Make the flagship reachable, and safe to trust with a client list

A market-readiness audit found the product sold a retention radar and delivered a
content generator: every "Show me who is slipping" button routed to an 11-field
content-marketing onboarding ending in "Generate my content preview", and the only
door to the radar was a localStorage-gated block on /preview that vanished on
reload and did not exist on a second device. On a phone the flagship did not exist
at all. This fixes that, and three things a real owner would have hit.

Funnel. Signup is one step and five fields (name, type, city, your name, email),
and it lands on the radar, not a content preview. Description and brand voice are
no longer collected up front; they are content-only and asked for later. The empty
radar leads with "See it with sample data", a one-click server-side import, so an
owner with no CSV handy sees the thing populated immediately.

Trust. The win-back no longer sends on one click. It drafts, stores the note, and
shows the owner exactly what will go out; a second, deliberate "Send it" delivers
it. This is the whole point of a product that emails your client list, and it
makes the FAQ's "you see everything the agent writes" true. Discard and Rewrite
are there too.

Deletion. There was no delete path anywhere, while /privacy promised an owner
could delete their data at any time. There is now a token-gated route that cancels
any subscription and removes every row in one transaction, a type-DELETE-to-confirm
control in the dashboard, and a privacy policy rewritten to describe the client
list it actually holds (controller/processor, CASL, self-serve deletion).

Honest numbers. The landing page claimed a regular is worth $1,200-$3,000 a year;
the cited source is a three-year loyalty-member figure, about $600 annualized, so
it now says that. "40% of new clients" was the wrong population (40% is the whole
base), corrected. The source line no longer calls vendor blogs "research".

Also: the logo is one shared BloomMark instead of the emerald app-icon that still
sat on setup, dashboard, preview and the legal pages; a booking export's cancelled
and no-show rows are no longer counted as visits; and an over-cap import keeps the
most recently active clients instead of an arbitrary slice.

Author: JonathanSolvesProblems

README.md

@@ -2,7 +2,7 @@
 
 **Bloom finds the clients a local business is about to lose, and writes to each one personally.**
 
-Nobody cancels. They just quietly stop coming, and the owner finds out months later, if ever. Roughly 40% of new clients are gone within a year, a first-timer who does not rebook within 30 days has about a one-in-five chance of ever returning, and a regular is worth $1,200 to $3,000 a year. The signal is invisible because it is an *absence*, spread across hundreds of people who each have their own rhythm.
+Nobody cancels. They just quietly stop coming, and the owner finds out months later, if ever. A typical salon loses about 40% of its clients every year, a first-timer who does not rebook within 30 days has about a one-in-five chance of ever returning, and a loyal regular is worth several hundred dollars a year (about $600). The signal is invisible because it is an *absence*, spread across hundreds of people who each have their own rhythm.
 
 An owner uploads a booking-history CSV from whatever they already use. Bloom works out each client's own visit rhythm, flags the ones drifting from it, and drafts a personal note to each. It is your appointment book, but it reads itself.
 

SUBMISSION.md

@@ -46,7 +46,7 @@ Bloom: the AI that catches the clients you're about to lose
 ### Elevator pitch (max 200 characters)
 
 ```
-Nobody cancels, they just stop coming. Bloom reads your booking history, finds who is drifting from their own visit rhythm, and writes each one a personal note. One salon client is worth $1,200 a year.
+Nobody cancels, they just stop coming. Bloom reads your booking history, finds who is drifting from their own visit rhythm, and writes each one a personal note. A loyal regular is worth several hundred dollars a year, so saving even one covers the software.
 ```
 (199 characters.)
 
@@ -70,11 +70,12 @@ answer to a harder question, and it was a question I only found by reading the
 retention research for salons and barbershops.
 
 Nobody cancels. They just quietly stop coming, and the owner finds out months
-later, if ever. About 40% of new clients are gone within a year. A first-timer
+later, if ever. A typical salon loses about 40% of its clients every year. A first-timer
 who does not rebook within 30 days has roughly a one-in-five chance of ever
 returning, which makes days 7 to 30 after a first visit the highest-value moment
-in the entire business and the one nobody is watching. And a regular is worth
-$1,200 to $3,000 a year, so this is not a rounding error, it is the largest
+in the entire business and the one nobody is watching. And a loyal regular is
+worth several hundred dollars a year (about $600 annualized), so this is not a
+rounding error, it is the largest
 single profit leak most shops have.
 
