Privacy policy

Effective and last updated: 9 November 2026

1. Who we are

The controller of your personal data is JSMN EQT LLC, doing business as cacrunner (also trading as levelpartner.ai), 15 Main St Unit 470, Flemington, New Jersey 08822-7423, United States. Contact for privacy questions: privacy@levelpartner.ai. General contact: support@levelpartner.ai, +1 866-261-9691.

We run demand tests (also called smoke tests or fake-door tests) for our clients: investors, founders and agencies who want to know whether people would buy a product before it is built. We operate the test pages and are the controller of the data collected on them. Our clients receive aggregated results, and the contact details of people who ask to hear about the launch (see section 5).

2. What this policy covers

• Our website cacrunner.com, including the contact form.
• Demand-test pages we run for clients, under cacrunner.com/t/… or on a domain registered for a specific test. Each page links to this policy.
• Clients and prospects who apply for or buy a test.

3. How a demand test works, and what that means for you

A demand test shows an ad for a product that is not available yet. If you click, you see a product page and can start a checkout. The checkout asks only for your name, email and country, and never for payment details. When you click “Pay”, the next page tells you plainly that the product is not live yet, that nothing was charged and that no card data was taken. You can then choose to be told when it launches. More detail: About our demand tests.

For a small number of tests a client may choose a version where a card is saved with our payment provider Stripe but not charged. That page says so clearly before you enter anything, and the card details go directly to Stripe; we never see or store them.

4. What we collect

When you visit cacrunner.com

• Technical data our hosting provider Cloudflare processes to deliver and protect the site: IP address, browser and device information, the page requested and the time. We use no advertising or analytics cookies on cacrunner.com.
• A small session-only setting in your browser so the intro animation plays once per visit (see the cookie policy).

When you use the contact form

• Your name, email, the role you select and your message.

When you visit a demand-test page

• Page events: page views, the “Buy now” click, the “Pay” click, the reveal view and the launch-notice opt-in, each with a random event id, a random visitor id kept in a first-party cookie, the time, and whether you accepted marketing cookies.
• Ad attribution: the campaign parameters in the link you clicked (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and Meta’s click id (fbclid).
• What you type at checkout: name, email and country.
• Launch-notice choice: only if you tick the box, we record that you opted in, the time and the version of the wording you saw (current version 2026-11-09.1). The box is never ticked for you.
• Security data: IP address and browser user agent, used to block automated traffic and abuse, and, if you accept marketing cookies, sent to Meta as described below.

If you are a client

• Contact and company details, your answers to our onboarding questions, the test configuration, ad spend entered for the report, and billing records.

5. Why we use it, and our legal bases

We do not use your data for automated decisions that have legal or similarly significant effects on you.

6. Meta Pixel and Conversions API

Demand-test pages show a cookie banner with equal “Accept” and “Reject” buttons. Only if you click Accept:

• the Meta Pixel loads in your browser and tells Meta about page views and the test steps (checkout started, purchase intent, reveal viewed, opt-in);
• our server sends the same events to Meta’s Conversions API with the same event id, so each event is counted once. These events can include your email address, lowercased and hashed with SHA-256 before it leaves our server (we never send the raw email), Meta’s click id, your IP address and your browser user agent.

If you click Reject, make no choice, or your browser sends a Global Privacy Control signal, nothing is sent to Meta and the Pixel never loads. Meta processes the data it receives under its own terms and privacy policy. For the collection and transmission of data through the Pixel, Meta Platforms Ireland Ltd and we may be joint controllers under EU law; for the processing after transmission Meta is responsible. You can also manage ad settings in your Meta ad preferences.

7. Who we share data with

• The client the test was run for: aggregated results (counts, rates, costs; no names or emails). If you opted in to the launch notice, also your name and email, so they can tell you about the launch. They may only use it for that purpose.
• Cloudflare, Inc. (hosting, database and security), as our processor.
• Meta Platforms, only with your consent, as described in section 6.
• Stripe, only on tests that save a card, as an independent controller for the payment data you give it.
• Professional advisers and authorities where the law requires it, or to protect our rights.

We do not sell personal data. Sending data to Meta for ad measurement after you click Accept can count as “sharing” under some US state laws; Reject or a Global Privacy Control signal opts you out.

8. International transfers

We are based in the United States and our providers may process data in the US and other countries. Where EU or UK data is transferred, we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (with the UK addendum), plus additional safeguards such as encryption in transit and hashing of emails before they reach Meta.

9. How long we keep data

• Checkout details of people who did not opt in: deleted automatically 30 days after the checkout.
• Launch-notice opt-ins: until the launch notice is sent or you unsubscribe, and at most 1 year after you opted in.
• Pseudonymous page events and visitor records: 2 years, so results can be audited.
• Contact-form messages: 2 years.
• Client and billing records: as long as the law requires for accounting and tax (usually 7 years).

10. Your rights

Depending on where you live, you have the right to:

• access your data and get a copy;
• correct it or have it deleted;
• restrict or object to processing based on legitimate interests;
• data portability;
• withdraw consent at any time, without affecting earlier processing;
• opt out of the “sale” or “sharing” of personal data and of targeted advertising (US state laws);
• not be discriminated against for using these rights;
• complain to your data-protection authority.

To use any of them, email privacy@levelpartner.ai. Tell us the email you used and, if you can, the test page. We reply within 30 days (45 days where US state law allows) and may need to verify your identity. You can unsubscribe from a launch notice with the link in that email. Withdraw cookie consent by clearing the site’s cookies; the banner then appears again.

11. Security

Data is encrypted in transit (HTTPS with HSTS), stored with Cloudflare, and access is limited to people who need it. Admin access requires a one-time login link. Emails are hashed before they are sent to Meta. No system is perfectly secure; we will notify you and the authorities of a breach where the law requires.

12. Children

Our services are not directed at children under 16, and our ads are not targeted at them. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes

We update this policy when our practices change. The date at the top shows the latest version; material changes are highlighted on this page.

14. Contact

JSMN EQT LLC, 15 Main St Unit 470, Flemington, New Jersey 08822-7423, United States · privacy@levelpartner.ai · +1 866-261-9691