Privacy Policy

1. Who We Are and What This Policy Covers

ShadowRock Consulting LLC (“ShadowRock”, “we”, “us”) is a Texas limited liability company with its principal office at 3007 Mohican St., El Dorado Hills, CA 95762, United States. We provide customer experience, employee experience, CRM, and AI consulting services to businesses.

This policy explains how we collect, use, disclose, and protect personal information through shadowrock.io and its pages that link to this policy (the “Site”), through our contact and consultation forms, and in our business dealings with prospective clients, client personnel, partners, and vendors. For this information, ShadowRock is the “controller” (GDPR) and the “business” (US state privacy laws).

This policy does not cover personal information we handle on a client’s behalf during a consulting engagement, such as data inside a client’s Zendesk or CRM instance. In that work we act as the client’s processor or service provider under our Service Agreement, and the client’s own privacy notice applies.

2. Summary

• We collect what you send us through our forms or by email, plus technical data from your browser. Through analytics, advertising, and session-recording tools, we also collect data about how you use the Site.
• We use it to answer inquiries, run and secure the Site, understand and improve how the Site is used, fix problems, and advertise our services, including showing our ads to people who have visited the Site (remarketing).
• We do not sell personal information for money. We do “sell” or “share” personal information, as those terms are defined in some US state laws, when our advertising partners Google and Apollo receive identifiers and internet activity from the Site for cross-context behavioral advertising. You can opt out in one click with Your Privacy Choices in the Site footer or Do Not Sell or Share My Personal Information in our cookie notice. We automatically honor Global Privacy Control signals.
• In the United States, including California, and in most other countries, these tools are on by default. On your first visit we show a notice where you can accept all, decline all, or choose by purpose.
• In the European Economic Area, the United Kingdom, Switzerland, Quebec, and the other locations listed in Section 6, we do not use analytics, advertising, or session-recording tools at all, and we do not show a cookie banner.
• To exercise your privacy rights, email legal@shadowrock.io.

3. Personal Information We Collect

Information you give us

Our contact, consultation, and landing-page forms ask for your name, work email address, and message. You can also give your company, role or title, and the service you are interested in. Landing-page forms also record which landing page you used. Each form asks you to check a box agreeing to our Terms of Use and this policy. When you submit it, we keep a record of that agreement with your inquiry: the date and time, which form you used, the versions of the Terms of Use and of this policy, a random submission identifier, and the IP address your request came from. If you email us, call us, or meet with us, we collect your contact details, business details, and what you tell us.

Please do not send us sensitive personal information, such as health, financial account, or government ID details, through the Site.

Information collected automatically

• Device and connection data: IP address, browser and device type, operating system, language, referring page, pages requested, and date and time. Cloudflare, our network and security provider, processes this to deliver and protect the Site.
• Approximate location: the country, and where available the state or province, derived from your IP address. We use it to decide which cookie rules apply to you, and we do not store it. We do not collect precise geolocation.
• Bot-protection signals: when you submit a form, Cloudflare Turnstile checks browser and device signals to confirm a person, not a bot, is submitting it. Your IP address is sent to Cloudflare with that check.
• Cookie and usage data: where the tools in Section 6 run, online identifiers, pages viewed, interactions such as clicks and scrolling, and the campaign or ad that brought you to the Site.
• Session recordings: where session recording runs, a reconstruction of your visit described in Section 6.

Information from other sources

We may receive business contact information, such as name, job title, employer, and work email, from business data providers such as Apollo.io and from public professional profiles, to identify organizations that may benefit from our services. Apollo’s website tool may also tell us which organization is associated with the IP address of a Site visitor.

4. How We Use Personal Information

Where the GDPR, UK GDPR, or Swiss data protection law applies, the legal basis for each use is shown in brackets.

