Privacy notice

Last updated: October 24, 2026

Dolphil is operated by Zivash, Inc. This notice explains how we handle personal information when you visit our website, contact us, book a call or take part in our business research and outreach. For privacy questions or requests, email dan@dolphil.com.

Website visits and administration

Google Firebase hosts our website. Google and our infrastructure providers process technical information, such as IP addresses and request information, to deliver the website, maintain security and diagnose problems.

Our payment-administration page uses Google sign-in through Firebase Authentication. Google provides identity and authentication information for that sign-in. A successful Google sign-in can create a Firebase user record even if you are not authorized to use the payment API. Signing out ends the app session; it does not delete that record. Website visitors do not need to sign in to read the site or book a call.

Inquiries and bookings

If you email us, we use your address and the information in your message to respond and keep track of the conversation. Google Workspace processes our business email.

Clicking a booking button loads Cal.com’s scheduler inside our website. The scheduler does not load before that click. Cal.com and the connected Google Calendar and Google Meet services process the information you submit to arrange the meeting, send invitations and provide the meeting link. Connected calendars are checked for scheduling conflicts.

Our booking API receives signed notifications of booking creation, rescheduling and cancellation. It keeps booking identifiers, times, status and related operational records. It can also record whether a call was qualified or held and whether a pilot was paid, separately from the booking itself. These records are not proof that a scheduled call took place. Our first-party booking ledger does not retain attendee names, email addresses or meeting notes from those notifications.

Optional advertising measurement

We use X’s pixel and campaign identifiers only if you allow ad measurement. Until you choose Allow, the site does not load that pixel or send first-party advertising visit/click records. You can decline and still book a call. We also disable this measurement when your browser sends a Global Privacy Control or Do Not Track preference.

When allowed, we record the campaign, creative, audience tag, X click identifier and random attribution identifiers associated with your visit and booking-button click. A random attribution identifier can be passed to Cal.com to connect a booking with that visit. We do not pass the page’s campaign parameters or X click identifier to the scheduler.

The X pixel receives browser and network information under X’s data-handling practices. Our server can separately report an accepted, attributed booking to X using the X click identifier, a random conversion identifier, the event time and our configured event identifier. That server request does not include attendee names, email addresses, phone numbers, email/phone hashes, meeting notes or mailbox contents. The X event source is shared with Ziva and Slapjam. X may associate activity with other information it receives; allowing measurement is not anonymous browsing.

You can reopen Ad measurement on our website and choose Decline to withdraw consent. This removes the related campaign/click data from our first-party visit records and prevents future conversion delivery. It cannot recall information already sent to X or a request already in flight. If server cleanup fails, the site displays that failure and retains only the random cleanup identifiers needed to retry it.

Consent and attribution are kept in browser session storage. Attribution has a seven-day maximum window. First-party measurement and booking-ledger records expire 30 days after their last update and are removed by scheduled cleanup. These limits do not determine how long X, Cal.com, Google or other providers retain their own records.

Quotes and payments

Our authorized administrator sends quote amounts, currencies and descriptions through our Cloudflare API to Stripe to create payment links. Stripe hosts checkout and processes the information you enter there. Our website and payment-link API do not collect card numbers. Stripe can make transaction and relevant customer information available to us through the seller account. Quote descriptions and payment records can contain information about the relevant customer or transaction.

Business research and outreach

We research public business sources to identify companies, potential buyers and professional contact routes. This can include names, roles, business contact details, source URLs and information relevant to a business offer. We use this information to assess fit, prepare outreach and keep records of communications, responses and contact preferences. Information may come from company websites, professional profiles, published directories and direct communications, rather than from the person visiting our website.

When providing research and outreach work for a customer, relevant contact research and draft material may be shared with that customer for the agreed work. Public availability of a contact detail does not itself establish permission to contact someone. Service responsibilities, including sending, handling replies and scheduling, depend on the agreed service and are not established by this notice.

We use AI services, including OpenAI and Anthropic, to help process research and prepare drafts. Relevant research and draft content can be processed by those providers. Do not send us passwords or other credentials in an inquiry or booking form.

Providers, retention and requests

We use providers for hosting, authentication, email, scheduling, meetings, payments, infrastructure, advertising measurement and AI-assisted work. These include Google/Firebase, Cal.com, Stripe, Cloudflare, X, OpenAI and Anthropic. Our providers may process information outside your country. Their applicable terms and privacy notices govern their own handling; this notice does not promise a particular provider training exclusion, storage region or universal deletion period.

The 30-day first-party ledger limit is not a blanket retention rule for our business. Inquiry correspondence, research, outreach history, payment records, security logs, backups and records needed for legal preservation have different purposes and retention requirements. Signing out, declining advertising measurement or deleting a browser session does not automatically delete those records.

Depending on applicable law, you may have rights to request access, correction or deletion of personal information, object to certain uses or withdraw consent. Contact dan@dolphil.com with your request, including if your information was obtained from a public business source or you do not want further outreach. We may need information to verify and locate the relevant records. Legal obligations or preservation requirements can limit deletion; a request does not automatically erase independent provider or customer records.

We use HTTPS, restricted administrator access and server-side payment credentials to help protect information. No internet service or security control guarantees complete security. We may update this notice as our handling changes and will show the updated date here.