Privacy Policy.

1. Who we are

This site is operated by Mentrup Group LLC ("we", "us", "InsiderHub"), a California limited liability company.

Registered address: 6310 San Vicente Blvd #106, Los Angeles, CA 90048, United States.

Contact: hello@insiderhub.co.

This site is directed to businesses in the United States. Our company, our staff, and the vendors we use are in the United States, so any personal information you send us is processed there.

2. What we collect

Data reaches us two ways: you type it into a form, or a measurement tool on the page records your visit.

2.1 Contact form

When you fill in the contact form on our contact page, we receive your name, company, work email, phone number, team size, the workflow "symptoms" you select, and whatever you write in the message field. Along with it we record the page URL you submitted from, your browser's user-agent string, the time of submission, and a Cloudflare Turnstile token that shows the submission came from a person rather than a script.

We use the phone number to reply to you and to schedule and confirm your audit, including by text message to that number. Message and data rates may apply, and you can reply STOP to end texts at any time. We do not send marketing texts or marketing email off the back of a contact-form submission. If you want those, you have to opt in later.

If you have used one of our interactive tools in the same browser session, a short summary that the tool generated may already be filled into the message box when the page loads. Your browser holds that summary in session storage and hands it to the form. It is submitted with the rest of your message unless you delete it first.

2.2 Resource download forms

Our resource pages ask for your name, email, and optionally your company before sending you the template or checklist. We record which resource you asked for, the page URL, your user-agent string, the time, and a Turnstile token. The email address you give us is added to a follow-up email sequence about the resource and about what we build. Every message in it can be unsubscribed from.

2.3 Interactive tool pages

Some resources include a scorecard or calculator at /resources/<name>/tool/. Your answers stay in your browser while you work through the questions. When you click the button that asks us for help or books an audit, we receive: every answer or figure you entered (including any staff cost, hourly rate, headcount, hours worked, and tool names you typed), the score, tier, and summary the page calculated, the page URL, the page you arrived from, and the lead identifier described in section 2.5.

2.4 Automatically, on every page

Two measurement tools load on every page of this site after the page has finished painting. There is no consent gate: they load for every visitor except in the two cases below, or unless you block them using one of the routes in section 9. Between them they collect your IP address, the approximate location it implies, your browser, device, and operating system, the page you arrived from, the pages you view, timestamps, and how you move through the page.

If your browser sends the Global Privacy Control signal, neither tool loads for that visit. Section 7 sets out which browser signals we honor and which we do not.

If you have used the opt-out button on our Do Not Sell or Share page in this browser, neither tool loads here from your next page view onward. Section 8 explains how that works and what it covers.

• Microsoft Clarity records a replay of your visit. That includes mouse movement, clicks, scrolling, and changes to the page as you interact with it, so we can watch back where people get stuck. Masking in our Clarity project is set to Strict, so text, numbers, and form inputs are all masked in the recording. We use Clarity for heatmaps and for interaction problems such as dead clicks and rage clicks, not to read what you type or what you see on the page. It also receives the named events listed in section 2.6.
• Google Analytics 4 (property G-P3TH1QJ183) counts page views and sessions. Google's Enhanced Measurement is on, which adds scroll depth, clicks to other sites, and file downloads. Google Signals is turned off on our property, so Google does not associate your visit here with a signed-in Google account for demographics, interests, or advertising audiences. We use no advertising or remarketing features. If we ever turn Signals on, we will say so here first. Even so, California law defines "sharing" broadly, and analytics run by a third party can fall inside it, which is why the page in section 8 exists.

2.5 The identifier in links we email you

When we email you a link to one of our tool pages, that link carries an identifier for your record in our CRM as ?id= in the address. If you arrive that way, we send that identifier to Google Analytics as a User-ID, which is Google's sanctioned mechanism for an internal, non-personal identifier. It lets us follow a known lead's visits across sessions and devices. It also goes to the automation service that receives your tool submission.

We no longer send that identifier to Microsoft Clarity as a custom tag. The page address Clarity records may still contain it, because it is part of the URL you opened.

In plain terms: on those visits the analytics are linked to your record with us rather than being anonymous. If you would rather they were not, delete everything from ?id= onward before you open the link, or use one of the routes in section 9.