• Responding to inquiries and providing services: replying to you, scheduling consultations, preparing proposals, and managing our relationship with you or your organization. [Steps you ask for before a contract, and our legitimate interest in responding to business inquiries.]
• Routing and tracking inquiries: form submissions arrive as email and become tickets in our help desk and records in our CRM. Our help desk applies automated tagging and spam filtering. [Legitimate interests.]
• Operating and securing the Site: delivering pages, preventing spam, fraud, and abuse, limiting repeated form submissions, and fixing errors. [Legitimate interests. Storage that is strictly necessary for these purposes does not require consent.]
• Analytics and session recording: understanding how visitors use the Site, finding and fixing problems, and improving the user experience. [Not used in the EEA, the United Kingdom, or Switzerland.]
• Advertising and marketing: measuring how our Google Ads campaigns perform, showing our ads to people who have visited the Site or contacted us (remarketing and Customer Match, described in Section 6), and identifying organizations that visit the Site. [Not used in the EEA, the United Kingdom, or Switzerland.]
• Business communications: following up on your inquiry and sending relevant information about our services or events. [Legitimate interests, or consent where the law requires it.]
• Legal and compliance: complying with law, handling privacy requests, enforcing our terms, and establishing or defending legal claims. [Legal obligation and legitimate interests.]
• Business transfers: as part of a merger, acquisition, financing, or sale of assets, subject to this policy. [Legitimate interests.]

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you. We do not use sensitive personal information to infer characteristics about you.

5. How We Disclose Personal Information

We disclose personal information to the following service providers (processors), which process it on our behalf under contract:

• Cloudflare, Inc.: content delivery, DNS, network security, bot protection (Turnstile), tag management and consent management (Zaraz), media storage (R2), and email delivery of form submissions (Email Sending).
• Google LLC: business email and groups (Google Workspace), which receive form submissions, and website analytics (Google Analytics 4).
• Zendesk, Inc.: help desk, where form submissions, emails to sales@shadowrock.io, and privacy requests sent to legal@shadowrock.io become tickets. We have signed Zendesk’s data processing agreement and its CCPA service-provider terms.
• Odoo S.A.: customer relationship management (CRM).
• PostHog, Inc.: website analytics and session recording.

The Site runs on servers we operate in the United States. The Site’s icons, fonts, and images are delivered from our own domains, so loading a page does not send your IP address to a third-party content network other than Cloudflare.

Where the advertising tools in Section 6 run, we also disclose personal information to these advertising partners, which may use it for their own purposes under their own privacy policies. Under some US state laws, these disclosures are a “sale” or “sharing” of personal information:

• Google LLC (Google Ads and Google signals): measuring the performance of our ads and the form submissions that follow them (enhanced conversions), building remarketing audiences of Site visitors, and Customer Match, as described in Section 6.
• Apollo.io: identifying organizations that visit the Site and supporting our business development.

We may also disclose personal information to our professional advisers, to authorities or other parties when the law requires it or to protect rights, safety, and property, to a successor in a business transfer, or with your consent.

6. Cookies and Similar Technologies

We use cookies, local storage, session storage, and similar technologies, which this policy calls “cookies”. Cloudflare Zaraz loads our analytics and advertising tools and runs each one only when its purpose is allowed for your browser. We group the optional tools into three purposes: Analytics, Advertising, and Session recording.

How your choice works depends on where you are

• United States, including California, and every location not listed in the next paragraph: the three purposes are on by default. On your first visit we show a notice at the bottom of the page that describes them and offers Accept all, Decline all, and Manage. The tools start only after the notice has appeared. Without a selection, these default settings apply: if you keep browsing or close the notice, the three purposes stay on. You can decline all, turn off any purpose, or opt out of sale and sharing at any time.
• European Economic Area, United Kingdom, Switzerland, Jersey, Guernsey, the Isle of Man, Gibraltar, Quebec, Canada where we cannot identify the province, and any location we cannot determine: we do not use analytics, advertising, or session-recording tools, and we do not show a cookie banner or ask for consent. The Site uses only strictly necessary cookies. These tools are not loaded at all when you visit from one of these locations, so preferences you set in the same browser elsewhere do not start them. Cookie Preferences shows a short message confirming that tracking is not used.
• Global Privacy Control: if your browser sends an opt-out preference signal such as Global Privacy Control (GPC), you are automatically opted out of the sale and sharing of your personal information and of targeted advertising. We turn the Advertising purpose off for that browser, including any earlier choice to allow it, before those tools can load, and show the message “Opt-out preference signal honored”. GPC does not switch off Analytics or Session recording, which our providers carry out on our behalf as service providers; you can turn those off under Cookie Preferences.