 The reason nobody watches it is not laziness. It is that the answer is invisible:
@@ -215,9 +216,9 @@ something the market already gives away.
 The real problem was hiding in the retention research. In a salon or barbershop,
 nobody cancels. They just quietly stop coming, and the owner finds out months
 later, from a gap in the appointment book that nobody had time to notice. About
-40% of new clients are gone within a year. A first-timer who does not rebook
-within 30 days has roughly a one-in-five chance of ever returning. A regular is
-worth $1,200 to $3,000 a year. That is the largest single profit leak most shops
+40% of a salon's clients are gone within a year. A first-timer who does not
+rebook within 30 days has roughly a one-in-five chance of ever returning. A loyal
+regular is worth several hundred dollars a year. That is the largest single profit leak most shops
 have, and it stays invisible because it is an absence, spread across hundreds of
 people who each keep their own rhythm.
 
@@ -256,7 +257,7 @@ has no employees but me. What it creates is not headcount, it is protected
 livelihood. A neighbourhood salon runs on thin margins and a handful of chairs,
 and every regular who drifts away unnoticed is revenue that would otherwise pay a
 stylist. When Bloom keeps 20 clients a year who would quietly have left, worth on
-the order of $25,000, that can be the difference between a shop cutting a chair and
+the order of $12,000, that can be the difference between a shop cutting a chair and
 keeping one, or hiring the next. The economic opportunity Bloom enables is the
 retained revenue base that local service jobs actually depend on, for people well
 beyond any founding team: the stylists, barbers, and front-desk staff whose hours
@@ -369,7 +370,7 @@ field instead.
 ### Explain how your project uses AI to impact the world, specifically in the category you have chosen.
 
 The biggest profit leak in a local service business is invisible. Roughly 40% of
-new clients are gone within a year, and a first-timer who does not rebook within
+a salon's clients are gone within a year, and a first-timer who does not rebook within
 30 days has about a one-in-five chance of ever coming back. Owners do not ignore
 this because they do not care. They ignore it because the signal is an ABSENCE
 spread across hundreds of people who each have a different rhythm, and because
@@ -379,8 +380,8 @@ Bloom removes both barriers. A deterministic engine finds the drift by measuring
 every client against their own median cadence, and Gemini writes each of them a
 note that reads like the owner remembered them, because it is given that person's
 real history. A shop with 400 clients might have 20 slipping in a given month,
-worth $25,000 a year between them. Saving three of them pays for the software for
-years.
+worth over $10,000 a year between them. Saving three of them pays for the software
+for years.
 
 This is squarely Small Business Services: the AI does not advise the owner, it
 performs a service the business would otherwise pay a person for, and the outcome
@@ -398,8 +399,8 @@ to those clients requires a plan: Starter $49/month or Pro $99/month, billed
 through Stripe. Between the two tiers the only difference is who sends the weekly
 newsletter; both include the win-back, because that is the reason to pay at all.
 
-The pricing argument writes itself: a lapsed regular is worth $1,200 to $3,000 a
-year, so recovering ONE client pays for a year of Starter several times over. I am
+The pricing argument writes itself: a lapsed regular is worth several hundred
+dollars a year, so recovering ONE client pays for a year of Starter. I am
 not asking an owner to believe a projection, I am showing them their own losses
 and charging less than one of them.
 

