Privacy Policy

This policy explains what SecondOrder Systems LLC (“SecondOrder,” “we,” “us”) collects when you use secondordersystems.com and the free tools on it, why we collect it, how long we keep it, and how to have it removed. It is written to be checked against what the site actually does, not to cover every possibility. If something here turns out to be wrong, tell us and we will fix the site or the policy, whichever is out of line.

Client engagements (managed builds, trials, leadership retainers) are covered by a separate signed agreement that takes precedence over this policy for the data handled inside that engagement. This policy still governs the website.

The short version

• Apart from the usage measurement described below, we collect what you type or tap into a form on this site, plus, for the Audit and the inquiry forms, how you arrived: the campaign tags and the referring site on the link you came in on, and the page you first landed on.
• If we write to your company first, we use only contact details your company has published itself, send at most three short emails, and stop for good the moment you reply “no” (section 1).
• The free tools (Renewal Radar, Payer Risk Check) read your file in your browser. The file is never uploaded. If you ask us to email you the summary, we receive your email address and the headline numbers shown on screen, never the rows.
• We do not sell, rent, or share your information for anyone else’s marketing.
• No advertising trackers. Analytics is cookie-free, and our own usage measurement stores no IP address, no browser details, no email address, and nothing from your files.
• Email info@secondordersystems.com and we delete everything tied to your address, except billing records the law requires us to keep and the entry that stops us emailing you again.

1. What we collect, and where it goes

Here is every form on the site and the tables it writes to.

• Inquiry and contact forms — name, email, company, phone (optional), revenue band, the platform you run on (and, for some platforms, whether your account includes API access), the builds you ticked, what you wrote about your situation, which page you sent it from, if you tell us, how you heard about us, and how you arrived (the campaign tags, referring site and first page of your visit, as for the Audit). Stored in leads.
• The SecondOrder Audit — the system you run and, for Aspire, whether your account includes API access; your answers to the Audit’s statements; your email and, if you give them, your role, revenue band, company, how you heard about us and who referred you; the resulting scores, the next step we suggested and an internal priority we use to decide whom to write to first; the campaign tags, referring site, the page you first landed on and the two random visit identifiers (section 4) of the link you arrived on; and the calendar date on your device when you took it. Stored in audit_responses. Each submission is also sent to our own inbox so a person can read it; deleting your information removes that copy too. Taking the Audit schedules three follow-up emails (days 2, 7 and 14) with your results and plan; each one carries an unsubscribe link, and unsubscribing cancels the rest. You join the monthly newsletter only if you tick the box. Kept for 24 months and deleted on request.
• Newsletter — email and where on the site you signed up. Stored in subscribers.
• Earlier forms — an application form and resource sign-up cards that are no longer on the site. Anything sent through them is kept in design_partner_applications and downloads under the limits in section 7, and deleted on request.
• “Email me the summary” on a free tool — your email, which tool, and a short list of the headline figures the tool displayed (counts, totals and percentages; at most twelve short values, never a row, a name, or an invoice). Stored in tool_runs. This also adds you to subscribers so we can send the monthly note; unsubscribe any time.
• Starting a trial — name, email, company, and which build. Your card is entered on Stripe’s hosted page and we never see or store the card number. Stripe returns a customer reference, which we store with your email, company, build and trial dates in trial_signups. Stripe event IDs are logged in stripe_events so a repeated webhook cannot create a duplicate record.
• When we write to a company first — we contact landscape companies we think we can help, using only what the company has published on public web pages: its name, website, city and state, and a named contact’s name, role and work email, with the page we found them on and a short note on why we wrote. We never buy lists, never guess email addresses and never collect personal (non-work) details. We send at most three short emails. Reply “no”, or ask us to delete your details, and we stop at once; we then keep only the address or company domain on a do-not-contact list so we never write again. These records are kept in our own outreach files, not in this site’s database.
• Unsubscribe — your email is added to unsubscribes so we do not email you again, and removed from subscribers. That suppression entry is kept on purpose; deleting it would let a later sign-up re-enable email.

Inquiries, trial sign-ups and Audit submissions are also sent to our own inbox so we can reply; deleting your information removes those copies too.

Every form has a hidden field that only automated bots fill in; submissions with it filled are dropped and not stored.

2. What the free tools do with your file

Renewal Radar and Payer Risk Check are built so that the spreadsheet or CSV you load is parsed and analyzed entirely inside your browser tab. There is no upload step: the file is not sent to our servers, not stored, and not read by any AI model or third party. Closing the tab is the delete. You can verify this yourself by opening your browser’s developer tools (Network tab), running a tool, and confirming that nothing carrying your file leaves the page. The only requests that carry anything from the tool are small usage events — that the tool was opened, that a file was read and how many rows it had, that the columns were matched and the results shown (section 4) — and the optional summary email, only if you click it. You will also see the page loading its own links and the analytics described in section 4; none of them carry your file.

If we ever add a tool that needs a server step, its page will say so above the drop zone in the same plain words, and this policy will be updated first.

3. Data you send us directly

A managed build runs on a server in a cloud account in your company’s name, which we administer. Your platform data is stored there, not on our systems. If you send us a file directly, we use it only for the task you sent it for. It is kept apart from any other company’s data, is never used to train a model, and is deleted when that task is done or when you ask, whichever comes first. Where a platform vendor’s terms govern that data, we follow them.

