What this site processes, and why.

Information you choose to send

The contact form asks for your name, email address, and message, with optional company and current-website fields. It also records your selected service, coarse entry attribution, and a random submission reference retained across retries to help identify duplicate requests. The reference and website field are not sent to our analytics event helpers. Netlify Forms processes the submission so Jeremy Cleland can read and answer it. Netlify also records the submitting IP address and time. Form posts are rate-limited at the edge. Do not send passwords, health records, government identifiers, payment-card data, or other information that is unnecessary for a first conversation.

Scheduling, LinkedIn, GitHub, and other external links take you to a separate provider. Their notices and account settings govern what happens there.

The visibility scanner

When you submit a URL, Cleland & Co. servers resolve the host and fetch that public page plus robots.txt, llms.txt, and sitemap.xml at the site root. Requests identify as ClelandCoScanner. When the optional speed-data check is turned on, the site origin (scheme and host, not the full path) is sent to Google's Chrome UX Report so the result can show origin-level field Core Web Vitals. That is not a Lighthouse or PageSpeed Insights lab test. The submitted URL is not sent to PageSpeed Insights, a listing API, a crawl index, or an answer-engine API. The scan returns a result for this visit; Cleland & Co. does not keep a scan-results database. The scanned site, its DNS, and its hosting still see the request, and their logs may retain ordinary request metadata.

Repeated scans are rate-limited. The application limit stores a hashed key and recent timestamps in Netlify Blobs. The edge also limits requests by IP. Hosting, Blob, and network logs can retain request metadata longer than the active limit window.

Analytics, error reporting, and browser storage

This site loads Google Analytics 4. It sends page path, page location, page title, and events such as scan started, completed, or failed; score band, score, and elapsed time; CTA selection; contact-form start, accepted submission, and submission error; service interest; and coarse entry attribution. Query strings and fragments are omitted from our page-view events. Visiting this privacy notice is measured the same way as any other page. The event helpers do not intentionally send the scanned URL, contact-form text, name, email, or company. Google may receive standard device, network, cookie, and identifier information under its own policies. Google Analytics sets first-party cookies. This site does not currently expose its own analytics-consent control.

The site sends error reports and a sample of performance traces to Sentry. Reports can include the page URL, browser or runtime details, and a stack trace. Form bodies and scan URLs are not attached as dedicated fields; error text can still contain a URL. Sentry processes that telemetry under its own policy and retention settings.

The site stores a coarse entry page and recognized campaign/source labels in sessionStorage for the current tab, so an inquiry can retain its entry context. Article entries are grouped as Writing. These fields contain no contact details and are separate from Google Analytics sessions. If storage is unavailable, the form still works. The site also stores a light or dark theme choice in localStorage. If no choice is stored, the site follows the browser color-scheme preference. Browser privacy settings or blockers can restrict Google or Sentry requests, cookies, and local storage; clearing local storage may reset the theme. A direct email does not require site analytics.

Purposes and service providers

Data is used to deliver the page or scan you requested, limit abuse, respond to messages, understand aggregate site use, maintain security, diagnose failures, and keep necessary business records. Current service paths include Netlify for hosting, functions, forms, Blobs, and edge rate limiting; Google Analytics 4; Google Chrome UX Report when a scan key is configured; Sentry; Cal.com when you choose the scheduling link; the public site you ask the scanner to fetch; and ordinary email providers when a conversation continues. Those providers may process data in the United States.

Cleland Client Reporting and Google account data

Cleland Client Reporting uses Google authorization to retrieve read-only Google Analytics and Search Console data for website reports. This can include property identifiers, traffic and engagement totals, events and key events, page paths, traffic sources, device categories, search queries, clicks, impressions, click-through rates, and average search position. Google permissions can cover multiple properties accessible to the connected account; reporting is limited to the properties agreed for the engagement. The connection does not request permission to edit Google settings, manage advertising, read Gmail, or access Google Drive files.

The data is used to prepare, check, and compare website performance reports and make recommendations for the authorized website. Jeremy Cleland reviews this data as part of the requested reporting service. Reporting may use software assistants, including OpenAI Codex, to analyze retrieved metrics and prepare the report. Reports are shared with the requesting client or recipients the client authorizes. Google data is not sold or used for advertising targeting. Use and transfer of information received from Google APIs follow the Google API Services User Data Policy, including its Limited Use requirements where applicable.

The current reporting connection stores authorization credentials and refresh tokens on the operator’s computer with access restricted to the operator’s user account. Tokens allow scheduled retrieval without asking you to sign in for every report; they are not included in reports or website code. Retrieved metrics, supporting evidence, and generated reports are retained for the reporting engagement, comparisons, and necessary business records. Report content processed through software assistants is also subject to the configured provider’s retention settings.

You can revoke access at any time through Google Account connections. Revocation stops future retrieval but does not automatically delete previously retrieved metrics or reports. Email jeremy@clelandco.com to disconnect reporting, request deletion of stored tokens, or request deletion of retained reporting data. Copies already delivered to you remain under your control. Necessary legal, accounting, security, or dispute records may need to be retained; we will explain any applicable limitation when responding to your request.

Retention and requests

Contact messages and correspondence are retained according to the conversation and ordinary business-record and legal needs, under the configured Netlify and email systems. Analytics retention follows the configured Google property and Google's policy. Hosting, form, function, Blob, and network logs follow provider configuration and policy. Error-report retention follows the configured Sentry project.

To ask what Cleland & Co. holds about you, request correction or deletion, or raise a privacy question, email jeremy@clelandco.com. A request may be limited where retention is required for security, contracts, accounting, disputes, or applicable law. Identity may need to be verified before a record is disclosed or changed.

Security, scope, and changes

Reasonable technical controls reduce risk but do not make internet transmission or third-party processing risk-free. This notice covers the public Cleland & Co. site and Cleland Client Reporting; a consulting engagement may require a separate agreement, security schedule, or data-processing terms before client data is handled.

Material changes will update the effective date above. This notice describes how the site works today and is not legal advice.