Information we collect
We collect information you provide directly and information collected automatically. Directly provided data includes contact details you submit when requesting a call or proposal, such as your full name, business email, phone number, company name, and any descriptive message. For client engagements we may receive additional data needed to perform services, including business metrics, product telemetry, and aggregated customer signals when authorized by the client. Automatically collected data includes technical and usage information when you access our site, such as IP address, browser type, operating system, referring URLs, pages visited, and interaction events. We also collect anonymized analytics and performance metrics to improve site function and measure interest. Where we combine client-provided business data with our operational data, we follow contractual terms and only process that data according to the agreement in place. We do not knowingly collect children's personal information and our services are intended for businesses and professionals.
How we use information
We use collected information to provide, maintain, and improve our services. Contact details are used to respond to inquiries, schedule calls, send proposals, and communicate about engagements. Usage and technical data help us maintain website performance, troubleshoot issues, and strengthen security. Where you are a client, we use business data to perform the services described in the contract, to build dashboards, run experiments, and produce recommendations that improve long-term business outcomes. We also use aggregated and de-identified information for research, service improvement, and informing product development. Marketing communications are sent only with consent or under permissible legitimate interest; you can opt out of marketing at any time. We do not sell personal information for money. When processing is based on legitimate interest, we balance our business needs with your privacy rights and implement safeguards to minimize impact. We may also use data to comply with legal obligations and protect the rights, property, or safety of Calmstonepath, our clients, and others.
Cookies and similar technologies
Our website uses cookies and similar technologies to enable core functionality, remember preferences, and collect analytics. Cookies fall into categories: strictly necessary cookies that allow the site to function; performance and analytics cookies that help us understand usage patterns; and optional cookies used for measuring interest and improving experience. When you first visit the site we display a non-intrusive cookie banner (bottom-right) that explains choices and allows you to accept or reject analytics cookies. You may change your preferences at any time by clearing browser cookies or by contacting us. Third-party services we use for analytics and hosting may also place cookies. We carefully select partners that follow privacy best practices and use data only to provide their services. If you reject analytics cookies, we will not collect behavioral analytics tied to your device, but essential site functionality will continue to work. For more detail on specific cookies and durations, contact [email protected].
Data retention and security
We retain personal information only for as long as necessary to fulfill the purposes described in this policy, to comply with legal obligations, and to resolve disputes. For general inquiries and marketing contacts, we typically retain contact records for up to three years unless you request deletion sooner. For client engagements, retention periods are governed by contractual terms and any applicable laws; we generally retain project records for the duration of the engagement plus a reasonable archival period to meet operational and legal requirements. We implement reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including secure access controls, encryption in transit, network protections, and incident response processes. While we strive to protect data, no method of transmission or storage is completely secure. In the unlikely event of a data breach affecting personal data, we will follow applicable notification laws and take steps to remediate and notify impacted parties where required.
Third-party services and transfers
We use trusted third-party service providers to operate our site and deliver services, including cloud hosting, analytics, email delivery, and professional tools used during engagements. These providers process data on our behalf and are contractually bound to protect that data and to use it only for the purposes we specify. In some cases, data may be transferred to jurisdictions outside your country of residence; when that occurs we rely on legal mechanisms such as standard contractual clauses, adequacy findings, or client consents to ensure appropriate protections are in place. We do not authorize third parties to use personal information we share with them for their independent marketing purposes unless we have disclosed that use and received consent where required. For a current list of major processors and transfer mechanisms, contact [email protected].
Your rights and choices
Depending on your jurisdiction, you may have rights regarding your personal data, such as the right to access, correct, delete, restrict, or obtain a copy of your information in a portable format. You may also have the right to object to certain processing activities and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us at [email protected] or use the mailing address below. We will verify your identity before responding to requests and will respond within applicable legal timeframes. If you have an unresolved privacy concern, you may also have the right to lodge a complaint with your local data protection authority. For marketing communications, you can opt out using the unsubscribe link included in those emails, by replying with an unsubscribe request, or by contacting [email protected].
Children and minors
Our services and website are directed to businesses and professionals. We do not knowingly collect personal information from children under 16. If we become aware that a child under the applicable minimum age has provided us with personal information, we will take steps to delete such information as soon as possible. If you believe we may have collected information from a child, please contact [email protected] so we can investigate and take appropriate action.
Changes to this policy
We review our privacy practices regularly and may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes we will post the updated policy on this page with a revised effective date. Non-material clarifications or minor updates may be made without prior notice. You are encouraged to review this page periodically to stay informed about our privacy practices. The effective date for the current policy is provided below.
Contact information & effective date
If you have questions about this Privacy Policy or wish to exercise your rights, contact our privacy team at [email protected] or by mail at the address below. You may also call our main office during business hours for general inquiries. Calmstonepath LLC 1255 Market St, Suite 900 San Francisco, CA 94103 United States Phone: +1 (415) 650-1234 Email: [email protected]
Effective date: January 1, 2026