A Close Reading of Some Very Concerned Customer Outreach

Favorite Part No. 1 · in which no pitch is made, at length

“I'm not reaching out to pitch you on features or pricing.”

A sentence immediately followed by six paragraphs of pitch, concluding in a migration offer with a timeline. This is the I'm not going to tell you what to do, BUT of B2B sales — a load-bearing disclaimer, and the most carefully engineered line in the document. The entire email only works if the reader forgets, for roughly four hundred words, that the author's paycheck depends on the conclusion being believed.

What follows is worth noticing for what it never contains. No feature is named. No price is quoted. No capability is compared. The pitch is made entirely in negative space — the case for switching is assembled from our disclosures rather than from anything they do — right up until the closing paragraphs, where a migration offer and a timeline arrive as though summoned by the reader's own alarm. It is a sales letter that outsources its argument to the SEC and keeps only the call to action.

The framing is generous throughout: they would rather we hear it from them than find out the hard way. The hard way, presumably, being our platform continuing to function.

The concern is touching. The invoice is implied.

Favorite Part No. 2 · in which we are overwhelmed with gratitude that someone read the audit documents

Thank you, sincerely, for reading our filings

We want to take a moment here, because it deserves one. Someone over there read the filings. Not skimmed a headline — read them. The dates are right, the docket is right, the quotations are accurate, and the sequence is in order. They found the April notice, the May governance change, the July agreement, and the going-concern language, and they got every one of them correct.

Do you understand what that means? Those documents are produced under duress, at enormous cost, by people who would rather be doing anything else. They are audited, reviewed by counsel, argued over line by line, signed under penalty of federal law, and then published into a government database where they are read by approximately no one. Auditors are paid to read them. Regulators are obligated to read them. Everyone else opens the press release. Years of investor-relations spend, and the most devoted readership our EDGAR page has ever had turns out to be a competitor's sales team — people under no legal duty whatsoever, reading our quarterly disclosures voluntarily, in what one assumes was their own time.

We are, frankly, moved. Somebody cares about our disclosure obligations more than we do. If they ever want to compare notes on the footnotes, our finance team would genuinely enjoy the company.

It also matters for how we respond. The email cannot be dismissed as fabrication, and any attempt to do so would fail immediately, because every factual brick in it is sound. The building they made out of the bricks is another matter entirely — but the bricks are ours, and they were laid straight. Nobody reads a 10-Q for pleasure; we are touched that someone finally did.

Favorite Part No. 3 · the trick, performed once, reused throughout

The entity switcheroo

Here is the move, performed in one sentence: the company will likely wind down its affairs and dissolve — therefore your customer database could lose access with little warning.

The quote is real. It is about SpringBig Holdings — a shell in Wilmington whose remaining assets are a bank balance, an SEC reporting history, and a CEO reachable by Gmail. The platform, the servers, the data, the team, and the contracts live in SpringBig, Inc., which was transferred as a going concern precisely so that none of those things would be interrupted. The author quotes the obituary of the holding company, lays it on the operating company's doorstep, and invites the reader to grieve.

It's a good trick. It's also the only trick. Every scary clause — going concern, dissolution, sub-$500K market cap — describes the entity that no longer owns anything. Remove the conflation and the email collapses into “a holding company resolved its debt and a SaaS business continued operating,” which is a hard headline to sell a migration against.

One entity died so the other could live. They're mourning the wrong one.

Favorite Part No. 4 · the biggest number they could find

The $42.2 million “deficit”

The accumulated deficit is a lifetime ledger of every loss since founding — not a debt, not a balance owed, not anything that comes due. Roughly seventy percent of it was booked in a three-year window around the SPAC transition, when the burn rate had a burn rate:

The most recent quarter contributed half a million dollars, with adjusted EBITDA in the black. Citing the lifetime figure as evidence of present danger is citing someone's total lifetime grocery spending as proof they can't afford lunch. The going-concern doubt itself was driven by the note maturity — the exact obligation the reorganization extinguished at the parent. They are pointing at a crater as evidence of a bomb.

The scariest number in the email is the one that means the least.

