Privacy Policy

1. Who we are

This Privacy Policy explains how Francette, LLC, a Pennsylvania limited liability company doing business as “Ricerca” (“Ricerca,” “we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with the website located at ricercacredit.com and related pages and features (the “Site”). Francette, LLC is the controller responsible for the personal information described in this Policy.

2. Scope

This Policy applies to information we collect through the Site and through your communications with us (for example, when you submit a contact form, complete the get-started questionnaire, or email us). It does not apply to third-party websites or services that we do not control, or to information governed by a separate engagement agreement. Using the Site does not create an accountant-client or attorney-client relationship; please see our Disclaimer and Terms of Service.

Our portals are separate services. The sign-in page on this Site links out to our client, CPA-firm, and internal portals (for example, portal.ricercacredit.com and firm.ricercacredit.com). Those are separate authenticated applications, governed by the applicable engagement agreement and their own terms and privacy notices - not by this Policy. Information you enter after you leave this Site to sign in is handled under those agreements.

3. Information we collect

Information you provide to us

When you submit our contact form, complete the get-started questionnaire, or otherwise reach out, we collect the information you choose to provide, which may include:

• your name;
• your company / organization;
• your work email address;
• your phone number (optional);
• your industry;
• your estimated annual R&D spend, as a range rather than an exact figure;
• what you are interested in (for example, a federal §41 study, state credits, §174A, or “not sure yet”) - the questionnaire summarizes these selections into the message text before it is sent;
• the contents of your message;
• whether you told us you are a CPA or accounting firm (an optional checkbox on the contact form), so we can route your inquiry correctly;
• where the link you followed carries a source tag (for example, arriving from the on-site calculator), that tag - it is summarized into the visible message text with your other selections before you submit;
• the campaign details of the link that first brought you to the Site, sent along with the form - see “Campaign attribution” below; and
• your consent selection (the consent checkbox you submit with the form), which we record with your submission.

Please do not include sensitive personal information or confidential tax data in free-text fields. A short description of your R&D work is all we need to start the conversation.

How your submission reaches us

Forms are submitted over HTTPS to our own serverless form handler - a Cloudflare Pages Function running on the same domain as the Site - which delivers the submission to us by email through Resend. Submissions arrive in our inbox and are handled as business correspondence. The same function also records the submission as a lead in our customer-relationship-management (CRM) and accounting system, Microsoft Dynamics 365 Business Central (operated by Microsoft Corporation; see §7), by way of our own application programming interface. Your IP address is processed briefly at that point to rate-limit repeat submissions and to verify the spam-protection check described below; only a one-way salted hash of it, never the address itself, is kept with the lead record, as an abuse-prevention marker.

Campaign attribution

So that we know which of our channels an inquiry came through, your browser notes - once, on your first page view - the campaign details of the link that brought you here: any utm_ tags (source, medium, campaign, term, content), the click identifier an ad platform appended (such as gclid, msclkid, li_fat_id or fbclid), our own src tag, the address of the referring website (without its query string), and the page you landed on. These are first-party values held on your device: they sit in your browser’s sessionStorage for the length of the tab, and they leave your browser only if you submit a form, when they are stored on your lead record. If - and only if - you accept analytics on the cookie banner, they are also kept in a first-party cookie for up to 30 days, so that a later visit can still be tied to the link that first brought you; declining or withdrawing removes that cookie. We use them only to understand which channels lead to inquiries. We do not send them to advertising platforms, use them to follow you across other websites, or build advertising profiles. See our Cookie Policy for the keys involved.

Newsletter emails

If you subscribe to our R&D tax credit updates, we collect your email address, the page you subscribed from, any campaign (UTM) tags on the link you arrived through, and the website that referred you (the site's address only, not the full page). Subscribing is a two-step (double opt-in) process:

• Step 1, the form. Our form handler emails you a confirmation link through Resend, our email delivery provider. The link carries your signup details, including the time and your IP address, and is signed so it cannot be altered. It expires after 7 days. If you do not click it, you are not added to our list and we keep no record of the signup beyond short-lived anti-abuse markers that expire within minutes; Resend keeps its own delivery log of the confirmation email.
• Step 2, your confirmation. The link opens a page with a "Confirm my subscription" button (opening the link alone changes nothing). When you press it, we record your consent: the exact wording you agreed to, when you signed up and confirmed, and the IP address used at each step. That consent record, with your email address, source page and UTM tags, is sent to our own inbox as an email notification. Your address is added to our mailing list at Resend, which sends the updates as our processor. Once our CRM integration is enabled, the same details, including your IP address, are also passed to the Ricerca platform and recorded as a contact in our CRM (Microsoft Dynamics 365 Business Central) so we can honor your preferences.

