Privacy Policy

⁰¹Personal data that You provide to Us

When You submit a “Let’s Talk”, “Talk to us”, “Become a client”, “Book a session”, or other contact or project form, or contact Us by email, We process the information You provide. If You apply for a role or otherwise send Us recruitment materials, We also process the information You choose to provide for that purpose.

Depending on the form or interaction, this information may include:

• Your name;
• Your email address or business email address;
• Your company, job title, phone number, or other business contact details, where provided;
• Information about Your project, inquiry, booking request, budget, or other message content;
• Links to Your professional or social profiles, resume, portfolio, or similar materials, where You choose to provide them;
• Any other information You voluntarily include in a form, email, or communication with Us.

Fields marked as required must be completed so that We can process the relevant request. Other information is optional unless We specifically state otherwise.

⁰²Automatically-collected information

The Website uses a combination of first-party server-side statistics, security infrastructure, and consent-dependent Analytics or Marketing tools. Not all technical information is stored, and some information is processed only transiently to deliver or secure the Website.

Our first-party server-side statistics may record the page path, referrer (internal path or external origin only), country, coarse device class (mobile/desktop), technical traffic classification (for example human view, bot, or speculative prefetch), HTTP status, and a daily pseudonymous visitor hash.

For the first-party statistics system, raw IP address and user-agent are used transiently in memory to calculate the daily hash and are not written to Our statistics database.

The daily visitor hash is generated using a random salt that changes each UTC day. The salt is kept for no longer than 48 hours, after which identifiers for the relevant day cannot be linked across days using that salt.

Plausible Analytics receives the page URL and referrer and, in transport only, the visitor’s IP address and user-agent to calculate its own daily-rotating visitor identifier. Plausible does not store the raw IP address or user-agent.

Google Analytics 4 and Ahrefs Analytics process Website usage information only after You consent to the Analytics category through the consent banner.

For Google Analytics 4, this may include page and event information, pseudonymous identifiers, and Analytics cookies after consent. Ahrefs Analytics operates without cookies but may still process technical request and usage information.

Cloudflare processes technical request information, including IP address and browser signals, for content delivery, security, traffic management, and bot protection, including Cloudflare Turnstile on contact forms.

Profound receives server-side bot and AI-crawler request metadata, including user-agent information and a truncated form of the IP address, to help Us understand automated access to the Website.

RB2B is used only after consent to the Marketing category. It is configured so that person-level and company-level identification applies to visitors located in the United States only.

Through RB2B, We may receive a visitor’s name, job title, company, business email, LinkedIn URL and location, and sometimes company website, industry, estimated employee count, and estimated revenue.

RB2B may associate Website activity and technical identifiers with information held by RB2B or its data partners in order to identify United States business visitors and provide professional or business contact information to Us.

The Website may also generate standard request metadata when it loads content or scripts from external delivery providers, including jsDelivr. Media content is served through Our own infrastructure hosted on AWS behind Cloudflare.

⁰³Cookies

We use Cookies and similar technologies to operate and secure the Website, remember Your privacy choices, measure Website usage and, where You have provided the relevant consent, identify potential business visitors.

On Your first visit, the Website displays a consent banner that allows You to Accept All, Reject non-essential technologies, or Manage Your Preferences by category. The available categories are Necessary, Analytics and Marketing.

You can review or change Your choice at any time by using the “Cookie Settings” control available in the Website footer. Withdrawing consent does not affect the lawfulness of Processing carried out before withdrawal.

Necessary technologies

Necessary technologies are used to provide, secure and operate the Website and to remember the privacy choices You make. They are not used for advertising or behavioural profiling.

The Website currently uses:

• la26:consent — a localStorage entry used to remember the choices You make in the consent banner. It does not itself contain Your name, email address or other directly identifying information. The choice remains stored on Your device until You change Your preferences, clear Your browser storage, or We ask You to renew Your choice, including where Our consent-based technologies or purposes materially change.
• Cloudflare and Cloudflare Turnstile — used for Website delivery, security, traffic management and protection of contact forms against automated submissions. These services may process technical information such as IP address and browser/device signals and, depending on the security configuration, may use short-lived security cookies or tokens for the period necessary to validate a security challenge or maintain the relevant security state.