Favorite Part No. 5 · sworn on the public record, loosely

“None of this is rumor. All of it is in their public SEC filings.”

This is the sentence that makes the rest of the email work, and it is doing something more sophisticated than it appears. It pre-empts the reader's obvious objection — of course a competitor says this — by relocating the authorship. The claims aren't theirs; they belong to a federal filing system. The author is merely a concerned reader who happened to be passing the docket.

The oath is undermined slightly by the market-cap figure two sentences earlier, which appears in no SEC filing, because market caps do not live in SEC filings. And once you start sorting the email's claims by source, the seam widens: the filings supplied the dates, the dollar figures, and the quotations, but the market data came from a stock screener, the characterization of a CEO being installed by the lenders, not chosen by the board came from the author, and the prediction that our client could lose access with little warning and little recourse came from nowhere at all. Three registers, one oath, no distinction drawn between them.

Which is the craft of the thing. Every load-bearing claim is sourced; every unsourceable claim is placed adjacent to a sourced one and allowed to borrow its credibility. The facts are from the filings; the fear is from the sales floor.

Favorite Part No. 6 · the villains who kept the lights on

The lender horror story

The email presents “the lenders took control” as the climax of a tragedy, and structurally it is the emotional hinge of the whole letter: the moment the reader is asked to picture strangers holding the keys to their customer database.

Consider what the alternative actually looked like. The April default notice put foreclosure on the table — the lenders were entitled to accelerate, seize the collateral, and unwind it. That is the scenario worth fearing, because that is the one where an operating business gets taken apart for parts. It is also the scenario that did not happen. What happened instead was an orderly statutory transfer engineered to keep the operating company intact: the debt assumed onto a going concern, a guaranty delivered, the equity pledged back, and operators installed to protect an asset the lenders now own outright.

Every step of that structure costs money and takes lawyers. Nobody builds it to shut something down; you build it because the thing you are holding is worth more running than liquidated. Secured creditors are many things, but they are not famous for setting fire to their own collateral — and having converted twelve and a half million dollars of debt into ownership of a platform, their entire return now depends on that platform keeping its customers.

Credit where it is due, and it is due to Lightbank and Shalcor Management. They could have foreclosed; they built a going concern instead, which is the harder, slower, and more expensive of the two options. We note, for the record, that our admiration for this decision is entirely genuine and only slightly convenient.

The email, in short, asks the reader to fear the one group of people financially incapable of wanting the outcome being feared.

Favorite Part No. 7 · three impossible things, one sentence

“Zero downtime and full data portability. Quickly.”

Here, at last, the author writes about something we can evaluate them on. Everything prior concerned our filings; this concerns their capability — and it is the only testable claim in the letter.

The promise is to migrate years of customer records, loyalty point balances, redemption histories, and campaign data between platforms with entirely different schemas, and to do it with zero downtime, complete fidelity, and speed. All three. Simultaneously. Anyone who has actually moved loyalty data between systems felt a cold hand on their shoulder reading that sentence, because those three properties trade against one another by nature: fidelity demands reconciliation, reconciliation demands a freeze, and a freeze is downtime. You may pick two, and the honest vendors tell you which two before the contract is signed.

The stakes are also being understated. Point balances are not a data export; they are the ledger of a financial relationship between a dispensary and its customers, and every discrepancy surfaces at a register with a person standing at it. A migration plan that begins “quickly” is one that has not yet met a loyalty tier boundary, an expired-points rule, or a redemption that posted twice. And as the contract section below establishes, their own terms forbid running two messaging platforms in parallel — the one technique that would make a zero-downtime cutover possible in the first place. The person promising the painless migration is the same one who has just demonstrated, at length, a comfort with the gap between a claim and its fine print.

Favorite Part No. 8 · in which the buyer is gently insulted

The condescending close

I understand you just signed with them, the pricing they offered was likely very enticing, and a 6 month agreement felt nice.

The email ends by gently informing the prospect that their own recent decision was naive — a closing tactic built on disparaging the buyer's judgment in the hope of unsettling their confidence in it. Read the sentence again and notice how much is packed into it: the choice is attributed entirely to price, the term length is characterized as something that merely felt nice rather than something evaluated, and the buyer is positioned as having been charmed rather than having decided. Nothing in it engages with why someone might actually choose a platform.

