Privacy Policy

1. Who we are

Robles Consulting LLC (“Robles Consulting”, “we”, “us”) is an IT consulting firm registered in Texas, United States, operating this website at roblesconsultingllc.com.

For the purposes of the EU and UK General Data Protection Regulation, we are the data controller for the personal data described in this policy. Our registered contact details are:

Email is the fastest route for anything in this policy, including requests to see or delete what we hold about you.

This policy covers website enquiries, website plan purchases and the personal data we use to administer consulting sessions. When we process data on a client’s behalf under a separate agreement, that agreement also governs how we handle the client’s data.

We also operate haborusagesbekesseg.org, a Hungarian and Russian website for readers of a book. Messages sent through that site are covered by its own privacy notice, not by this policy.

2. What we collect

Information you give us

Our inquiry forms ask for the information needed to reply and assess your request. Where email verification is available, we send a short-lived code to confirm that you control the address; no password is required.

The contact form collects your name, email address, and message, plus your business name and an indicative project budget if you choose to provide them.

Previously submitted site review requests include the address of your current website, your name and your email address, plus your phone number if you choose to give it. If you do, we also record whether you ticked the box agreeing to receive text messages from us about the review; you can withdraw that at any time by replying STOP.

A verified consulting scope request also collects the problem, desired outcome, existing system and development stage, budget range, timing, and your role in the decision. We keep it with your consulting contact and review task. You may choose an existing advisory draft to reuse its saved system context. Verification and submitting a request do not subscribe you to marketing.

The newsletter form in the footer of this site and of rc-frame.work collects your email address, the site and language you signed up on, and when you asked. We email you a link to confirm, and you are only subscribed once you use it. When you confirm, we record when you did and which version of this notice applied.

Every newsletter and other marketing email we send ends with an unsubscribe link, and email apps that support it also show a one-click unsubscribe button. Either one stops our newsletters and other marketing email to that address straight away, and we then keep the address on a do-not-email list so that it stays that way.

If you email us directly, we hold that correspondence for as long as we need it to deal with the matter.

If you buy a website plan, section 3 explains what we collect before, during and after the purchase.

Information collected automatically

When you submit the contact or site review form, we also record:

• Your IP address and browser user-agent string. These are stored alongside your submission and are used to investigate abuse and spam.
• A timestamp of the submission.

For email verification, we retain short-lived challenge and session records, timestamps, and hashed rate-limit identifiers to prevent abuse. The verification service does not store your raw IP address or browser user-agent with the scope request. Codes expire after 10 minutes and verified sessions after 30 minutes; expired verification records are removed by scheduled cleanup. Necessary cookies keep verification tied to your browser. See our Cookie Policy.

Cloudflare, which serves this site, processes request data including IP addresses to deliver pages and to protect against attacks. Cloudflare Turnstile runs on our forms to distinguish humans from bots; it is a privacy-focused alternative to a traditional CAPTCHA and does not profile you across sites.

Analytics

Cloudflare Web Analytics runs on every page, with no cookies. Cloudflare, which hosts this site, adds a small script from static.cloudflareinsights.com. It reports which page you viewed, the site that referred you and how long the page took to load. It sets no cookies, stores nothing in your browser and does not use your IP address or browser details to recognise you. We see only totals, such as views by page, referring site, country, browser and device type. It runs whether or not you accept analytics, and your cookie choice does not turn it off.

PostHog runs only if you accept analytics. Until then, we load no PostHog code and set no analytics cookie. If you accept, PostHog records page categories, selected offers and durations, calls-to-action, and inquiry starts, attempts, failures and successful submissions. For online session purchases, we also record which step is viewed, checkout attempts and failures, clicks to Google scheduling, and acknowledged help requests. These observations do not establish a payment or confirmed appointment. We also record a broad referral-source category, an optional project-budget range and whether company or phone information was provided, not those details themselves. We do not send names, email addresses, phone numbers, message contents, raw URLs, query strings or private links to analytics. Session recording, surveys and automatic text capture are disabled. An inquiry is not a payment or confirmed booking.

Google Analytics sets cookies only if you accept analytics. Before you choose, it loads with its cookies switched off and sends cookieless measurements that Google uses to estimate visits in total. If you accept, it also sets cookies holding a randomly generated identifier. It receives a page view for each page and the same defined events as PostHog. The page address it receives keeps only utm_ campaign tags from the query string, and the referring address is cut down to the referring site. Google receives your IP address and browser details with each request and derives an approximate location from them; Google Analytics 4 does not store IP addresses. Advertising features, Google signals and ad personalisation are off. Rejecting analytics stops Google Analytics completely.

