Privacy Policy

# Scope

This policy applies to brackeneast.com and messages you send to Bracken East about the website or prospective services. It does not govern personal data processed for a client engagement. A signed services agreement, statement of work, and any applicable data-processing terms govern that work.

# Information We Process

# Information You Choose to Send

The contact page asks for your name, email address, optional company name, and message. When you submit the form, your browser sends those fields and a Turnstile response to a Cloudflare Worker. The Worker validates the request and sends the message through Cloudflare Email Service to Bracken East's mailbox. The website does not write contact-form submissions to a database.

# Free Tools

Our free tools, such as the site survey and the domain trust checker, ask for your email address and, depending on the tool, a web address or domain and answers about your business and its systems. A Cloudflare Worker stores what you enter, the tool's results and report, timestamps, the tool's progress status, and a random, unguessable report link in a Cloudflare D1 database. The site survey also stores the page that referred you and any campaign tags in the link you followed.

Some tools save as you go. The site survey and the domain trust checker save your entries while you fill them in, before you submit, so you don't lose progress. We record whether you finished or left partway through, and we may email you about the tool even if you didn't finish. Your browser also keeps your progress in local storage on your device so you can pick up where you left off.

If you give us a web address or domain, the Worker makes a few ordinary, read-only requests to its public pages, as any visitor would, and looks up its public DNS records and certificate transparency logs. It never logs in, tests for weaknesses, or changes anything.

To write report summaries, we send the relevant answers and results, but not your email address, to Cloudflare Workers AI through Cloudflare AI Gateway. The summaries are checked against the underlying results before they are shown. To limit abuse, the Worker stores a one-way hash of your IP address rather than the address itself and uses it to rate limit submissions.

# Website Request and Security Data

Cloudflare hosts and protects the site. When your device requests a page or submits the form, Cloudflare may process your IP address, requested URL, date and time, browser or device information, referring page, routing data, Turnstile interaction signals, and security events. Bracken East may access limited logs or aggregate operational data when needed to deliver, protect, or troubleshoot the site. Cloudflare describes this processing in its Turnstile Privacy Addendum.

# Aggregate Traffic Metrics

Cloudflare provides Bracken East with aggregate zone and Worker metrics derived from normal requests at its network edge, such as request volume, response status, bandwidth, and broad traffic trends. These metrics are used only to understand site use, reliability, and performance, not for advertising, profiling, or tracking people across sites.

Cloudflare also provides Web Analytics for the public site. The site loads Cloudflare's script, which sends the page address, the referring page, and how quickly the page loads to Cloudflare. Cloudflare derives your country, browser, and device type from the request. The script sets no cookies and stores nothing in your browser. It never runs on report and result pages, whose addresses contain private codes.

The public site also loads Umami, an open-source analytics script, from a server that Bracken East controls. It records page views and how the site is used: clicks on links and buttons, opening menus and report sections, how far you scroll, and the steps you reach in the contact form and free tools, including whether each step succeeded or why it did not. For each, the script sends the page address without its query string or fragment and with private report codes removed, the page title, the referring page, the name of the action, your screen size, and your browser language. It also measures how quickly each page loads and responds.

An action may carry a short label that the site defines, such as which button was used, which survey question you reached, or which form fields need attention. These labels never include what you type into a form or your survey answers.

The analytics server derives approximate location (country, region, and city), browser, operating system, and device type from each request. It groups requests into visits with a one-way hash of your IP address and browser details, salted with a value that changes each month, and does not store your IP address. The script sets no cookies, stores nothing in your browser, and sends nothing when your browser sends a Do Not Track signal. Bracken East reviews these measurements as aggregate reports and does not use them to identify visitors.

# Protected Previews

Pre-release environments may use Cloudflare Access. For authorized preview users, Cloudflare may process login identifiers plus authentication and request logs to enforce access controls and investigate suspicious activity.

# Information the Public Site Does Not Collect

The public site has no user accounts, checkout, advertising pixels, session replay, or social-media SDKs. Bracken East does not set cookies or store data in your browser for advertising, profiling, or analytics; the free tools use local storage only to keep your progress on your device. Cloudflare may use strictly necessary cookies or browser storage for Turnstile, Access, or other security controls.

# Why We Use Information

• Deliver, secure, maintain, and troubleshoot the website.
• Measure aggregate page views, referrals, and site performance.
• Respond to inquiries, arrange calls, evaluate fit, and prepare proposals.
• Provide free tool results and report links, and follow up about them by email, including when a tool was left unfinished.
• Maintain appropriate business records, prevent abuse, enforce these website terms, and comply with law.

Bracken East does not use website visitor information to make solely automated decisions that produce legal or similarly significant effects.

# When Information Is Disclosed

Bracken East discloses information only as reasonably necessary:

• To Cloudflare for website delivery and security, aggregate traffic metrics, Turnstile validation, sending contact messages, storing free tool submissions in D1, and writing report summaries with Workers AI.
• To Proton for delivery and storage in Bracken East's mailbox.
• To professional advisers, insurers, or public authorities when needed to comply with law, protect legal rights, investigate misuse, or address a security incident.
• To a buyer or successor as part of a merger, reorganization, or sale of the business, subject to applicable law and the commitments in this policy.

Bracken East does not sell or rent personal data, disclose it for cross-context behavioral advertising, or process it for targeted advertising. There is no payment or other benefit exchanged for website visitor data.

# Retention

The contact endpoint does not intentionally store form submissions in a website database. Free tool submissions and reports are kept in D1 so your report link keeps working, until you ask us to delete them or they are no longer needed to follow up. Delivered messages and related business records are kept only while needed to respond, evaluate or manage a business relationship, document decisions, resolve disputes, protect the service, or meet legal obligations. Cloudflare may retain security, Turnstile, request, and email-delivery data under its settings and policies. Cloudflare retains aggregate zone and Worker measurements under the retention period applicable to the service. Umami analytics records stay on the analytics server and are deleted once they are no longer useful for comparing traffic over time. When information is no longer needed, Bracken East deletes it, de-identifies it, or allows it to expire from systems and backups under normal retention cycles.

# Security

Bracken East uses administrative and technical safeguards appropriate to the information and the size of the service, including HTTPS, restricted administrative access, account security controls, and data minimization. No transmission or storage system is completely secure. Do not send passwords, authentication secrets, payment-card data, government identifiers, health information, or sensitive client exports through ordinary website email.

# Your Privacy Choices and Rights

Depending on where you live and which law applies, you may ask Bracken East to confirm whether it processes your personal data and to access, correct, delete, or obtain a portable copy of that data. You may also use an authorized agent where permitted by law.

Send requests to privacy@brackeneast.com with enough information to identify the relevant interaction. Bracken East may verify your identity and authority before acting. If a request is denied, reply with the subject "Privacy Appeal" and explain why you believe the decision should be reconsidered. Requests and appeals will be handled within the time required by applicable law. Connecticut requests covered by the Connecticut Data Privacy Act are generally answered within 45 days, subject to a permitted extension; covered appeals are answered within 60 days.

Because Bracken East does not sell personal data or use it for targeted advertising, there is currently nothing to opt out of through a browser preference signal. If those practices change, Bracken East will update this policy and provide the controls required by law.

# Children

This business-to-business website is not directed to children or designed for use by anyone under 18. Bracken East does not knowingly collect personal information online from a child under 13. If you believe a child sent personal information, contact privacy@brackeneast.com so it can be reviewed and deleted as appropriate.

# Changes to This Policy

Bracken East may update this policy as the website, providers, or legal requirements change. The effective date at the top will be revised when an update is posted. Material changes will be presented prominently on the site when appropriate.