2.6 Interaction events

Both measurement tools also receive named events describing what you did, with parameters attached. These are: clicks on our calls to action and where on the page they sat, the label and destination of navigation and footer links you click, opening the mobile menu, flipping a card open, opening a stat tooltip, toggling a symptom chip on the contact form, starting the contact form, submitting it successfully along with your team size and how many symptoms you picked, form validation and network errors, resource downloads with the resource name, and on tool pages your score, tier, and any campaign parameters in the URL. Where a link is an email address or a phone number, we record that it was clicked and where on the page the link sat, not the address or the number itself.

3. Cookies and similar technologies

These are the cookies and browser-storage entries this site and its vendors set. Durations are approximate, and for the vendor entries they are set by the vendor rather than by us.

On your first visit a notice bar appears telling you that cookies and analytics are in use, with links to this policy and to our Do Not Sell or Share page, and an OK button. Dismissing it stores a timestamp in ih_notice so it does not show again. Dismissing it does not change what loads on the site: it is a notice, not a consent gate. The control that changes what loads is the opt-out button described in section 8.

Section 9 lists what actually works if you want these gone. Blocking them does not stop the site from working: nothing on this site depends on analytics, and only the form pages need Turnstile.

4. How we use it

• To reply to you, schedule calls, and send proposals or scoping documents if we keep talking.
• To send you the resource you asked for, and follow-up email about it.
• To operate, maintain, secure, and improve the site.
• To see which pages and messages work, using the aggregate numbers and the recordings.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To comply with legal obligations and enforce our agreements.

We do not use this data to make automated decisions about you, and we do not use it for creditworthiness, lending, insurance, employment, or housing purposes.

5. Who else receives it

These are the vendors that actually receive data from this site today.

• Cloudflare hosts and serves the site, and provides the Turnstile bot check on the 11 pages that carry a form. It sees request data such as your IP address, user agent, and the path you requested, plus the device and browser signals Turnstile uses to tell people from scripts.
• Microsoft receives the session replays, heatmaps, and events described in section 2.4, through Microsoft Clarity.
• Google receives the page views and events described in section 2.4, through Google Analytics 4.
• LeadConnector / HighLevel is our CRM. Everything you submit through the contact form or a resource form is stored there, and our follow-up email is sent from it.
• An n8n workflow automation server we operate ourselves, at n8n.brokerbuddy.co, receives the tool submissions described in section 2.3 and passes them into our CRM. It is our own infrastructure, not a third-party service.
• Professional advisers such as our accountant or legal counsel, where there is a reason for them to see it.

We do not use Meta, LinkedIn, Hotjar, HubSpot, or any chat widget on this site, and there is no advertising or retargeting pixel on any page. If that changes, this section changes with it.

6. How long we keep it

Some of these periods are set by vendors on their own schedules rather than by us. Where that is the case we say so instead of quoting a number we cannot stand behind.

• Form submissions in our CRM. Kept while we are in contact and afterwards for as long as we need them for tax, accounting, and dispute purposes. Deleted sooner if you ask.
• Follow-up email lists. Kept until you unsubscribe or ask us to delete you, then suppressed so we do not add you back by accident.
• Google Analytics data. Event-level data is kept for the retention window set on our Analytics property under Google's own limits. Aggregate reports outlive that window.
• Microsoft Clarity recordings. Deleted by Microsoft on its own rolling schedule. We do not export or keep separate copies of recordings.
• Tool submissions. Held in the automation service's execution history for as long as that service keeps its logs, and in our CRM under the CRM rule above.
• Cloudflare request logs. Kept for the period Cloudflare's platform applies. We do not maintain our own server logs, because there is no server to log.

7. Do Not Track and Global Privacy Control

We honor Global Privacy Control (GPC). If your browser sends the GPC signal, neither Microsoft Clarity nor Google Analytics loads on this site for that visit. We treat it as an opt-out of sale and sharing. Nothing else is needed from you, and it applies on every page.

We do not honor Do Not Track (DNT). DNT is deprecated and has no legal standing, and browsers send it inconsistently, so we do not act on it. If you turn DNT on and nothing else, the tools in section 2.4 still load. California law requires us to say that plainly, so we are saying it plainly rather than burying it.

