Legal

Privacy Policy

Short version: we collect what you type into the application or the estimate tool, we use it to answer you, we do not sell it, and we will delete it if you ask.

Last updated September 6, 2026 · Middle Research and Development

Who we are

Middle Research and Development (“Middle R&D”, “we”) operates middlernd.com. We are based in the United States and work with ecommerce brands, primarily in the United States.

For anything in this policy — including a request to access or delete your data — email norbert@middlernd.com. A person reads it.

What we collect

Only what you give us, plus the minimum a website needs to run.

Diagnostic application: Your name, email address, optional phone number, store URL, revenue band, monthly ad spend, ad channels, what breaks when ads work, an optional note, and who can approve an install. All of it typed by you, all of it needed to decide whether we can help.
Leak estimate answers: Your eleven answers stay in your own browser (session storage) while you use the tool and are discarded when you close the tab. They are only sent to us if you ask for the breakdown by email — and then they travel with that request so the summary can be built.
Email address for the estimate breakdown: Used to send you that one summary, and kept so we can recognise you if you apply later. We do not add you to a list or start a sequence.
Analytics: Aggregate, cookieless page-view data via Cloudflare Web Analytics — which pages were viewed and roughly from where. It does not identify you, does not follow you between sites, and sets no cookies.
Server and security logs: Our host, Cloudflare, records request metadata including IP address and browser user-agent for delivery, caching and abuse prevention. We do not use these to build a profile of you.

Cookies and tracking

This site sets no cookies of its own, runs no advertising pixels, and does no cross-site tracking. That is why there is no cookie banner — there is nothing to consent to.

The estimate tool uses your browser’s session storage to remember your answers between steps. It is not a cookie, it never leaves your device, and it clears itself when you close the tab.

If we ever add advertising or cross-site tracking, this policy changes first and consent is asked for where the law requires it.

Why we are allowed to use it

To answer your application and decide whether to offer a diagnostic — because you asked us to, and because we have a legitimate interest in running the business you contacted.
To send the estimate breakdown you requested — with your consent, given by typing your email into that box.
To keep the site up, fast and free of abuse — legitimate interest.
We do not use your data for automated decisions with legal consequences, and we do not profile you for advertising.

Who else processes it

We keep the list short on purpose. Each of these is a processor acting on our instructions, not a party we sell data to.

Cloudflare: Hosting, content delivery, security and cookieless analytics. United States and its global edge network.
Resend: Sends the application notification and the estimate summary. United States.
Google Workspace: Our own email inbox, where your application arrives and is stored.

How long we keep it

Estimate answers: not stored on our servers at all. They live in your browser and, if you requested the summary, inside that one email.
Applications and email summaries: kept in our inbox while there is a live conversation, and for up to 24 months after, so we recognise you if you come back. Then deleted.
Analytics: aggregate only, retained by Cloudflare on their standard schedule. It cannot be traced back to you.

Your rights

Wherever you live, you can email norbert@middlernd.com and ask us to show you what we hold, correct it, or delete it. We will do it, and we will not treat you worse for asking.

California (CCPA/CPRA): rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information, and we do not process sensitive personal information for inferring characteristics — so there is nothing to opt out of. You may use an authorised agent.
EU/UK (GDPR): rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. You may also complain to your local supervisory authority.
Other US states with privacy laws: the same requests are honoured on the same terms.
We will respond within 30 days, and sooner in practice.

Security

The site is served only over HTTPS with strict transport security. API keys and other secrets live server-side and are never exposed to the browser. Form input is validated on both the client and the server.

No system is perfect. If you believe you have found a security problem with this site, email norbert@middlernd.com and we will take it seriously.

Children

This is a business-to-business site and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has sent us information, tell us and we will delete it.

International visitors

The site is hosted in the United States and served from Cloudflare’s global network. If you visit from outside the US, your information is processed in the US, which may have different data-protection rules than your country. By using the site you accept that transfer.

Changes

If this policy changes materially we update the date at the top and, where we hold your email because of a live conversation, we tell you. Continuing to use the site after a change means you accept the current version.