We use your email only to send you those updates. You can unsubscribe at any time using the link in every email, or by replying to any email and asking us to stop.

Spam protection (Cloudflare Turnstile)

Where it is enabled, we use Cloudflare Turnstile - a privacy-oriented alternative to a CAPTCHA - to keep automated submissions off our forms. The Turnstile widget loads with the page whenever a protected form is present (currently the contact and get-started forms), and Cloudflare receives your IP address, browser signals, and the verification token in order to judge whether the request is human. The sign-in pages of our portals, which are separate applications, use the same protection where enabled. Turnstile is used for security only - not for advertising, profiling, or cross-site tracking. See our Cookie Policy for the storage side of this.

Tools that never send us anything

Our credit calculator runs entirely in your browser: the figures you type are computed on your device and are never transmitted to us. Once you edit a figure, the calculator keeps a copy of its illustrative result (the total qualified research expenses, the calculation method, the estimated credit with and without the §280C(c) election, and a timestamp, not the individual figures you typed) in your own browser’s sessionStorage under the key ricerca:estimate. That copy is first-party, is cleared when you close the tab, and is read only by our own get-started and contact forms, which offer it back to you as a visible, editable summary line you can change or delete before sending. Nothing from the calculator reaches us unless you choose to submit the form.

Information collected automatically (only after consent)

We use Google Consent Mode v2, and analytics are denied by default. No analytics scripts load and no analytics cookies are set unless and until you click “Accept” on our cookie banner. If you accept, we use Google Analytics 4 (GA4) and Google Tag Manager (GTM) to collect standard, aggregated usage information such as pages viewed, approximate (city-level) location derived from IP address, device and browser type, referring pages, and on-site interactions. Advertising storage, ad user data, and ad personalization remain denied at all times - accepting grants analytics storage only. If no GA4/GTM identifier is configured for the Site, no analytics run and no banner appears at all. See our Cookie Policy for details, including how to change your choice.

Server logs

Our hosting and content-delivery (CDN) providers may automatically record standard server access logs - such as IP address, date and time of requests, requested URLs, user-agent, and similar technical data - for security, troubleshooting, abuse prevention, and reliability. These logs are generated regardless of your cookie choice and are retained by those providers under their own policies.

4. How we use information

• to respond to your inquiries, requests, and communications;
• to record and manage leads, client relationships, and our business billing and accounting records in our CRM and accounting system, and to see which channels our inquiries come through;
• to provide, operate, maintain, and improve the Site and our content;
• to understand how the Site is used and to measure and improve its performance (with your consent, via analytics);
• to protect the security and integrity of the Site - including spam prevention, rate limiting, and the form-protection check described in §3 - and to detect and prevent fraud and abuse;
• to comply with legal obligations and to establish, exercise, or defend legal claims; and
• for other purposes you authorize or that are described to you at the point of collection.

We do not sell personal information, and we do not use information submitted through the Site to train public or third-party AI models. Where our engagements use AI systems, they run through enterprise endpoints under contractual terms that prohibit provider training on our data - that platform processing is governed by the applicable engagement agreement, not by this Site policy (see §2).

5. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal information under one or more of the following legal bases:

• Consent - for analytics, any non-essential cookies, and newsletter emails (which you may withdraw at any time);
• Legitimate interests - to respond to inquiries, keep business records, operate and secure the Site, and prevent abuse, where those interests are not overridden by your rights; and
• Legal obligation - to comply with applicable laws and respond to lawful requests.

