The short version: we collect what you type into our contact form, a small amount of traffic data, designed not to identify you, to see which pages are read, and the routine technical logs every web server keeps. We use cookieless, first-party analytics. We run no advertising pixels and no third-party trackers, and we do not sell or share your personal information.
Notice at collection
This table summarises the personal information we collect, why, and for how long. The sections below explain each row in more detail.
| Category | What exactly | Why | How long | Sold or shared? |
|---|---|---|---|---|
| Identifiers and contact details | Name, email address, company name and, if you give it, a phone number, from the contact form or your email | To reply to you and, if we work together, to provide our services | While we are in conversation or working together, then as long as our business records require (see below) | No |
| Professional or commercial information | Your trade and whatever you write in the message box | To understand your business and answer your question | Kept with your contact details | No |
| Technical details sent with a contact form | A keyed digest of your IP address, your browser's user-agent string and the page the form was on | To limit abuse of the form and to know which page an enquiry came from | Kept with your contact details | No |
| Business information from public sources | Business name, contact details, licence details and website content, which can name an owner or licence holder | Internal market research, and deciding whom we might contact about our services | While the research is current, and deleted on request | No |
| Internet activity (site analytics) | Pages viewed, the referring website's domain, campaign tags in the link, device type, browser family, time on page and a visitor code that changes every day | To see which pages are read and where visitors come from | Up to 400 days | No |
| Internet activity (server logs) | IP address, the address requested, browser user-agent and time of each request | To keep the site running and secure and to diagnose faults | 7 days | No |
We do not collect sensitive personal information from visitors, and we do not use any personal information to infer characteristics about you.
Who we are
This site is run by Alumic Systems, Inc. ("Alumic", "we", "us"), a California business based in Los Angeles, California. We help trade contractors with website content, search, paid advertising and finding where enquiries fall out of their process. This policy covers this website and the enquiries it receives. When we take on a client, the written agreement for that engagement says how we handle any information the client shares with us to do the work.
What we collect and where it comes from
When you use the contact form
The form asks for:
- your name and email address (required);
- your company name, your trade and a phone number (all optional);
- a message describing what is going on (optional).
Along with what you type, we record:
- the path of the page the form was on, such as
/contact; - your browser's user-agent string, which names the browser and operating system;
- a keyed digest of your IP address. We do not store the address itself. The digest is a one-way code made with a secret key, and we use it only to count how many messages arrive from one place so the form cannot be flooded (five an hour and twenty a day).
If you give a phone number, we check it is a valid US or Canadian number and then store it encrypted. Our staff see only its last four digits in lists; the full number is decrypted only on the page a staff member uses to call you back.
The form also contains a hidden field that people never see. Automated form-fillers tend to complete it, and a submission that does is discarded.
When you email us
If you write to hello@alumic.agency or reply to us, we receive your email address, your name as your email program shows it, and whatever the message contains. That correspondence is held by our email provider.
When you browse the site
Our public pages include a small first-party analytics script. We built it ourselves; it sends data only to our own server. For each page you view it sends:
- the page's address, which we store as its path only, dropping everything after the
?except campaign tags; -
the campaign tags
utm_source,utm_mediumandutm_campaign, if the link you followed carried them; - the page you came from, which we store as its domain only, such as
google.com, and not at all when you move between pages of this site; - how long the page was visible on your screen.
From the request itself our server works out a device type (desktop, mobile or tablet) and a browser family (such as Chrome or Safari), and stores those instead of the full user-agent string.
To count visitors without cookies, the server combines your IP address and user-agent string with a random value that exists for one day (a "salt") and stores only the resulting one-way code. The IP address and user-agent are not stored. The salt is replaced at the start of each day (midnight UTC) and the old one is deleted, so the same visitor gets an unrelated code the next day, and once a salt is gone its codes can no longer be linked back to an IP address. The same code on one day is what lets us group pageviews into a visit.
Pageviews by our own signed-in staff, and by browsers that identify themselves as automated, are not recorded. The script sets no cookies and writes nothing to your browser's storage.
Web server logs
Like almost every website, our web server logs each request it receives: your IP address, the address requested, the time, the response and your browser's user-agent string. Sign-in tokens are removed from these logs before they are written.
The free tools
The calculators and checklists under /tools run entirely in your browser. What you type into them is not sent to us or anyone else. A tool that remembers your progress, such as a checklist, keeps it in your own browser's storage, where only you can see it and from where you can clear it.
Information about businesses from public sources
To understand the trades we work with, we research trade contracting businesses using publicly available information: state contractor licence records, public business listings and ratings, and the businesses' own websites. Some of that information names a person, such as a licence holder or an owner listed on a public record. We use it for internal market research and to decide whom we might contact about our services; we do not sell it or publish it. The rights described below apply to it, and you can ask us what we hold about you or your business and to delete it.
What we do not collect
- No advertising pixels, retargeting tags or social media trackers.
- No third-party analytics service. Our analytics are our own and stay on our own server.