The Game Plan and Advisory run on what you tell us and what you show us on your own screen. We do not ask for exports, files, logins or passwords for them. Working documents live in a folder your company owns and shares with us, and our copy of your plan keeps only summary figures you tell us, never records from your systems.

4. Technical data

Form endpoints read your IP address in memory to limit repeated submissions. It is not written to our database. Our hosting provider keeps standard request logs (IP address, user agent, timestamps) for a short period for security and debugging, under its own retention policy.

Cookies and analytics. The site sets no advertising or tracking cookies. Site analytics runs on Umami, a privacy-focused, cookie-free service. It records aggregate page views, referrers, browser and device type, approximate location, and the same named events described in the next paragraph; it does not build individual profiles, and we do not combine it with form data. If we enable error monitoring, it receives technical error details and may include the page you were on; we configure it not to capture form contents.

Our own usage measurement. We also record a small number of named events on our own servers — for example that a free tool was opened, that a file was read in your browser, that the Audit was started or finished — so we can see which resources are useful and where people get stuck. Each event stores two random identifiers, one kept in your browser’s local storage that lasts between visits and one kept in session storage that clears when you close the tab, plus the page path, the referring website’s domain, any campaign tags in the link you arrived on, and a few short details such as the number of rows in a file or which button or page section you clicked. It does not store your IP address, your browser details, your email address, or any content from a file you analyze with our tools. The random identifiers are not linked to your name or address unless you separately choose to send us a form. Clearing your browser storage removes them and you appear as a new visitor.

The Audit before you give an email. If you take the Audit without asking for your plan, the event log still records that you started, how many statements you had answered and, once you finish, your band and your lowest area, tied only to the random identifiers above, never to a name or email. Nothing you type is recorded in events. While you take the Audit, your answers are kept in your own browser tab so you can pick up where you left off; they are not sent anywhere until you ask for your plan. If you do ask for it, the same two identifiers are stored with your submission (section 1), so we can see the steps that led to it.

5. Why we use it

• To reply to you and to deliver what you asked for: Audit results, a tool summary, a resource, a trial.
• To send the monthly newsletter, if you signed up or requested a summary. Every such email has an unsubscribe link.
• To run a trial and, if you continue past it, bill the service you chose.
• To understand which pages and tools are useful, in aggregate.
• To understand, in aggregate, what landscape companies need and decide what we build next. Audit answers are counted in totals; we publish Audit figures only as totals from groups of 30 companies or more.
• To decide which Audit results a person should reply to first. That priority is internal and never changes what your result says.
• To prevent abuse of the forms and keep the site running.

We do not use your information for advertising, and we do not use it to train AI models.

6. Who processes it for us

We use a small number of service providers, each bound by its own terms to process data only on our instructions: Vercel (website hosting), Supabase (database), Resend (sending email), Stripe (card capture and billing), Umami (site analytics), Google Workspace (our email inboxes, including the one our outreach email is sent from and replied to), and, when enabled, an error-monitoring provider as described above. Vercel, Supabase, Resend, Stripe and Umami store data in the United States; Google Workspace stores mail under Google’s own data-location terms. We do not sell your information to anyone, and we do not share it with data brokers or advertisers. We will disclose information if the law requires it, or to protect the site and its users from abuse.

7. How long we keep it

• Inquiries, Audit responses, and anything sent through earlier forms: up to 24 months after your last interaction with us, then deleted.
• Tool-run summaries and earlier resource sign-ups: up to 12 months.
• Usage events (section 4): up to 24 months.
• Newsletter subscribers: until you unsubscribe.
• Unsubscribe suppression entries: kept indefinitely so your choice sticks.
• Outreach records (when we wrote to your company first): up to 24 months after our last email, or until you tell us to stop; after that only the do-not-contact entry is kept, indefinitely, so your choice sticks.
• Trial and billing records: for the life of the relationship plus the period tax and accounting rules require (generally seven years).

Any of these can be shortened at your request; see the next section.

8. Your choices and rights

Whatever state or country you are in, you can ask us to: tell you what we hold about you; correct it; delete it; stop emailing you; or send you a copy. Email info@secondordersystems.com from the address in question, or tell us which address to look up. We answer within 30 days and do not charge for it. Deletion covers every table listed above except billing records we are legally required to keep and the unsubscribe suppression entry. We will never treat you differently for exercising these rights.

To stop marketing email, use the unsubscribe link in any message and confirm with one click; it takes effect immediately. Transactional messages tied to something you asked for (a trial confirmation, a receipt) are not marketing and may still be sent while the relationship is active.

We do not respond to browser “Do Not Track” signals because the site does no cross-site tracking to turn off.

9. Security

The site is served over HTTPS. The database is not reachable from the browser: every write goes through a server function using a key that is never sent to the browser, and access rules are enforced at the database level. Card details never touch our systems. We keep the number of people and systems with access to your data as small as we can. No system is perfectly secure; if a breach affects your information we will tell you promptly and say what happened.

10. Children

The site is for businesses and the people who run them. It is not directed to anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.

11. Where we are

SecondOrder Systems LLC is a New Jersey limited liability company, and this site is operated from the United States. If you use it from elsewhere, your information is processed in the United States.

12. Changes

When this policy changes, the effective date at the top changes with it. A change that affects what we collect or how we use it will also be described on the Resources page or in the newsletter before it takes effect.

Contact

SecondOrder Systems LLC
971 US Highway 202N, Ste N, Branchburg, NJ 08876
info@secondordersystems.com