Privacy notice · last updated 1 September 2026
A fit check, not a data grab.
Administrative Burden Ltd, trading as Modest Ambitions, is the controller. This service collects only enough information to assess, sell and deliver a fixed-price scope.
What is collected
Company name, work email, selected system, sample size, review focus, billing market, payment and order references, page-level funnel events and any source or UTM values included in the submitted fit-check URL. Card numbers never pass through this app.
Why and legal basis
Pre-contract and contract: assess the requested work, save the scope, take payment and deliver the order.
Legitimate interests: count page and checkout events, prevent abuse, secure the service and understand whether the self-serve flow works. These events do not follow you across other sites.
Legal obligation: retain the minimum payment, contract and accounting records required by tax and company law. Email is never added to a newsletter or sold.
Cookies and links
There are no advertising or third-party analytics cookies. An encrypted, HTTP-only session cookie is created when you submit or securely open a saved scope. It keeps that browser authorized for up to seven days. Email access links work once and expire after 30 minutes; operators can revoke browser access immediately.
What not to send
Do not submit client files, customer names, bank data, test records or operational exports through this site. The fit check contains no upload field. If you purchase, a minimum dataset and secure transfer route are agreed separately.
Who receives it
Authorized Modest Ambitions operators and the minimum service providers needed to host the app, deliver transactional email, provide secure file transfer and process payment. Stripe receives order and contact details needed for hosted Checkout. Before live payment is enabled, the named providers, processing locations and signed data-processing terms must be recorded in the internal processor register.
International transfers
Some providers may process information outside the UK. Where that happens, the transfer is documented and must use an applicable adequacy decision or contractual safeguard. Email hello@modestambitions.studio for the current provider list and transfer safeguard.
Retention
Unpaid scopes and funnel events: deleted automatically within 90 days.
Operational files: deleted within 30 days after delivery unless a shorter period is agreed; deletion is recorded by an operator and overdue confirmation is flagged daily.
Paid order and accounting records: retained for seven years, then deleted automatically unless a documented legal hold applies.
Security audit events: deleted within one year.
Automated scope check
Rules compare the selected system and sample size with the published fixed scope. They may permit checkout, request an export check or mark the sample too large. They do not make a legal or similarly significant decision; you can email for human review.
Your rights
Depending on the circumstances and the law that applies, you may ask for access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. Email hello@modestambitions.studio from the work address used for the scope. We may retain limited records where law requires it. You may complain to the UK Information Commissioner; people covered by EU/EEA or Swiss law may also contact their local supervisory authority.
Security
Sensitive database fields are encrypted at application level. Buyer access uses one-use email links and encrypted sessions. Operator access is invite-only, rate-limited and protected by password, TOTP MFA, lockout and short inactivity timeout. Access changes and deletion confirmations are audit logged.
Controller contact
Administrative Burden Ltd (company 17363389), trading as Modest Ambitions. Privacy and security requests: hello@modestambitions.studio.