- No third-party requests from our pages. Fonts and scripts are served from our own server, so no one else learns you visited.
- No cookies on the public site. The only cookies we set are for our own staff signing in (see the cookie notice).
- No accounts for visitors. There is nothing to sign up for.
- Nothing that ties a visit to this site to the rest of your browsing.
How we use it
- To answer your enquiry, by email or by phone if you gave us a number.
- To decide together whether we are a good fit, and to provide our services if we work together.
- To keep a record of our conversations with you so either of us can pick up where we left off.
- To understand, in aggregate, which pages are read and how people find the site, so we can improve it.
- To keep the site and form secure and working, and to stop spam and abuse.
- To comply with the law and to establish or defend legal claims.
We will not add you to a marketing email list because you sent us a message. If we would like to send you something beyond a reply, we will ask first.
Who we share it with
We share personal information only with service providers that help us run the business, under contracts that limit what they may do with it:
- our hosting provider, whose servers in the United States run this site and its database;
- our backup storage provider, which holds encrypted copies of the database;
- our email provider, which carries and stores the email we send and receive;
- data and processing providers we use for the business research described above, which supply public listing data or read public business websites on our behalf.
We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer or successor if the business is ever sold or reorganised, in which case this policy would continue to apply to it.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the past twelve months.
How long we keep it
- Enquiries and correspondence: for as long as we are talking or working together. If we do not go on to work together, we delete an enquiry when we no longer need it to follow up. If we do, we keep it for the length of the engagement and afterwards for as long as tax, accounting or legal obligations require. You can ask us to delete it at any time.
- Analytics pageviews: up to 400 days, then deleted. The daily salt behind the visitor code is deleted after one day.
- Business research data: while it is current enough to be useful; we replace it when we refresh the research, and delete a record on request.
- Web server logs: 7 days.
- Backups: encrypted database backups are kept for 30 days, so a record we delete can survive in a backup for up to that long before it expires.
Your California privacy rights
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you these rights over your personal information:
- Know and access: to ask what personal information we have collected about you, where it came from, why we collected it, who we disclosed it to, and for a copy of it.
- Delete: to ask us to delete personal information we collected from you, subject to exceptions the law allows, such as records we must keep.
- Correct: to ask us to correct inaccurate personal information.
- Opt out of sale or sharing: to tell us not to sell or share your personal information. We do neither, so there is nothing to switch off, but you may still tell us, and we will honour it if our practices ever change.
- Limit use of sensitive personal information: we do not collect sensitive personal information from visitors or use it to infer anything about you, so this right does not come into play.
- Non-discrimination: we will not treat you differently, or deny you a reply or a service, because you used any of these rights.
We apply the same rights to anyone who asks, wherever they live, as far as we reasonably can.
How to exercise your rights
Email hello@alumic.agency and tell us which right you want to use. We will confirm receipt within 10 business days and respond within 45 days. If we need longer, up to a further 45 days, we will tell you why.
Verification. Before we disclose, correct or delete anything, we need to be reasonably sure the request comes from you. Usually that means replying from, or confirming a code sent to, the email address you gave us. We will ask only for information we need to verify you, and use it only for that. The analytics visitor code changes daily and cannot be linked to you, so we cannot find or return analytics records about a particular person.
Authorised agents. Someone you have authorised may make a request for you. We will ask for proof of their authority, such as your signed permission, and may still ask you to verify your identity directly.
Global Privacy Control
If your browser sends a Global Privacy Control signal, we treat it as a valid request to opt out of the sale and sharing of your personal information. Because we do not sell or share personal information, honouring the signal does not change anything the site does today. If our practices ever change, a browser sending the signal will be opted out automatically, with nothing more for you to do.
Children
This site is for business owners and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, email us and we will delete it.
Security
- The whole site is served over encrypted HTTPS.
- Phone numbers are encrypted at rest with AES-256-GCM, under a key kept separately from the database. We keep a keyed one-way code of the number to spot duplicates, and the last four digits for display; nowhere do we store the number in readable form.
- IP addresses sent with the contact form are stored only as keyed digests, and analytics store no IP address at all.
- Only our own staff can reach enquiries, through a signed-in console. Database backups are encrypted before they leave the server.
No system is perfectly secure. If we learn of a breach that affects your personal information, we will tell you as the law requires.
Visitors outside the United States
We serve businesses in the United States, and this site and its data are hosted in the United States. If you visit from elsewhere, your information will be processed in the United States, where data protection law may differ from the law where you live. You can still ask us to access, correct or delete your information by email.
Changes to this policy
If we change how we handle personal information, we will update this page and the effective date at the top. If a change is significant, such as a new kind of information or a new purpose, we will say so clearly on this page before it takes effect, and we will not apply it to information collected earlier without your consent where the law requires it.
Contact us
Questions, requests and complaints about privacy go to hello@alumic.agency. We are Alumic Systems, Inc., Los Angeles, California.
Questions about this page go to hello@alumic.agency. Alumic Systems, Inc. is based in Los Angeles, California. Related: terms of service , cookie notice , accessibility .