If your browser sends a Global Privacy Control signal, we treat that as a refusal of PostHog and Google Analytics and never ask again unless you opt in yourself. See our Cookie Policy for the full list.

Payments

Website plans and consulting sessions are paid through Stripe. You enter your card or bank details on Stripe’s checkout page, so they go to Stripe, not to us. We never receive your full card number or security code.

For each purchase, we keep the name and email address on the order, what you bought, the amount and any sales tax, the payment status (including any refund or dispute), and Stripe’s reference numbers. Stripe asks for a billing or service address and uses it to calculate any sales tax. We keep only its country, to confirm the service is for the United States.

What we never collect here

We do not ask for special-category data (health, biometrics, political or religious views, and so on), we do not buy personal data from data brokers, and we do not build advertising profiles.

3. Website plan customers

This section covers what we hold when you buy a Managed, Managed+ or Autopilot website plan. We use it to build, host and support your website and to handle your billing.

Before you pay

Before you pay, we save only the plan you picked and a random reference so you can come back to checkout. We do not add you to marketing. Unused selections are deleted after 24 hours. The details:

Starting a website purchase saves a selected plan, catalog version, a permitted page path and a random purchase reference. It does not create a contact or subscribe you to marketing. A random token in your tab lets you recover that selection; the server stores only its hash. Payment and customer-account access require separate verification.

With analytics consent, that purchase context can include a bounded source, medium and campaign category, plus the version and time of your choice. It excludes raw URLs, arbitrary query text, advertising click IDs and email addresses. A referral from a link is captured only with this consent; a code you explicitly enter is processed as your purchase instruction. Recording a code does not promise a discount or commission.

Unused contexts expire after 24 hours and are removed by scheduled cleanup. Optional attribution expires after 30 days or is cleared when you withdraw consent; an explicitly entered referral remains a separate purchase instruction. A context already attached to checkout keeps the minimum recovery references until payment has been reconciled and its durable record saved, or the attempt is confirmed closed. Required payment records follow the retention rules below. We do not erase a potentially paid order merely because its attribution expires.

When you accept the website plan terms, we save the terms version and its content fingerprint, the plan and price you were shown, your consent to monthly renewal and the time you accepted.

When you pay

Stripe takes the payment, as described under Payments above. We then record your order: the name and email address from checkout, the plan, the amount and tax paid, the accepted terms version and Stripe’s references for the subscription and payment. We add you to our customer records with a task for our team to follow up. Buying does not sign you up for marketing.

After you pay

At checkout you fill in a short website brief; we receive it only after your payment is confirmed. It asks whether you are starting fresh, replacing a site or finishing one; your business name; a short description of your business; your current website address; and whether you have a domain.

As we work, we keep the content and media you send, your change requests and approvals, the draft and live addresses of your site, and billing events from Stripe such as renewals, failed payments, plan changes and cancellations. You keep ownership of the content you supply. We use it only to deliver and support your website unless you agree to another use.

Please do not put passwords, card details or recovery codes in the brief, comments or email. We ask for access through invitations or another agreed secure method, and you can remove that access at any time. To manage billing or download your site, you sign in with a one-time code sent to the email address on your order.

Where it is kept

Order records, briefs and requests are stored in our database on Cloudflare, in Robles Consulting’s own account. Card and bank details stay with Stripe. Order and billing emails are sent through Resend. See How long we keep it for what we remove after your plan ends and what we must keep.

4. Why we use it, and our legal basis

Where the GDPR applies, we rely on the following bases. Where it does not, we still limit ourselves to these purposes.

We do not use your data to make automated decisions that have a legal or similarly significant effect on you, and we do not use it to train machine learning models.

We will only send you marketing email if you ask us to. Replying to your enquiry is not marketing.

Our CRM emails currently use neither invisible open-tracking pixels nor click-tracking link rewriting. We record operational delivery, bounce, complaint, unsubscribe, and direct reply events needed to deliver and respond to the communication. We will update this notice before enabling additional email engagement tracking.

5. Who we share it with

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We use a small number of service providers who process data on our instructions, under contract:

Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy.

Fonts on this site are served from our own domain, not from a third party, so loading a page does not tell any font provider that you visited.

On our press page, your browser loads our public Medium article list through rss2json.com, a feed service, and article pages show images hosted by Medium. Your browser contacts those services directly, so they receive your IP address and browser details, as with any web request. We send them nothing else.

Beyond these providers, we disclose personal data only where we are legally required to (for example a valid legal request), where we need to establish or defend a legal claim, or as part of a merger or sale of the business. In which case we will tell you before your data becomes subject to a different policy.