It is also a strategic error of a specific kind. A prospect who receives a warning about a vendor might forward it to that vendor out of concern. A prospect who receives an insult forwards it out of irritation — which is how this document came to exist. People generally do not enjoy being told they were fooled by a nice price, particularly by the vendor who lost.

The prospect signed anyway. The email was, in the end, a testimonial.

Favorite Find No. 1 · the governance documents, compared

A brief word on data governance, since they brought it up

The email's emotional core is concern for the prospect's customer database — where it lives, who controls it, whether it's safe. So reasonable a concern, in fact, that we spent an evening with the author's own governance documents. Three of them: the security page, the privacy policy, and the published sub-processor list. The findings are best described as a group project where nobody exchanged phone numbers.

The security page announces that our system was designed for todays modern frameworks and protocols — a sentence whose relationship with the apostrophe sets the tone. It lists, as security achievements: databases encrypted at rest, applications that encrypt in transit with TLS/SSL only, and disaster recovery consisting of our data hosting provider's backup services. SSL was deprecated over a decade ago, and transport encryption is a condition of a browser rendering your page at all — listing it as a differentiator is listing “doors that lock” on a home tour. It's not a fortress; it's the floor, described in the tone of a moat.

Now the contradiction. The security page states — twice — that ALL services and ALL data are hosted on Amazon Web Services (AWS) | Google Cloud Platform (GCP). Their sub-processor list, dated March 2026, lists GCP only. AWS does not appear. Either all customer data lives partly on AWS — in which case the legal disclosure is missing a sub-processor that hosts everything — or it doesn't, in which case the security page is decorative. One of those two documents is wrong, and both are theirs.

Archive comparison — same page, two dates2024-06-14 vs 2026-06-28

screenshot not found in this deploymentreceipts/privacy-policy-datestamp-diff.png

The sub-processor table's quietest line item: OpenAI, L.L.C., scope “All” products, processing personal data contained in user account information and text or files created by customer. Every product. Customer-created text and files. Routed to a generative-AI provider — disclosed only in a help-center table, while the privacy policy the world actually reads remains innocent of any AI processing whatsoever.

Archive capture — privacy policycapture · 2026-06-28

screenshot not found in this deploymentreceipts/lorem-ipsum-privacy-policy.png

Template placeholder text, in a production legal document. And it is not a stray line at the foot of the page — it is spliced into the middle of the sub-processor disclosure itself, running onto the contact address with no space between them: …available upon request by emailing privacy@aiq.com.Lorem ipsum dolor sit amet… A paste landed inside a sentence about where customer data goes, and nobody read the paragraph again.

Every capture has now been fetched and searched, and the answer is better than the guess we withdrew: these are two separate failures, nine months apart.

The effective date went backwards first. It reads August 17, 2023 on 14 June 2024 and July 9, 2023 by 5 October 2024 — a 113-day window — and it has read July 9, 2023 in every one of the fifteen archived states since. Six hundred and thirty-one days of a legal document certifying that its current text took effect five weeks earlier than the version it replaced.

The placeholder arrived much later, in the 77 days between 24 April and 10 July 2025, and appears in all eleven states after that. Whoever pasted it was editing a page whose date stamp had already been wrong for nine months, and left it wrong. Two people, or the same person twice, neither of them reading the document.

What is not in doubt is the persistence. Three hundred and fifty-two days, across eleven distinct archived states, the page growing from 45,687 to 47,160 bytes through eight different sizes — which is the part that matters. The document was not abandoned. It was edited, repeatedly, all year, by people who never read the paragraph they were editing around. Eleven revisions is eleven chances to notice.

They wrote us a letter about data stewardship. Their privacy policy contains lorem ipsum.