Your Privacy Choices in the Site footer (shown with the California opt-out icon), and Do Not Sell or Share My Personal Information in our cookie notice, turn Advertising off immediately, in one click, and confirm it. Cookie Preferences in the footer lets you turn each purpose on or off. Your choice applies to the browser and device you use. If you clear your cookies, you will need to choose again.

The periods below are the longest each item is kept. Your browser may delete some of them sooner, depending on its settings and tracking protections.

Strictly necessary

These cookies are needed for the Site to work securely and to remember your privacy choices. They are always on.

• sr-consent (Cloudflare Zaraz, 1 year): stores your choices for Analytics, Advertising, and Session recording.
• sr-consent-basis (ShadowRock, 1 year): records whether your settings came from your own choice, from the defaults, or from closing the notice.
• sr-consent-replay (ShadowRock, 1 year): stores your Session recording choice where Zaraz does not.
• sr-consent-model-v2 and sr-gpc-notice-seen (ShadowRock, session storage, deleted when you close the browser): remember which cookie rules apply to your location and whether you have seen the GPC message.
• Google consent state (Cloudflare Zaraz, local storage, until you clear it): passes your Analytics and Advertising choices to Google’s tools as “granted” or “denied”.
• Cloudflare security cookies, such as __cf_bm and cf_clearance, and Cloudflare Turnstile: detect bots and protect our forms.

Analytics

• Google Analytics 4 (Google): runs through Zaraz on Cloudflare’s servers rather than as a Google script in your browser. Zaraz keeps a random client identifier and session data for it in first-party cookies on our domain: cfz_google-analytics_v4 (up to 1 year) and cfzs_google-analytics_v4 (deleted when you close the browser). We have set Zaraz not to pass your IP address or browser user-agent to Google. We do not send your email address or other form contents to Google Analytics. We have turned on Google signals: if you are signed in to a Google account and have allowed ad personalization, Google may associate your activity on the Site with that account to provide cross-device reports and the remarketing audiences described under Advertising. When Advertising is off, we tell Google through its consent mode that advertising storage and ad personalization are denied, so this data is not used for our remarketing.
• PostHog (PostHog): a cookie named ph_<project key>_posthog and local storage, kept for up to 1 year. PostHog runs in your browser and records the pages you view and how you interact with them, such as clicks (autocapture and heatmaps). It receives your IP address with each request. It creates a person profile only for people who identify themselves.

Session recording

When the Session recording purpose is on, PostHog records how you navigate and use the Site, including clicks, scrolls, mouse movement, and the pages you visit, so that we can find and fix problems and improve the user experience. The recording is a reconstruction of the page structure, not a video of your screen. We configure it to protect your information:

• all text on the page and every form input are masked before anything leaves your browser, so recordings do not contain what you read or type;
• pages built around a form, such as our contact and landing pages, are not recorded at all, and forms on other pages are blocked from recordings;
• keystrokes, form contents, and network request contents are not captured, and nothing is captured from your camera or microphone.

Session recording runs only when the Analytics purpose is also on. Recordings are kept for the retention period set in PostHog and then deleted. PostHog processes them as our service provider. You can turn Session recording off under Cookie Preferences at any time.

Advertising

• Google Ads (Google): runs through Zaraz. When you arrive from one of our Google ads, Zaraz stores the ad-click identifier in a first-party cookie, for up to 1 year, so we can measure whether the ad led to an inquiry. We also use the Site’s Google Ads and Google Analytics data, including Google signals, to build remarketing audiences, so that Google may show our ads to people who have visited the Site, on Google services and on other sites and apps. Google may combine this with information it holds about you under its own privacy policy.
• Enhanced conversions (Google Ads): when you submit a form on the Site, we may send Google a hashed (SHA-256) version of your email address with the conversion, so that Google can match it to a Google account and measure whether our ads led to your inquiry. This happens only while Advertising is on, so Your Privacy Choices, Do Not Sell or Share My Personal Information, and Global Privacy Control turn it off. It is separate from Customer Match: we do not use it to build advertising lists.
• Customer Match (Google): we may upload email addresses of people who have contacted us through the Site or who are our clients to Google Ads, to show them our ads or to exclude them from our campaigns. The addresses are hashed (converted into a code) before upload, and Google uses them only to match existing Google accounts. We do not upload purchased or third-party prospect lists. You can ask us to exclude your email address by writing to legal@shadowrock.io.
• Apollo website tracker (Apollo.io): a script that may record the pages you view and uses your IP address to identify the organization you may be visiting from. Apollo may set its own cookies or local storage.