prisma/schema.prisma

@@ -72,6 +72,11 @@ model Client {
   /// Median days between this client's visits. Null when they have only ever
   /// visited once, which is exactly the highest-risk case.
   cadenceDays  Int?
+  /// A drafted win-back the owner has not yet approved. Held here so the owner can
+  /// read exactly what will be sent before it goes, which is the whole trust story
+  /// of a product that emails your clients. Cleared on send or discard.
+  winBackDraft   String?
+  winBackDraftedAt DateTime?
   /// Set when the agent has already reached out, so it never nags twice.
   winBackSentAt DateTime?
   /// Anti-spam law applies to win-back email too. Once set, the agent will never

src/app/api/businesses/[id]/delete/route.ts

@@ -0,0 +1,77 @@
+import { NextRequest } from 'next/server'
+import Stripe from 'stripe'
+import { db } from '@/lib/db'
+
+/**
+ * Delete a business and everything attached to it.
+ *
+ * The privacy policy promises an owner can delete their data at any time, and
+ * this is the code that keeps that promise. It is also the answer to the single
+ * biggest objection this product has: an owner is uploading their entire client
+ * list, and they need to know they can take it back.
+ *
+ * POST + token-gated, so a link prefetch can never wipe an account. Cancels any
+ * live subscription immediately (the account is being destroyed, not paused),
+ * then deletes the children before the parent, since the schema has no cascade.
+ */
+export async function POST(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const { id: businessId } = await params
+  const token = request.nextUrl.searchParams.get('t') ?? ''
+
+  const business = await db.business.findUnique({ where: { id: businessId } })
+  // 404 rather than 403 so the route never confirms a business exists.
+  if (!business || !token || token !== business.dashboardToken) {
+    return new Response('Not found', { status: 404 })
+  }
+
+  // Stop billing first. If this throws, do NOT delete: leaving the account intact
+  // is far better than destroying the record while a subscription keeps charging a
+  // card with nothing left to point it at.
+  if (business.stripeSubscriptionId && process.env.STRIPE_SECRET_KEY) {
+    try {
+      const stripe = new Stripe(process.env.STRIPE_SECRET_KEY)
+      await stripe.subscriptions.cancel(business.stripeSubscriptionId)
+    } catch (err) {
+      // "No such subscription" means it is already gone, which is fine; anything
+      // else is a real failure and must stop the delete.
+      const msg = String((err as Error)?.message ?? err)
+      if (!/No such subscription|resource_missing/i.test(msg)) {
+        console.error('Delete blocked, could not cancel subscription:', err)
+        return page(
+          'Could not delete yet',
+          'I could not cancel your subscription, so I have not deleted anything, to be safe. Please try again in a minute, or contact support.'
+        )
+      }
+    }
+  }
+
+  // Children before parent, one transaction, so a half-delete cannot strand rows
+  // that outlive the business they belonged to.
+  await db.$transaction([
+    db.client.deleteMany({ where: { businessId } }),
+    db.subscriber.deleteMany({ where: { businessId } }),
+    db.weeklyContent.deleteMany({ where: { businessId } }),
+    db.agentLog.deleteMany({ where: { businessId } }),
+    db.business.delete({ where: { id: businessId } }),
+  ])
+
+  return page(
+    'Your account and data are deleted.',
+    'Everything you uploaded is gone: your client list, your history, and your account. Nothing more will be sent to anyone. Thank you for trying Bloom.'
+  )
+}
+
+/** A plain confirmation page. There is no dashboard to return to anymore. */
+function page(title: string, body: string): Response {
+  const html = `<!doctype html><html lang="en"><head><meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${title}</title></head>
+<body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#f4f1e4;font-family:system-ui,-apple-system,'Segoe UI',Roboto,sans-serif;color:#16150f">
+  <div style="max-width:440px;padding:32px;text-align:center">
+    <h1 style="font-size:1.4rem;margin:0 0 12px">${title}</h1>
+    <p style="color:#56524a;line-height:1.6;margin:0 0 24px">${body}</p>
+    <a href="/" style="display:inline-block;background:#16150f;color:#f4f1e4;text-decoration:none;padding:12px 22px;border-radius:2px;font-weight:600">Back to home</a>
+  </div>
+</body></html>`
+  return new Response(html, { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } })
+}