6. Cookies & analytics

We use cookies and similar technologies as described in our Cookie Policy. We take a consent-first approach: analytics are denied by default under Google Consent Mode v2, and nothing non-essential loads before you accept. Your choice is stored locally in your browser under the ricerca_consent_v1 key. You can change or withdraw your choice at any time using the cookie preferences control on the Cookie Policy page - withdrawing is as easy as giving consent, and takes effect immediately. Accepting analytics also lets us keep the 30-day first-touch campaign cookie described under “Campaign attribution” in §3; withdrawing removes it.

7. How we share information - service providers & processors

We do not sell your personal information. We share information only as needed with service providers and processors who handle it on our behalf and under appropriate confidentiality and data-protection obligations, including:

• Google LLC - Google Analytics 4 and Google Tag Manager, for website analytics (only after you consent);
• Resend - to transmit and deliver contact-form and questionnaire submissions to our inbox, to send newsletter confirmation emails, and to hold our newsletter mailing list and send the updates;
• Cloudflare, Inc. - hosting, content delivery, and serverless functions for the Site, and Cloudflare Turnstile (where enabled) to protect our forms from spam and abuse;
• Microsoft Corporation - Microsoft Dynamics 365 Business Central, our CRM and accounting system, which processes lead and client business-contact data (names, business email addresses, phone numbers, company details, the content of your inquiry, the campaign details described in §3, and confirmed newsletter subscriptions with the consent record and IP address described in §3) and our billing and payment records for engagements, under Microsoft’s Products and Services Data Protection Addendum, with data hosted in the United States; and
• our other infrastructure providers - to serve the Site and maintain its security and reliability.

We may also disclose information when required by law or legal process, to protect our rights, safety, and property or those of others, or in connection with a corporate transaction such as a merger, acquisition, or sale of assets (subject to this Policy).

8. We do not sell or “share” personal information

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). We do not knowingly disclose personal information for monetary or other valuable consideration.

9. Data retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy - such as responding to and following up on your inquiry, maintaining business records, and complying with legal obligations - after which we delete or de-identify it. Lead and client contact records in our CRM are kept while the relationship or inquiry is active and for as long afterward as we need for business records, and billing and accounting records are kept for the period that tax and accounting rules require. Analytics data is retained according to our GA4 configuration and Google’s retention controls. Server logs are retained by our hosting/CDN providers under their own retention schedules. Data held in the calculator’s browser storage is not retained by us at all: it lives on your device and is cleared when the tab closes.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including transmission of the Site and its forms over HTTPS/TLS, access controls, and spam-prevention measures. You can learn more on our Security page. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your privacy rights

California (CCPA/CPRA)

If you are a California resident, you have the right to: (a) know what personal information we collect, use, and disclose; (b) access and obtain a copy of that information; (c) correct inaccurate personal information; (d) request deletion of your personal information; and (e) opt out of the sale or sharing of personal information. As noted above, we do not sell or share personal information, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.

EEA / UK (GDPR)

If you are in the European Economic Area or the United Kingdom, you have the right to: access your personal information; rectification of inaccurate data; erasure (“right to be forgotten”); restriction of processing; data portability; objection to processing based on legitimate interests; and the right to withdraw consent at any time (without affecting processing already carried out). You also have the right to lodge a complaint with your local data-protection supervisory authority.

12. How to exercise your rights

To exercise any of the rights above, email us at [email protected] with your request. We will respond within the timeframes required by applicable law. To protect your privacy, we may need to verify your identity before acting on your request, and you may use an authorized agent where the law permits.

13. International data transfers

We are based in the United States, and the service providers we use may process information in the United States or other countries. If you access the Site from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States and other jurisdictions whose data-protection laws may differ from those in your location. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for such transfers.

14. Children’s privacy

The Site is intended for businesses and adults and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

15. Do Not Track / Global Privacy Control

Because we do not sell or share personal information and load non-essential cookies only after you affirmatively opt in, our analytics will not run unless you click “Accept.” Browsers and standards handle “Do Not Track” (DNT) and Global Privacy Control (GPC) signals inconsistently; given our consent-first, opt-in design, no additional action is required for analytics to remain off if you do not accept.

16. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above, and the revised Policy becomes effective when posted. We encourage you to review this Policy periodically.

17. Contact

For privacy questions or to exercise your rights, contact:

Francette, LLC d/b/a Ricerca
Email: [email protected]
A mailing address for privacy requests and legal notices is available on written request to the email above.