Privacy policy
What we collect, why we collect it, and what you can ask us to do about it.
IronRoot Risk Consultants LLC ("IronRoot," "we," or "us") provides IT governance, risk, and compliance consulting. This policy explains how we handle information collected through ironrootrisk.com.
We advise clients on protecting data for a living, so we keep our own collection deliberately minimal. We do not sell personal information, we do not run advertising trackers, and our free resources require no email address to download.
Information we collect
Information you give us
When you submit the contact form, we collect the information you enter:
- Name and email address (required)
- Company and phone number (optional)
- The message describing what you are trying to accomplish
We use this solely to respond to your inquiry and, if we begin working together, to communicate about the engagement. We do not add you to a marketing list without your consent, and we do not use this information for automated decision-making or profiling.
Information collected automatically
Analytics. If you accept analytics cookies, we use Google Analytics to understand which pages visitors find useful. IP addresses are anonymized before storage. Analytics do not load at all unless you accept — declining is fully honored, and the site works identically either way.
Server logs. Our host, Vercel, records standard request information including IP address, browser type, and pages requested. These logs support security monitoring and troubleshooting.
Abuse prevention. To stop spam submissions, our contact endpoint counts recent submissions per IP address. This counter is held in temporary server memory, is not written to a database, and clears on its own.
Local storage. Your cookie choice is stored in your own browser under ironroot-cookie-consent so we do not ask again on every visit. It never leaves your device. Clearing your browser data resets it.
What we do not collect
- We do not require an email address to download any resource on our free tools page.
- We do not use advertising networks, retargeting pixels, or social media trackers.
- We do not knowingly collect information from anyone under 16.
Service providers
We share information only with the providers that operate this site. Each processes data on our behalf under its own terms:
| Provider | Purpose | What it receives |
|---|---|---|
| Vercel | Website hosting | Standard request logs |
| Resend | Delivers contact form submissions to our inbox | The contents of your form submission |
| Google Analytics | Aggregate site usage — only with your consent | Anonymized usage data |
| Cloudflare (cdnjs) | Serves a QR code library used only on our digital business card page | Standard request data |
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We may disclose information if required by law or to protect our legal rights.
How long we keep it
- Contact inquiries: retained in our business email for as long as needed to respond and maintain client records. You may ask us to delete yours at any time.
- Analytics: retained according to Google Analytics' configured retention period, in anonymized and aggregated form.
- Server logs: retained by our host on a short rolling basis.
Your rights
Depending on where you live, you may have the right to request access to the personal information we hold about you, correction of anything inaccurate, deletion of your information, a portable copy, or to opt out of sale or targeted advertising — which does not apply here, as we do neither.
Colorado residents. The Colorado Privacy Act grants these rights to Colorado consumers, along with the right to appeal a refused request. If we decline a request, we will explain why and tell you how to appeal.
California residents. The CCPA/CPRA grants comparable rights, including the right not to receive discriminatory treatment for exercising them.
EU/UK residents. Where the GDPR applies, our legal bases are your consent (analytics), legitimate interest (site security and abuse prevention), and taking steps at your request prior to entering a contract (responding to your inquiry).
To exercise any of these, email chris@ironrootrisk.com. We will respond within the timeframe the applicable law requires, and we may need to verify your identity first.
Managing cookies
You can decline analytics cookies using the banner shown on your first visit. To change your mind later, clear your browser's site data for ironrootrisk.com and the banner will reappear. Most browsers also let you block cookies entirely — the site remains fully functional if you do.
Security
The site is served over HTTPS with HSTS, a Content Security Policy, and related protective headers. Form submissions are transmitted over encrypted connections. No method of transmission or storage is completely secure, but we apply the same practical controls we recommend to clients.
Changes to this policy
If we make material changes, we will update the effective date above and, where appropriate, provide additional notice. We encourage you to review this page periodically.
Contact
Questions about this policy or how we handle your information:
IronRoot Risk Consultants LLC
Northern Colorado, United States
chris@ironrootrisk.com