You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, some parts of the Site may not work, and we cannot remember your privacy choices.

Do Not Track

There is no common standard for responding to browser “Do Not Track” signals, so the Site does not respond to them. We do honor Global Privacy Control, as described above.

7. Your Choices

• Cookies, session recording, and advertising: use Your Privacy Choices or Cookie Preferences in the Site footer, or turn on Global Privacy Control in your browser.
• Google advertising: you can manage how Google personalizes ads, and whether your Google account activity is used for ad personalization, at adssettings.google.com.
• Apollo: you can ask Apollo to remove your information from its database through the Apollo Privacy Center.
• Email: every marketing email we send includes an unsubscribe link, and we honor opt-out requests within 10 business days. We may still send messages about an inquiry or engagement you started.

8. How Long We Keep Personal Information

We keep personal information only as long as we need it for the purposes in this policy, then delete or anonymize it. To set retention periods, we consider why we collected the information, whether a business relationship is ongoing, our legal, tax, and accounting obligations, and possible legal claims.

• Inquiries and correspondence: for as long as needed to handle the inquiry and any resulting relationship, and afterwards for as long as legal, tax, or contract requirements or possible claims make it necessary.
• Privacy requests: for as long as needed to respond and to show that we handled the request as the law requires.
• Form submissions on the Site: the Site does not store form submissions in its database. It sends each submission, with the record of your agreement to our Terms of Use, by email to our help desk (Zendesk), where it is kept as an inquiry (above). The Site keeps a record of your IP address in memory for up to 10 minutes to limit repeated submissions, and a random submission identifier for up to 30 minutes to stop duplicates.
• Analytics, session recording, and advertising data: for the retention period set in each tool, after which the provider deletes or aggregates it. Google and Apollo keep the data they receive for advertising under their own policies.
• Server and security logs: our servers do not record visitor IP addresses in their routine logs. Error and diagnostic logs are kept in size-limited files that are overwritten as new entries arrive and deleted when the service is updated. Cloudflare processes request and security logs to deliver and protect the Site and keeps them under its own retention policies.
• Cookies: for the periods shown in Section 6.

9. International Transfers

ShadowRock is based in the United States, and we and most of our service providers process personal information in the United States. If you contact us from outside the United States, your information will be processed in the United States, where data protection laws may differ from those in your country.

When we transfer personal information from the EEA, the UK, or Switzerland to a service provider in another country, we rely on the EU-U.S. Data Privacy Framework, its UK Extension, or the Swiss-U.S. Data Privacy Framework where the recipient is certified. Otherwise we rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum or Swiss amendments where required, or on another lawful transfer mechanism. You can ask us for more information about these safeguards.

10. Security

The Site is served over encrypted connections (TLS). Access to the systems that hold personal information is limited to personnel who need it, administrative access to the Site requires authentication through a separate access-control service, and credentials are kept in managed secret stores rather than in code. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your Privacy Rights

You can contact us about your personal information wherever you live. We will not discriminate against you for exercising your rights.

EEA, United Kingdom, and Switzerland

Under the GDPR, the UK GDPR, or Swiss data protection law, you have the right to:

• access your personal information and receive a copy;
• correct inaccurate information;
• have your information erased;
• restrict how we process it;
• receive the information you gave us in a portable format;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting processing that took place before you withdrew it.

We respond within one month, which may be extended where the law allows. You can also complain to your local data protection authority, for example the authority in the EU member state where you live or work, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner.

United States

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with similar laws may have the right to:

• know what personal information we collect, use, and disclose, and to access a copy of it;
• delete personal information we collected from you;
• correct inaccurate personal information;
• receive personal information in a portable format;
• opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects (we do not carry out such profiling);
• limit the use of sensitive personal information (we do not use sensitive personal information in ways that give rise to this right);
• not be discriminated against for exercising these rights.

