Not stored by us beyond your saved work. |
| Billing | Stripe customer id, subscription id, status, dates. Stripe holds card details, not us. | Seven years for tax and accounting records, as the law requires. |
| Emails | Sign-in codes, weekly digest preference and consent date, unsubscribe token | Codes expire in 10 minutes. Preferences while your account exists. |
| Usage limits | A hash of your IP address for preview limits and abuse protection | 36 hours for preview limits. Hourly for sign-in limits. |
| Funnel counts | Daily counts of visits, signups, checkouts and completed tool runs. No content, no profile. | 400 days. |
| Feedback | Text you send us through the feedback box | 180 days. |
| Launch list | Email and consent date if you asked to be notified before launch | 180 days. |
Why we process it and the legal basis
Under the GDPR and UK GDPR, we rely on these bases.
- Contract. Your account, saved work, AI replies, billing and sign-in emails exist to deliver the membership you asked for.
- Consent. The weekly digest email and the launch list. You opt in. You can withdraw at any time in Account or with the link in every email.
- Legitimate interest. Usage limits, abuse protection, security logs and anonymous funnel counts. These keep the product working and keep costs sane. We balanced this against your rights and kept the data minimal and short lived.
- Legal obligation. Billing records we must keep for tax and accounting.
How the AI works with your data
The AI tools and the feed pipeline use large language models from Anthropic, and OpenAI where configured. When you run a tool, your input, your saved profile, your chosen American and offer, your recent outcomes and the selected opportunity are sent to the provider to produce the reply. Under the API terms we use, the provider does not train its models on your inputs or outputs.
Every reply is machine generated. We label it as a draft and we tell you to check it before you use it. We do not use AI to make decisions about you that have legal or similar effects. The AI is instructed never to infer or use your religion, ethnicity, health or other protected traits, and to refuse fake proof and deceptive copy. Feed cards written by the pipeline are marked as AI drafted and are checked against their source before they publish.
Leave customer names, account details, health and financial records out of what you submit. The tools do not need them.
Who receives your data
- Vercel hosts the app and keeps security and reliability logs.
- Upstash stores account and saved work data.
- Anthropic and, where configured, OpenAI run the AI requests.
- Stripe handles payment and holds card details. We never see your card number.
- Resend sends sign-in codes and the digest you opted into.
These providers are in the United States. Where you are in the EU, UK or Switzerland, transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on standard contractual clauses in our agreements with them. We share nothing with advertisers or data brokers.
Cookies
One cookie, sta_session, keeps you signed in. It is strictly necessary, so no consent banner is needed. Browser session storage stops the same page from being counted twice in one visit. Guest drafts live in your browser's local storage until you clear it or bring them into an account. No third party cookies. No cross site tracking.
Your rights
Wherever you live, you can access, correct, export or delete your data, restrict or object to processing, and withdraw consent. In the EU and UK you can also complain to your supervisory authority. In California you have the right to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information as the CCPA defines those terms, and we treat any Global Privacy Control signal as an opt out.
- Export. Account → Export my work downloads everything you saved as a file.
- Delete. Account → Delete my account cancels any active subscription and erases your account, saved work, preferences and rankings within minutes. Billing records stay for the legal period without your saved work attached.
- Everything else. Email hello@3fold.me. We answer within 30 days and may ask you to confirm you own the account.
Security
Sign-in uses one time codes, hashed before storage, that expire in ten minutes. Sessions are random tokens stored as hashes. Data in transit is encrypted. Only named administrators can reach account data, and only for support, billing or safety. If a breach affects you, we will tell you and the relevant authority as the law requires.
Children
You must be 18 or older. We do not knowingly collect data from anyone younger. If that happens, email us and we delete it.
Changes
When data handling changes we update this page and the date at the top. Material changes to paid members are announced by email. Read the terms for the rest.