Favorite Find No. 2 · their counsel, rebutting their sales team

The service agreement reads their email for us

Their Services Agreement — revised May 7, 2026, so this is not archaeology; it is what their lawyers believe today — is reached via a footer link labeled “Terms and Conditions” that leads not to terms but to a help-center folder, shelved beside an article titled “EULA – Sample Only” and a “Charge Policy (Prior to March 2023)” maintained like a museum exhibit. The footer performing this navigation is copyrighted 2024, links its own logo to a page named old-home-2, and leaks raw Google Tag Manager URLs into the rendered page. This is the lobby. The contract inside is better.

Archive capture — services agreement §11.5capture · 2026-05-16

screenshot not found in this deploymentreceipts/services-agreement-11-5-loyalty.png

And the capstone. Section 6.1's “Permitted Uses” of Subscriber Data — expressly including Subscriber Personal Information — enumerates, at item (vi), use for the development, operation, and training of large language models and similar artificial intelligence, machine learning, and neural network applications. Not a sub-processor disclosure — a license, granted to themselves in the subscription contract, to train LLMs on customer data including personal information. Accompanied by §6.4's right to develop analytics that may be published, sold, or otherwise shared, and §6.6's reservation of the right to process or sell publicly available data that may pertain to Subscriber and its sales. None of which appears in the privacy policy — which remains, as established, partially lorem ipsum.

The company that asked our prospect whether they know where their data sits answered its own question, in its own contract: it sits in the training corpus.

Favorite Find No. 3 · a tour of the legal folder

Loose ends from the rest of the collection

• The footer link labeled “Refund Policy” resolves to a legal folder containing no refund policy — only a “Charge Policy (Prior to March 2023),” a document announcing its own obsolescence in its title, maintained as live legal content three years past the date it wears like a name tag.
• The Acceptable Use Policy introduces itself as “Schedule A” to a document it isn't attached to, and promises an express-agreement ceremony — “we will ask for your express agreement… before you upload or submit any content” — that a footer link filed under customer support cannot plausibly perform.
• Their legal corpus exists in two generations: the current help center, and an older support portal whose legal URLs remain indexed by search engines but now redirect to a page asking “What can we help you find?” — an unexpectedly philosophical response for a legal document.

Which brings us to the finding that is not a clerical matter. Section 9.3 of that Acceptable Use Policy — the one attached to nothing — states that a subscriber must not use the Services for any purpose relating to the offering for sale, sale or distribution of knives, guns or other weapons. It sits directly beneath the clause carving out cannabis from the prohibition on illicit drugs, so the drafting is deliberate: someone sat down, considered which regulated goods to permit, permitted cannabis, and prohibited weapons.

Their website sells a firearms product. There is a vertical landing page at aiq.com/industry/firearms headed The all-in-one platform designed to grow firearms businesses, offering SMS, email, push notifications, and e-commerce to firearms brands, stores, and ranges, with a Book Demo button. The Internet Archive holds seven captures of that page between 18 July 2025 and 18 July 2026, so it has been live and marketed for at least a year. And the prohibition is not some superseded clause the marketing outran: it is in the Acceptable Use Policy as published today. The archive holds only one capture of that document — a fact about what crawlers visited, not about what the policy says. Both statements are live, on the same domain, right now.

Archive captures — policy vs. product page2026-05-16 / 2026-07-18

screenshot not found in this deploymentreceipts/aup-firearms-contradiction.png

So either every firearms customer they have signed is in breach of the acceptable use policy from the moment of signup, or the acceptable use policy is decorative. Recall that this same document promises to obtain the subscriber's express agreement to the terms of this policy before any content is uploaded. If that ceremony ever occurs, they are asking gun retailers to affirm a policy forbidding gun retail. If it does not, the promise is the second false statement in the same file.

Their refund policy is an expired charge policy. Their terms are a folder. Their EULA has a sample. Their acceptable use policy prohibits one of their own verticals.

Favorite Find No. 4 · in which curl asks a few questions

The platform testifies too

For completeness, we asked their production application the same questions — no login required, since HTTP response headers speak to anyone with curl. Credit first: the login and privacy-preference pages ship HSTS with subdomain coverage, X-Frame-Options DENY, a sane referrer policy, and a permissions policy. Someone did half of this properly, and that half is genuinely fine.