GPC is a browser setting or an extension, not something you switch on here. Our Do Not Sell or Share My Personal Information page names the browsers that send it and how to turn it on in the ones that do not.

8. Do Not Sell or Share My Personal Information

We do not sell personal information for money, and we never have. But California law defines "sharing" broadly enough that third-party analytics and session replay of the kind described in section 2.4 may count, so we treat it as if it does.

Do Not Sell or Share My Personal Information sets out what we do, what we do not do, and every way to opt out, with the steps for each.

The quickest route is the button on that page. One click stores a flag in your browser, expires the analytics cookies listed in section 3, and stops Google Analytics and Microsoft Clarity loading here from your next page view onward. It works per browser and per device, so use it again in any other browser you visit us with, and clearing site data removes it. The same button switches you back if you change your mind. To have your CRM record deleted, email us instead: a browser flag cannot reach records we already hold.

We do not collect sensitive personal information as California law defines it, so there is nothing for a "limit the use of my sensitive personal information" request to limit. That page explains why.

9. Your choices and your rights

These are the opt-outs that work on this site today. We are not going to describe a control we have not built.

• Use the opt-out button on our Do Not Sell or Share page. One click stores a flag in that browser, expires the analytics cookies for insiderhub.co, and stops both tools loading here from your next page view onward. It covers that browser on that device only, and clearing site data removes it. The same button switches you back.
• Turn on Global Privacy Control. When your browser sends the GPC signal, neither tool loads here at all. Some browsers send it by default and others need a setting or an extension; the Do Not Sell or Share page names which is which.
• Email us. Write to hello@insiderhub.co and tell us what you want. We will delete your records from our CRM and, where you ask us to, pass a deletion request to the vendors named in section 5.
• Install the Google Analytics Opt-out Browser Add-on. Google publishes it for the major desktop browsers. It stops Analytics collecting from your browser on this site and every other one.
• Block the two measurement domains. Blocking clarity.ms and googletagmanager.com in your browser settings, or in a content blocker, stops both tools from loading here at all. Most content blockers already block them by default.
• Clear your cookies and site data for insiderhub.co, which removes the identifiers in the table in section 3. New ones are set on your next visit unless you also block the domains above.

Separately from those, you can ask us at any time what we hold about you, to correct anything wrong, to delete it, or to send you a copy. The California Consumer Privacy Act gives California residents those rights by name, including the right not to be treated worse for using them. We honor all of them for any US resident who asks, whether or not the statute technically applies to us. Email hello@insiderhub.co and we will respond within 45 days, and tell you if we need longer.

If someone submits a request for you, we may need to confirm with you directly before we act on it.

10. Children

This is a business-to-business site. We do not knowingly collect data from anyone under 16. If you believe a minor has submitted a form, email us and we will delete it.

To be clear about the two ages you may see in our policies: 13 is the threshold set by the US Children's Online Privacy Protection Act (COPPA), and it is the line our Chrome extension policy states. 16 is our own stricter policy for this website. Neither is a product aimed at children.

11. Security

The site is served over HTTPS with HTTP Strict Transport Security. Form submissions are posted over TLS to our CRM. We use Cloudflare Turnstile to filter automated submissions. We do not store passwords or payment information on this site, and there are no accounts.

No method of transmission over the internet and no method of electronic storage is perfectly secure. We use reasonable technical and organizational measures to protect personal information, but we cannot guarantee its absolute security. You transmit information to us at your own risk.

12. Where your data is processed

We are a US company serving US businesses, and the vendors named in section 5 process this data in the United States. If you contact us from outside the United States, your submission is transferred to and processed in the US, which may have different data protection laws than your country.

13. Changes to this policy

If we change anything material, we will update the "last updated" date at the top. If we add or remove a tool named in section 2 or section 5, this page changes in the same release. We will not retroactively erode rights you had when you first contacted us.

14. Contact

Questions, requests, complaints: hello@insiderhub.co.

Postal: Mentrup Group LLC, 6310 San Vicente Blvd #106, Los Angeles, CA 90048, USA.