src/app/api/businesses/route.ts

@@ -6,15 +6,19 @@ import { allowRequest, LIMITS } from '@/lib/ratelimit'
 const schema = z.object({
   name: z.string().min(1).max(100),
   type: z.string().min(1),
-  city: z.string().min(1).max(100),
+  city: z.string().max(100).default(''),
   province: z.string().max(50).default(''),
   country: z.string().max(3).default('CA'),
-  description: z.string().min(10).max(1000),
+  // Optional now. The flagship is the retention radar, which needs none of this;
+  // a description is only used for weekly content, so collecting it up front gated
+  // a spreadsheet analysis behind a marketing question. Prompted for later, in the
+  // dashboard, only when the owner turns content on.
+  description: z.string().max(1000).default(''),
   brandVoice: z.enum(['friendly', 'professional', 'casual', 'bold', 'elegant']).default('friendly'),
   contentLanguage: z.enum(['en', 'fr', 'es', 'pt', 'it', 'de']).default('en'),
-  // Optional at signup so the free preview stays frictionless. It is required
-  // before Pro can email (enforced in the send path), and editable in the
-  // dashboard, so a new owner is never blocked from seeing their first content.
+  // Optional at signup so the radar stays frictionless. Required before any email
+  // can send (enforced in the send path), and editable in the dashboard, so a new
+  // owner is never blocked from seeing who is slipping.
   mailingAddress: z.string().max(200).optional(),
   promotions: z.string().max(500).optional(),
   ownerName: z.string().min(1).max(100),

src/app/api/clients/import/route.ts

@@ -3,6 +3,7 @@ import { db } from '@/lib/db'
 import { parseBookingCsv } from '@/lib/import-csv'
 import { assessAll, summarize } from '@/lib/retention'
 import { publicBaseUrl } from '@/lib/config'
+import { sampleCsv } from '@/app/api/sample-csv/route'
 
 export const maxDuration = 60
 
@@ -20,6 +21,10 @@ export async function POST(request: NextRequest) {
   const token = form.get('t')?.toString() ?? ''
   const businessId = form.get('businessId')?.toString() ?? ''
   const file = form.get('file')
+  // One-click "try it with sample data": seed the built-in sample book without
+  // making a new owner download a CSV and upload it back. The follow-up sample
+  // (a client rebooked) uses sample=2, so a demo can show a save land.
+  const sample = form.get('sample')?.toString() ?? ''
 
   const business = await db.business.findUnique({ where: { id: businessId } })
   // 404 rather than 403 so the route never confirms a business exists.
@@ -31,14 +36,19 @@ export async function POST(request: NextRequest) {
   const back = (params: string) =>
     `${origin}/dashboard/${businessId}/clients?t=${encodeURIComponent(token)}&${params}`
 
-  if (!(file instanceof File) || file.size === 0) {
-    return Response.redirect(back('import_error=nofile'), 303)
-  }
-  if (file.size > MAX_BYTES) {
-    return Response.redirect(back('import_error=toobig'), 303)
+  let text: string
+  if (sample === '1' || sample === '2') {
+    text = sampleCsv(sample === '2')
+  } else {
+    if (!(file instanceof File) || file.size === 0) {
+      return Response.redirect(back('import_error=nofile'), 303)
+    }
+    if (file.size > MAX_BYTES) {
+      return Response.redirect(back('import_error=toobig'), 303)
+    }
+    text = await file.text()
   }
 
-  const text = await file.text()
   const result = parseBookingCsv(text)
 
   if (result.error) {
@@ -48,7 +58,14 @@ export async function POST(request: NextRequest) {
     return Response.redirect(back('import_error=norows'), 303)
   }
 
-  const clients = result.clients.slice(0, MAX_CLIENTS)
+  // If a book is over the cap, keep the most recently active clients rather than
+  // an arbitrary slice: a blind slice(0, N) kept whoever happened to appear first
+  // in the file and could drop the newest first-timers, who are the exact cohort
+  // on the 30-day cliff that this product exists to catch.
+  const clients =
+    result.clients.length > MAX_CLIENTS
+      ? [...result.clients].sort((a, b) => b.lastVisitAt.getTime() - a.lastVisitAt.getTime()).slice(0, MAX_CLIENTS)
+      : result.clients
 
   // Everyone the agent wrote to who has now booked again. Keyed by email, which is
   // the actual unique constraint: two clients can share a display name, and