The other half is the security page rendered in miniature. The Content-Security-Policy — the header whose sole purpose is preventing script injection — opens with 'unsafe-inline' 'unsafe-eval' on default-src, which is to a CSP what a doorstop is to a locked door. The policy exists, scans as present, and permits precisely the two things it was invented to forbid.

That same CSP then performs a public service their legal documents never managed: it enumerates their actual third-party surface — Google Analytics and Tag Manager, six varieties of HubSpot host, roughly a dozen Intercom endpoints, Zendesk, Sentry, Wistia, Vimeo, YouTube, a 2016-vintage fetch polyfill loaded off a public CDN without integrity attributes, and their own staging domains, allowlisted in production. The most complete sub-processor disclosure Alpine IQ has ever published is machine-readable, unintentional, and attached to every page load.

Two smaller exhibits close the tour. The production HTML ships developer commentary — a commented-out block annotated Uncomment this block after flag release — unfinished edits deployed to the world, the lorem ipsum pattern expressed in JavaScript. And the “Do Not Sell My Personal Information” page — the CCPA opt-out their footer offers every consumer — serves an empty “Initializing…” shell until the whole bundle executes under the CSP above, while its headers instruct archives never to preserve it: noindex, nofollow, noarchive, nosnippet. A privacy-rights page that requires full trust in their JavaScript to function, and politely asks history not to keep a copy.

Asked whether the platform matches the paperwork, the honest answer is: flawlessly.

Favorite Find No. 5 · the test they will never have to sit

On the subject of glass houses with no windows

One structural fact hangs over the entire email, unmentioned because mentioning it would dissolve the genre: every document the author quotes exists because we were legally required to write it. The 8-Ks, the 10-Qs, the going-concern language, the accumulated deficit, the default notices — that is what being a public company means. Your worst numbers, computed under GAAP, signed by officers under penalty of federal law, posted where any competitor's sales team can perform dramatic readings from them.

The author's company has never penned one. Not a 10-Q, not an 8-K, not an audited statement anyone outside their cap table has seen. They are private — so the sum total of the world's knowledge about their debt, burn rate, covenants, creditors, and going-concern status is: nothing. Their None of this is rumor flourish is quietly self-owning — regarding them, rumor is the only instrument their disclosure regime supports.

To be clear, and in keeping with our own standards: we make no claim about their financial condition, because no such claim can be made, by anyone, in either direction. That is precisely the point. The email's method — judge a company by its filings — is a test its author's company is structurally incapable of taking. Ask them what secured debt they carry, who holds it, what covenants bind them, what their last audit concluded. The answer is a smile, a subject change, and possibly an NDA. Our answer is a public docket — which is, after all, how they wrote the email in the first place.

They quoted our disclosures with the confidence of a company that will never have to make one.

Favorite Find No. 6 · the fan mail continues

The pattern

This is merely the latest entry in a running catalog — produced by a company trying to stay relevant in a vertical maturing faster than it is. The format keeps evolving; the method never does: real data points, surgically removed context, and the largest available number placed under the brightest available light, sold with the confidence of a fish-oil cart. We refuted the ten questions line by line and, per our agreement, published nothing. We will do the same here. The archive of unpublished rebuttals grows; think of it as our own accumulated deficit, except ours appreciates.

What the letter counts on is a reader new to this industry. Anyone who has worked in cannabis for more than a season has watched regulatory shifts, capital markets, and consolidation collide with perfectly sound businesses, repeatedly, and knows what that looks like on paper. They also know that appearing in a federal disclosure database at all is a function of scale — it means a company grew large enough to earn that level of scrutiny, and that the scrutiny is continuous rather than a verdict.

But the pattern is the most reassuring data point in this episode. Companies do not sustain a standing research operation about competitors they expect to die quietly. Nobody writes this much about a corpse, and nobody keeps writing. We are flattered by the line-by-line attention — genuinely, it rivals our auditors' — though it is a little deflating that so much reading produced so unimaginative a conclusion. The reporting is sound; it is only the inferences that are fiction. The effort spent on rhetorical sleight of hand is the real measure of how alive they suspect the deceased to be — and of how many deals keep going the wrong way.

They keep writing. We keep signing. Long may both continue.