Data and confidentiality
Privacy Policy
Inquiries and working session requests are treated as confidential by default, and optional analytics remain under visitor control.
01 / Data collected
what INFORMATION IS COLLECTED
When you submit or begin a working session request, relationship signup, field-paper story, involvement signal, or speaking engagement request, we collect the information you choose to provide: contact details, organization or affiliation, role, problem or story context, desired outcome, timing, engagement interest, urgency, budget context, story-use preference, NDA preference, and source attribution such as UTM source or referrer domain.
The request form can save draft progress after a usable email address is entered. Each inquiry record stores the privacy notice version, contact permission state, contact permission timestamp when granted, and the current analytics-consent state.
We do not sell inquiry information. We use it to evaluate fit, prepare for a conversation, respond to the request, manage follow-up, and improve the request process.
02 / Analytics choice
keep ANALYTICS OPTIONAL
Optional analytics run through Google Tag Manager, Google Analytics, and Microsoft Clarity only after analytics consent is granted. Consent is denied by default, and the Privacy choices control can be reopened to change that choice.
Analytics events are designed not to include personal information. We track page activity, paper read/DOI clicks, form-start and form-submit status, traffic source, medium, campaign, and referrer domain. Full referrer URLs, names, email addresses, phone numbers, and form text are not sent to analytics.
Request-session, relationship, and field-paper story forms are marked for Clarity masking so typed form content is not visible in recordings or heatmaps.
03 / Service providers
use SYSTEMS THAT SUPPORT THE SITE
The website is hosted on Vercel. Inquiry records are stored in Supabase and are available only through server-side application routes and authenticated admin access. Email notifications are sent through Resend to the internal Grumpy Lemon recipient.
Google Analytics, Google Tag Manager, and Microsoft Clarity are used for optional measurement and site-improvement reporting when analytics consent is granted.
If HubSpot or another relationship-management system is connected later, this notice will be updated before that system is used for production inquiries.
04 / Data rights
understand YOUR PRIVACY RIGHTS
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or request a copy of personal data associated with your request. You may also withdraw consent for optional analytics through the Privacy choices control.
- Controller
- Grumpy Lemon Enterprises
- Privacy contact
- chris@grumpylemon.com
- Response target
- Data-rights requests should be reviewed and answered within one month unless a legally allowed extension applies.
- Retention
- Stale drafts should be reviewed for deletion after 90 days. Submitted leads should be reviewed after 24 months unless there is an active relationship, legal need, or business reason to retain them.
- Security
- Administrative access is restricted, and inquiry records are not exposed through public database access.
05 / Confidentiality
keep SENSITIVE CONTEXT OFF THE PUBLIC SITE
If your issue is sensitive, say so in the request. NDA available. Do not submit regulated, classified, or legally privileged information through the website form.
This notice may be updated as the site, forms, analytics, or service providers change.