Analytics technologies

Analytics technologies help Us understand how visitors use the Website. The following Analytics services activate only after You consent to the Analytics category:

• Google Analytics 4 (Google LLC). Google Analytics is operated through Google Tag Manager using Consent Mode v2 in Basic mode. Before Analytics consent, GA4 does not activate, Analytics events are not sent to Google Analytics, and Analytics cookies are not set.
• Google Analytics may use the following first-party cookies:
  After Analytics consent, Google Analytics 4 may set first-party Analytics cookies, including _ga and property-specific _ga_* cookies, to distinguish visitors and maintain Analytics session state. Their default Google lifespan is up to approximately two years, subject to browser limits and Our configuration. If You withdraw Analytics consent through Cookie Settings, the Website stops Google Analytics transmission and deletes the Google Analytics cookies set by the Website.
• Ahrefs Analytics — cookieless Website analytics that runs only after Analytics consent. It does not set Analytics cookies but may process technical request and usage information.

Our first-party server-side statistics and Plausible Analytics operate without Cookies or similar storage on Your device. They are used for aggregated Website statistics and are processed on the basis of Our legitimate interests, as further described in this Policy.

The Google Tag Manager container itself may be fetched from Google's servers before Analytics consent. This produces a standard network request containing technical connection information such as IP address and user-agent, but GA4 does not activate and Google Analytics data are not sent until Analytics consent is granted.

Marketing technologies

We currently use RB2B / Retention.com for business visitor identification. RB2B activates only after You consent to the Marketing category. The service is configured so that person-level and company-level identification is limited to visitors located in the United States.

When activated, RB2B uses first-party Cookies and similar identifiers for session continuity, visit attribution, location-based matching and visitor identity resolution. Depending on their function, these technologies last from the current session up to approximately 12 months. They do not themselves store a visitor's name, email address or telephone number.

RB2B may nevertheless associate Website activity and technical identifiers with information held by RB2B or its data partners to identify a United States business visitor and provide Us with professional or business information, such as name, job title, company, business email address, LinkedIn URL and location. We or service providers acting on Our behalf may use that information for relevant business communications, subject to applicable law.

You may opt out of RB2B / Retention.com identification through: https://app.retention.com/optout.

Managing Your choices

You do not need to accept Analytics or Marketing technologies in order to use the Website. You can:

• accept or reject non-essential technologies when the banner is first displayed;
• select Analytics and Marketing separately through Manage Preferences;
• change or withdraw Your selection at any time through Cookie Settings in the Website footer;
• delete Cookies through Your browser settings.

If We materially change the purposes for which a consent-based technology is used or add a new category of Processing that is not covered by Your previous choice, We will request consent again where required.

The Website does not currently respond to browser Do Not Track (DNT) signals as a separate Website control. You can manage Analytics and Marketing technologies at any time through Cookie Settings. When active, certain third-party Analytics or Marketing providers may receive information about Your online activity over time or across websites as described in this Policy.

⁰¹Legal basis of Personal Data Processing

We process Personal Data only where We have a legal basis under the law applicable to the relevant Processing. Depending on the context, We rely on:

• Consent - for Google Analytics 4, Ahrefs Analytics, RB2B, and other non-essential Analytics or Marketing technologies where consent is required;
• Contract or pre-contractual steps - where You are acting in Your personal capacity and Processing is necessary to take steps at Your request before entering into a contract with You or to perform a contract with You;
• Legitimate interests - including responding to and managing B2B inquiries where You act on behalf of an organisation, privacy-preserving first-party statistics, server-side Plausible Analytics, Website and information security, technical operation of Our tag-management and consent configuration, content delivery, Cloudflare/Turnstile, Profound bot and AI-crawler analysis, and business communications where permitted by applicable law, provided that Our interests are not overridden by Your rights and freedoms.

Legal obligations - where Processing is necessary for Us to comply with applicable law, regulatory requirements, court orders, or other binding obligations.

Where Processing is based on consent, You can withdraw that consent at any time. Cookie-related consent can be changed through “Cookie Settings”; for other privacy requests, contact Us at [email protected]. Where Processing is based on legitimate interests, You may have the right to object as described above.

⁰²Purpose of data processing

We process Personal Data for the purposes described below and only to the extent reasonably necessary for those purposes.

Our principal purposes of Processing include:

• Responding to inquiries and providing Services

We use contact and project information to respond to Your request, communicate with You, prepare proposals, arrange sessions, and provide or administer Our Services.