We extend these rights to US residents regardless of whether a particular state law applies to us.

How to make a request: email legal@shadowrock.io with the subject “Privacy request”, or write to us at the address in Section 15. Requests sent to legal@shadowrock.io are tracked in our help desk (Zendesk). To opt out of sale, sharing, or targeted advertising, use Your Privacy Choices in the Site footer, or Global Privacy Control. You do not need to verify your identity to opt out.

Verification: for access, deletion, and correction requests, we verify your identity by matching information you give us with the information we hold, such as confirming control of the email address you used with us. We may ask for more information if needed.

Authorized agents: you may use an authorized agent to make a request. We may ask the agent for proof of your signed permission, and ask you to verify your identity directly.

Timing: we respond within 45 days. If we need more time, we will tell you, and we may extend by up to another 45 days where the law allows.

Appeals: if we decline your request, you can appeal by replying to our decision with the subject “Privacy appeal”. We will respond within the time required by your state’s law. If you disagree with the outcome, you can contact your state attorney general.

California

This section is our notice at collection and our notice to California residents. In California, as elsewhere in the United States, the Analytics, Advertising, and Session recording purposes are on by default once our cookie notice has appeared. You can opt out of the sale or sharing of your personal information at any time with Your Privacy Choices in the Site footer or Do Not Sell or Share My Personal Information in our cookie notice, each of which turns Advertising off in one click, or with Global Privacy Control.

We collect the following categories of personal information. The sources, purposes, and recipients are described in Sections 3 to 6, and we keep each category for the periods described in Section 8. We sell or share the categories marked below with the advertising partners named, for cross-context behavioral advertising.

• Identifiers: name, email address, IP address, and online identifiers. Disclosed for business purposes to our service providers. Sold or shared: online identifiers and IP address, to Google (Google Ads and Google signals) and Apollo.io; hashed email addresses, to Google (Customer Match and enhanced conversions).
• Customer records information (Cal. Civ. Code § 1798.80): name, email address, and employer. Disclosed to our service providers. Not sold or shared, except hashed email addresses as described under Identifiers.
• Professional or employment-related information: company and role or title. Disclosed to our service providers. Not sold or shared.
• Internet or other electronic network activity: pages viewed, interactions with the Site, session recordings, referral, and campaign data. Disclosed to our service providers, including PostHog for session recordings. Sold or shared: pages viewed, interactions, referral, and campaign data, to Google (Google Ads and Google signals) and Apollo.io. Session recordings are not sold or shared.
• Approximate location: country or state derived from your IP address. Disclosed to our service providers. Sold or shared: to Google and Apollo.io, as part of the network data above.
• Inferences: the organization associated with your IP address, which Apollo.io may infer. Used for business development. Not otherwise sold or shared.

We have not sold personal information for money. We do not collect sensitive personal information as defined by the CCPA. We do not knowingly sell or share the personal information of consumers under 16.

Nevada

We do not sell personal information for monetary consideration as defined by Nevada law. Nevada residents can still send an opt-out request to legal@shadowrock.io.

12. Children

The Site is meant for business audiences. It is not directed to children, and we do not knowingly collect personal information from children under 16 (or under 13 for the purposes of the US Children’s Online Privacy Protection Act). If you believe a child has given us personal information, contact us and we will delete it.

13. Third-Party Websites

The Site links to websites and platforms run by others, such as partner platforms and social networks. Their privacy practices are their own, and we encourage you to read their policies.

14. Changes to This Policy

We will post any changes on this page and update the date at the top. If we make material changes, we will flag them on the Site, and we will ask for your consent where the law requires it.

15. Contact Us

For privacy questions or requests, email legal@shadowrock.io with the subject “Privacy request”, or write to:

ShadowRock Consulting LLC, Attn: Privacy contact, 3007 Mohican St., El Dorado Hills, CA 95762, United States.

Our Privacy contact, ShadowRock Consulting LLC, is the person in charge of the protection of personal information for the purposes of Quebec’s Act respecting the protection of personal information in the private sector, and can be reached at legal@shadowrock.io.