Privacy Policy
Last updated 2026-10-29.
What we collect
- Email address — at checkout (to deliver the kit) and optionally via the lead-magnet form (to send the free educational PDF, then 4 short educational follow-up emails over the next 10 days, after which the emails stop. You can unsubscribe at any time).
- Payment information — handled entirely by Stripe. We never see your card number. Stripe stores the transaction record per its own retention policy (≥7 years).
- Consent acknowledgment — the checkout consent record (timestamp + IP) is stored in our server logs and in Stripe's order metadata.
- Checkout visit ID — a random ID stored in your browser (in local storage, not a cookie) and attached to any checkout you start. It lets us see whether someone who started a checkout came back and bought later. It contains no information about you, and it is never sent to our analytics or advertising tools.
- Checkout email pre-fill — if you sign up for the free checklist, your browser remembers that email address so it can be filled in for you at checkout. It is stored only in your browser, and you can clear it with "Use a different email" next to the buy button.
- Download-link requests — if you ask for a fresh download link at /download-link, we look up the email you type in our Stripe order records and, if it matches a purchase, email the link to that address. We don't store the email you type.
- Site interaction analytics via Vercel Web Analytics — pageviews plus anonymous interaction events (for example: which page sections you scroll to, whether you open an FAQ, whether you click a buy button or a citation link). No cookies and no personally identifying information — an event never carries your name, email, or any income/family detail, only the action taken, the page it happened on, and which link or channel (for example a search engine or a social profile) brought you to the site.
- Session analytics and recordings via Microsoft Clarity — on our public information pages (not on payment, download, or business-portal pages) Clarity records how a visit unfolds: pages viewed, clicks, scrolling, mouse movement, and how long you stayed, as an anonymized replay and heatmaps. Clarity sets first-party cookies to link pages within one visit. Text you type into forms is masked, and the email, consent, and income-check forms are explicitly excluded from recording, so what you enter is never captured. We use it only to see where pages confuse people so we can fix them. See Session analytics below.
- Search-ad conversion measurement. When we run search ads, the ad platform's conversion tag
(Google's
gtag.js, and Microsoft's if enabled) loads on our pages and may set a first-party cookie so we can tell whether an ad click led to a purchase. On a completed purchase it reports the sale amount and an opaque order id — never your name, email, or any family or financial details. We use it only to measure whether our ads work; we do not retarget you or build a profile. Details in Advertising measurement below. - Business-portal login (B2B facility partners only) — a facility that has purchased a
co-branded license signs in via a one-time emailed link. That creates a short-lived, HttpOnly session cookie
so the portal can recognize the signed-in session on later requests. This applies only to enrolled business
accounts at
/business— individual kit buyers and site visitors never see a login and no session cookie is ever set for them.
What we do NOT collect
- We do not ask for the applicant's name, income, Social Security number, age, family situation, or any other personal information about your family.
- We do not run ad-retargeting or behavioral-profiling tools, and our analytics never build a cross-site profile of you or are sold. The third-party tags we run are the search-ad conversion tag (only to measure whether an ad led to a sale) and Microsoft Clarity session analytics (only to improve our pages), both described above. We never run either on payment, post-purchase, or download pages.
- We do not maintain user accounts for individual kit buyers or site visitors. There is no login for them. (Business-portal login for enrolled B2B facility partners is a separate, narrow exception — see above.)
What we do with email addresses
Buyer email addresses are used only to deliver the kit, send refund confirmations, and respond to support requests. Lead-magnet emails are used to send the educational nurture sequence and a soft kit pitch at the end. You can unsubscribe from the nurture sequence at any time via the link in every email.
We do not sell or share email addresses with attorneys, Medicaid planners, lead-generation companies, advertisers, affiliates, or any third party. Ever.
Advertising measurement
We may run ads on Google Search (and later Microsoft/Bing). So we don't waste money on ads that don't work, we use the ad platform's standard conversion tag to learn whether an ad click actually led to a kit purchase. Precisely what that involves:
- Google's tag (
gtag.js) loads on our pages and may store a first-party cookie remembering that you arrived from an ad. - When a purchase completes, we tell the ad platform that a sale happened, its dollar amount, and an opaque order reference. We do not send your name, email, or any information about your family or finances.
- We do not use this to retarget you with ads elsewhere, and we do not build a behavioral profile of you.
- You can manage ad personalization at Google My Ad Center, and you can block cookies in your browser at any time — it will not affect your ability to buy or download a kit.
Session analytics
We use Microsoft Clarity to understand how visitors move through our public pages. Precisely what that involves:
- Clarity loads on our public information pages only. It does not load on the post-purchase page, kit download pages, business-portal pages, or the feedback form. Payment itself happens on Stripe's own site, where we run no tags.
- It records page views, clicks, scroll depth, mouse movement, and time on page, and can replay a visit as an anonymized recording. Text typed into any form field is masked, and our email, consent, and income-check forms are excluded outright.
- It sets first-party cookies and may collect your IP-derived approximate location, device type, and browser. Microsoft processes this data on our behalf under its privacy statement.
- We do not use it to identify you, and we do not combine it with your email address or purchase.
- You can block cookies or use your browser's tracking protection at any time. It will not affect your ability to buy or download a kit.
Service providers
- Stripe — payment processing and tax calculation.
- Resend — transactional email (order receipts, kit download links) and the educational email sequence for lead-magnet subscribers.
- Vercel — site hosting, file storage for the kit PDF, and site interaction analytics.
- Upstash (Redis) — short-lived, automatically-expiring technical data only: single-use login-link tokens, abuse rate-limit counters, a brief cache of business-portal access status, and a short retry queue for a failed email-list signup. Nothing here is kept beyond its automatic expiry, and none of it is used for marketing or profiling.
- Microsoft — Clarity session analytics on public pages only (see Session analytics).
- Google — search-ad conversion measurement only (the conversion tag described in Advertising measurement); we do not sell or share your data with Google for any other purpose.
Your rights
To request deletion of your email address from our records, email support@millertrustguide.com. We honor deletion requests within 7 business days. Note that Stripe retains order records independently per its own retention policy and we cannot delete those.