• Website analytics and improvement

We use first-party statistics, Plausible Analytics and, with Your consent, Google Analytics 4 and Ahrefs Analytics to understand Website performance and usage and to improve content and user experience.

Business visitor identification and business development

Where You have consented to the Marketing category and are located in the United States, We use RB2B to identify potential business contacts and companies visiting the Website, understand business interest in Our Services, and support relevant B2B communications.

• Recruitment

If You apply for a role or send Us recruitment materials, We use that information to assess and communicate about Your application and, where separately agreed, future opportunities.

• Security, fraud prevention and automated-access monitoring

We use Cloudflare, Cloudflare Turnstile, server/security logs and Profound to protect the Website, distinguish human and automated traffic, investigate misuse, and understand bot and AI-crawler access.

• Compliance with legal obligations and protection of legal rights

We may process or disclose Personal Data where necessary to comply with applicable law, lawful requests, or legal process, or to establish, exercise or defend legal claims.

• Communications and support

We use Your contact information to respond to questions, provide support, and communicate about a request or Service. Marketing communications, where used, are sent only on an appropriate legal basis and include a way to opt out where required.

⁰¹ How We process and where We store

We use selected service providers and infrastructure providers to operate the Website and process Personal Data for the purposes described in this Policy. Depending on the service, a provider may act as Our Processor or may process limited information under its own applicable privacy terms.

Webflow, Inc. (United States) - Website hosting and form submissions. Form submissions are also delivered as email notifications to [email protected] through Google Workspace.

Cloudflare, Inc. (United States / global edge network) - CDN, proxy, security, traffic management, Cloudflare Turnstile, and technical Processing supporting Our first-party statistics.

Plausible Insights OÜ (Estonia; EU-hosted servers) - server-side, privacy-preserving Website statistics. Plausible acts as a Processor under its data processing terms.

Google LLC / applicable Google entity - Google Tag Manager, Google Analytics 4 after Analytics consent, and Google Workspace for email copies of form submissions.

Ahrefs Pte. Ltd. (Singapore) - cookieless Website analytics after Analytics consent.

RB2B / Retention.com (United States) - United States-only person-level and company-level visitor identification after Marketing consent, as described above.

Profound (United States) - server-side analytics of bot and AI-crawler request logs, including truncated IP information and request metadata.

jsDelivr (multi-CDN infrastructure) - delivery of certain script libraries on case pages; the browser sends standard request information when those resources are requested.

Our media servers use AWS infrastructure behind Cloudflare. The media domain is operated as Our first-party infrastructure and is used to deliver Website assets.

⁰²Cross Border Data Transfer

Because the Company is established in the United States and some of Our providers are located outside the EEA or the United Kingdom, Personal Data may be transferred internationally.

Where GDPR or UK GDPR applies, We use a lawful transfer mechanism as required for the relevant transfer, which may include:

• an adequacy decision, including the EU-U.S. Data Privacy Framework or its UK Extension where the relevant recipient is validly certified and the transfer is covered;
• the European Commission Standard Contractual Clauses (“SCCs”) for transfers from the EEA; and

the UK International Data Transfer Agreement (“IDTA”) or the UK Addendum to the SCCs, where applicable to transfers from the United Kingdom.

Plausible Analytics is provided by Plausible Insights OÜ in Estonia and, according to the information provided to Us, its relevant analytics data are hosted in the European Union.

⁰³Disclosure of Personal Data

We do not sell Personal Data for monetary consideration. We do, however, disclose Personal Data or technical information to service providers, vendors, professional advisers, regulators, and other recipients where necessary for the purposes described in this Policy. This may include:

• Website hosting, cloud, security, analytics, communications, content-delivery, and visitor-identification providers described above;
• Professional advisers, including legal, accounting, and other consultants where reasonably necessary;
• Government authorities, courts, regulators, or law-enforcement bodies where disclosure is required or permitted by law.

We may also disclose Personal Data:

• to comply with applicable law, lawful process, or binding requests;
• to protect Our rights, security, users, or third parties; and
• in connection with a merger, acquisition, financing, reorganisation, sale of assets, or similar corporate transaction, subject to appropriate protections.

⁰⁴Links to other websites

Our Services may contain links to Third-Party websites over which We have no control. When visiting a Third-Party website, We strongly advise You to review Your privacy policies and terms of service.

We have no control over or responsibility for Third-Party websites' content, privacy policies, or practices.