6. International transfers

We are established in the United States, and the providers listed above, including Cloudflare, Stripe and Google, are predominantly US-based. If you are in the European Economic Area, the United Kingdom, or Switzerland, this means your personal data is transferred outside your home jurisdiction when you browse the site, contact us or pay us.

Where such a transfer happens, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) in our agreements with those providers, or on their certification under the EU-US Data Privacy Framework where they hold one. You can ask us for details of the safeguards that apply to a specific provider.

7. How long we keep it

• Nonessential intake and correspondence: we review and remove unnecessary content by 24 months after our last contact with you. We retain specific records longer when needed for an open engagement or a documented hold.
• Consulting working copies and temporary access: we remove our working copies and revoke our temporary access within 30 days after the work is completed or the engagement is closed by agreement, unless a documented legal obligation requires retention. We prefer customer-controlled materials and screen sharing, with no recording by default.
• Purchase and payment evidence: we retain the minimum records of accepted terms, purchases, payments, tax and disputes for seven years after the transaction’s tax year, then review them for disposal. We keep specific records longer where legally required or needed to resolve an outstanding obligation. A retention date does not make a paid consulting session expire.
• Website plan working copies and access: when your plan ends, you have 30 days to download your site. After that window, and after any export you asked for in time is delivered, we review our working copies of your content and our access for removal. Required financial records, documented legal holds and backups can remain.
• IP addresses and user-agent strings held for security: 12 months from the submission.
• PostHog analytics data: 12 months, if you consented to it.
• Google Analytics data: up to 14 months, after which Google keeps only aggregated reports.
• Newsletter: a signup nobody confirms is deleted when its link expires, 72 hours after the request. Once you confirm, we keep your address and the record of your consent until you unsubscribe, and after that only what we need to make sure we do not email you again.
• Your cookie choice: stored in your own browser and never sent to us. We ask again after twelve months.

Restricted recovery copies may retain removed data until their recovery window ends. If we restore a backup, we reconcile recorded removals before returning the data to normal use. Providers may retain records under their own legal obligations; we explain any applicable limits when handling a deletion request.

You can ask us to delete your data sooner; see below. We will do so unless we are required to keep it.

8. Your rights

If the EU or UK GDPR applies to you, you have the right to: be told what we hold about you and get a copy of it; have inaccurate data corrected; have your data deleted; restrict how we use it; object to processing we base on legitimate interests; receive your data in a portable format; and withdraw consent at any time, which is as easy to do as it was to give. Use the Cookie settings link in the footer of any page.

To exercise any of these, email privacy@roblesconsultingllc.com. We will respond within one month. We may ask you to confirm your identity before we act, and we will not charge you for a reasonable request.

If you are unhappy with how we have handled your data, you can complain to your national data protection authority. In the EU, the supervisory authority where you live or work; in the UK, the Information Commissioner’s Office. We would appreciate the chance to put it right first.

9. US state privacy rights

If you are a resident of California, Colorado, Connecticut, Texas, Virginia, or another state with a comprehensive privacy law, you may have the right to know what personal information we have collected about you, to have it corrected or deleted, to receive a copy of it, and not to be discriminated against for exercising those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising or targeted advertising. There is therefore nothing to opt out of on that front, though we honour Global Privacy Control signals regardless.

To make a request, email privacy@roblesconsultingllc.com. You may use an authorised agent; we will ask for proof of their authority.

10. Cookies and analytics

The strictly necessary items, Cloudflare’s security check and the record of your cookie choice, are always active because the site cannot work properly or respect your preference without them. Cloudflare Web Analytics also runs on every page, but it sets no cookies and stores nothing in your browser. Google Analytics runs without cookies until you choose and stops if you reject it. PostHog and the Google Analytics cookies wait for your consent.

Our Cookie Policy lists each cookie and storage entry, what it is for, and how long it lasts, and lets you change your choice.

11. Security

The site is served over HTTPS. Form submissions are validated and bot-checked before they are accepted, and stored in an access-controlled database. Access to enquiry and order data is limited to the people at Robles Consulting who need it to respond to you or deliver what you bought. Card details never reach our systems; Stripe handles them.

No system is perfect. If you believe you have found a security issue with this site, please email privacy@roblesconsultingllc.com and we will look at it promptly. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant regulator as the law requires.

12. Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.

13. Changes to this policy

If we change how we handle personal data, we will update this page and the “last updated” date above. Where a change materially affects you, we will do more than that. For a change that requires consent, we will ask again rather than assume.