Privacy Policy

The short version

• No tracking until you say yes. Analytics are switched off by default and stay off unless you accept the banner.
• One contact form, no accounts, no payments. What you type into the form goes to my inbox and nowhere else. Nothing to sign up for, nothing to log into.
• Nothing is sold or shared with advertisers. Ever. There is no ad network on this site and no ad network will be added without this page changing first.
• If you write, call, or use the form, I keep what you sent me so I can answer it and follow up.
• This page covers the website only. Consulting engagements are governed by the written agreement for that engagement.

Who this is

This site, yeomanlabs.co, is operated by YeomanLabs Consulting LLC, a Wisconsin limited liability company based in Madison, Wisconsin, United States. In this policy, "I" and "me" mean that company.

Questions about anything here go to info@yeomanlabs.co, and I answer them myself.

What gets collected automatically

Server and network logs

This site is served through Cloudflare. Like every web host, Cloudflare records technical information about requests in order to deliver pages and to block abuse: IP address, the page requested, timestamp, browser and operating system strings, and referring page. This happens for every visitor, before any consent decision, because a web server cannot return a page without it. I do not use these logs to build a profile of you, and I do not attempt to identify individual visitors from them.

Analytics, only after you accept

This site uses Google Analytics 4. It is configured with Google Consent Mode set to denied by default, which means that until you press Accept on the banner, no analytics cookie is written and no analytics data is stored or transmitted for your visit.

If you accept, Google Analytics records aggregate information about how the site is used: pages viewed, how long a visit lasted, approximate geographic region derived from a truncated IP address, device category, and which site or search sent you here. IP addresses are anonymized by Google Analytics 4 by default and are not stored in the reports I see. I use this to learn which pages are worth keeping, nothing more.

If you decline, or ignore the banner entirely, analytics stay off.

Cookies and local storage

Complete list. Nothing else is set by this site.

Cloudflare may also set a cookie for security and bot-detection purposes when its protection features are engaged. That is a strictly necessary function of the host and is not used for advertising. The contact form uses Cloudflare Turnstile to tell people from bots; it runs in a frame served from challenges.cloudflare.com, does not set a cookie on this site, and is not used to track you across sites.

What you send me directly

If you get in touch, whether through the contact form, by email, or by phone, what I hold is what you sent: your name, email address or phone number, your company, and whatever you told me about your situation. The form also asks for a rough endpoint count and what is prompting the project, because those two answers are what I need to tell you quickly whether I can help.

A form submission is checked by Cloudflare Turnstile, then emailed to me through Exchange Online from my own address. A copy of the submission, together with the IP address it came from and the browser string, is also held in Cloudflare's storage for 90 days as a backstop in case the email fails, and then expires automatically. The IP address exists to deal with abuse of the form and is not used for anything else.

I use what you send to reply, to scope work if it turns out I can help, and to follow up on that conversation. I do not add you to a mailing list, and there is no mailing list to add you to. Email for the domain is hosted on Microsoft Exchange Online.

If a conversation doesn't turn into work, I delete the thread once it's clearly gone cold, generally within twelve months. If it does turn into work, the records become business records and are kept for as long as tax, accounting, and professional-liability obligations require, typically seven years.

Who else handles this data

Three vendors, each doing one job:

• Cloudflare, Inc.: hosting, CDN, DDoS protection, the Turnstile bot check on the contact form, and the 90-day backstop copy of form submissions. Processes request logs and form submissions.
• Google LLC: Google Analytics 4. Processes analytics data, and only if you accepted.
• Microsoft Corporation: email hosting for the yeomanlabs.co domain (Exchange Online). Processes messages you send me, including contact form submissions once they are emailed to me.

Beyond those, I share personal information only where I am legally required to (a valid subpoena, court order, or comparable legal process) or where it is necessary to establish or defend a legal claim.

I do not sell personal information, and I do not share it for cross-context behavioral advertising, as those terms are defined under California and other US state privacy laws. There is no arrangement under which anyone pays for access to visitors of this site.

Your choices

Regardless of where you live:

• Decline analytics, or reset your choice using the button above.
• Block cookies in your browser, or use the Google Analytics opt-out browser add-on. The site works fine either way; nothing here depends on analytics running.
• Email me and ask what I hold about you, ask for a copy, or ask me to delete it. I'll do it, and I won't charge for it or make you justify the request.

If you're in the EEA, the UK, or Switzerland

My legal basis for server logs and the consent-storage entry is legitimate interest in operating and securing the site. My legal basis for analytics is your consent, which you may withdraw at any time without affecting anything that happened before you withdrew it. You have rights of access, rectification, erasure, restriction, portability, and objection, and you may lodge a complaint with your national supervisory authority. Data is processed in the United States by the vendors named above.

If you're in California or another US state with a privacy law

You have the right to know what is collected, to request deletion or correction, and to not be discriminated against for exercising either. Since no personal information is sold or shared for advertising, there is nothing here to opt out of on that front. Email the address above to exercise any of these.

Security

The site is served over HTTPS only. Email is authenticated with SPF, DKIM, and DMARC to make it harder to spoof mail from this domain. Accounts holding any of this data use multi-factor authentication.

That said, no method of transmitting or storing data is perfectly secure, and I'd rather say so than imply otherwise. Don't send confidential technical details about your environment (credentials, tenant identifiers, network diagrams) in a first email. Once there's a signed agreement in place, there's a proper channel for that.

Children

This site sells professional services to businesses. It is not directed at children, and I do not knowingly collect information from anyone under 16. If you believe a child has sent me information, email me and I'll delete it.

Client engagements are covered elsewhere

This policy covers visitors to this website. It does not cover data handled during a consulting engagement: your device inventory, directory data, tenant configuration, or anything else I touch while doing the work. That is governed by the confidentiality and data-handling terms of the written agreement for that engagement, which take precedence over this page in every respect.

Changes

If this policy changes, the effective date at the top changes with it. Material changes (a new analytics vendor, a contact form, anything that alters what is collected) will be described here rather than quietly swapped in.