Privacy Policy

What this service does

Market Validation Tool gives a free AI-written verdict on a business idea and sells full AI-written validation reports. It uses no live market data. This policy explains what data the site uses and why; our payment and AI providers have their own privacy terms.

Data we collect and how we use it

• Free checks (no account needed): the idea you submit, the verdict, the check's status, the model's token counts, the time, and a one-way salted hash of your IP address (for an IPv6 address, of its /64 network prefix). The hash enforces the limits of one free check per IP address per UTC day and five attempts per IP address per UTC day; we never store the IP address itself. Free checks are kept for 7 days under an unguessable link so you can unlock the full report for the same idea, then deleted; anyone you share the link with can see the idea and verdict until it is deleted. We also keep counts of free checks and "unlock" clicks without the idea text; if you are signed in, the count is linked to your account.
• Account: your name, email address and sign-in records, used to sign you in and keep your reports private. At sign-up we also store the campaign parameters and referring site from the attribution cookies described below, your country as estimated by Cloudflare from your IP address (we keep only the two-letter country code, not the address) and your browser language, to understand where sign-ups come from. We do not store your IP address with your account.
• Full reports: the idea, the report text, its status, dates, request identifiers and token usage, stored with your account so you can find reports in your private history and so a failed report returns its credit once.
• Content-safety records: every idea is screened before analysis. For each check we keep the time, verdict, reason code, matched categories, the check's status details and request ID, error text when the check fails, and your account ID when you are signed in. The idea itself is kept in that record for review only when it does not pass or the check cannot be completed.
• Credits and orders: credit grants, use and returns, order identifiers, amounts, status, the payment email address returned by Waffo Pancake (waffo.ai), our merchant of record, and refund or chargeback adjustments. We never see your card number.
• Cookies: necessary session cookies, and 30-day attribution cookies (utm_* campaign parameters and the first referring site) set when you arrive from a campaign link or another website. Attribution cookies are used only to record where sign-ups come from.
• Operations and support: service logs and the support tickets you send.
• How long we keep data: free checks are deleted after 7 days, as described above. Your account, reports, credits, orders and support tickets are kept until you ask us to delete your data. When you do, we delete your sign-in data (sessions, sign-in methods and pending email or password links), your reports and your support tickets, and anonymize your account: your email address, name, profile picture and sign-up attribution are removed. We keep the following, linked to the anonymized account ID: payment records, including the email addresses on your orders and the payment details Waffo Pancake sent us, for tax, accounting and dispute rules; your credit history, without your email address; content-safety records, including any idea text they hold; and the counts of your free checks and "unlock" clicks. Content-safety records and service logs have no automatic deletion.

Do not submit confidential, personal or sensitive information as an idea.

Who receives data

• Waffo Pancake (waffo.ai) screens each idea with its Prompt Sift content-safety check before analysis; Waffo states that the check keeps no prompt text after returning its result. Waffo is also our merchant of record: it runs checkout, takes payment, calculates tax and processes refunds. When you start checkout we send Waffo your account email address, and Waffo also receives the email and billing details you enter at checkout.
• DeepSeek receives the idea together with our fixed analysis instructions and returns the verdict or report text, under DeepSeek's own terms. DeepSeek is based in China; its privacy policy states that it processes and stores data in the People's Republic of China.
• Cloudflare hosts the site and its database.
• The sign-in provider you choose (such as Google) and our email delivery provider process the data needed to sign you in and send account emails.

We do not sell your ideas, reports or personal data.

Your rights

You can see your reports in your private history, your credits and your payments. You may ask us to access, correct, export or delete your data, or object to its processing: signed-in users can open a support ticket, and anyone can email the support address below. We answer as applicable law requires. Order and payment records may be kept longer where tax, accounting, fraud-prevention or dispute obligations require it.

We may update this policy; the date above identifies the current version.