Privacy Policy

1. Who We Are

Cartographer Consulting LLC ("Cartographer," "we," "us," or "our") is a professional services firm providing strategic technology and operations consulting, including HubSpot implementation and revenue operations advisory. We are a California limited liability company with foreign registration in Massachusetts, located at 11120 East Ocean Air Drive, Suite 101-35, San Diego, CA 92130.

This Privacy Policy explains what information we collect through www.cartographerconsulting.com (the "Site"), how we use it, who we share it with, and what choices you have.

2. Scope of This Policy

This Policy applies to information we collect through the Site and through directly related channels — our web forms, our marketing emails, and the initial business conversations that follow from them.

This Policy does not apply to:

• Information you provide to us offline or through channels unrelated to the Site.
• Client data we process on behalf of a client under an executed Master Services Agreement (MSA) and Statement of Work (SOW). That data is governed by the MSA, the applicable SOW, the executed Non-Disclosure Agreement, and any data processing agreement the parties sign — not by this Policy. In that context we act on our client's instructions rather than determining how the data is used. Clients who need a data processing agreement with CCPA service-provider terms, GDPR Article 28 processor terms, or a subprocessor list should ask us; we will provide one.
• Third-party websites, platforms, or tools we link to. Their own privacy policies govern.

3. How to Read This Policy

This Policy is a notice describing what we do with personal information — it is not a contract, and it does not ask you to give up any right. Where we rely on your consent for a specific activity, such as non-essential cookies or marketing email, we ask for that consent separately at the point of collection, and you may withdraw it at any time without affecting anything that happened before.

Terms governing use of the website itself are in our Terms & Conditions.

4. Information We Collect

4.1 Information You Provide Directly

• Contact and business details — name, business email address, phone number, company name, job title, and mailing address.
• Message content — the contents of any form submission, email, or attachment you send us, including the description of your business problem, systems, or objectives.
• Engagement scoping information — details about your technology stack, team structure, processes, or operations that you share while we evaluate a potential engagement.
• Scheduling information — the details you supply when booking a call, including your availability and any pre-call questionnaire answers.

We tell you what information is required at the point we ask for it. We do not require you to provide sensitive personal information to use the Site, and we ask that you not submit it.

4.2 Information Collected Automatically

When you visit the Site, we and our analytics providers automatically collect:

• IP address and approximate location derived from it (typically city or region level)
• Browser type and version, operating system, and device type
• Referring and exit pages, and the pages you view on the Site
• Date and time stamps, session duration, and interaction events such as clicks and form submissions
• Internet service provider

This information is collected through server log files and through cookies and similar technologies (see Section 6). We use it to understand how the Site performs, to diagnose problems, and to improve content — not to identify you personally, except where it is associated with a form submission you have chosen to make.

4.3 Information From Third Parties

We may receive information about you from:

• Publicly available business sources — your company website, LinkedIn, or public filings, used to understand a prospective client's business before a call.
• Referrals — a mutual contact who introduces us, and who shares your name and business contact details.
• Our platform providers — for example, HubSpot may associate your form submission with prior page views from the same browser.

5. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and provide the information you request
• Evaluate, scope, and price a potential engagement
• Operate, maintain, secure, and improve the Site
• Understand how visitors use the Site and which content is useful
• Send you emails you have asked for, including proposals, scheduling confirmations, and engagement communications
• Send marketing and educational communications where you have opted in or where permitted by law, subject to your right to unsubscribe at any time
• Develop and improve our service offerings
• Maintain business, accounting, and tax records
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our agreements

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. Cookies and Similar Technologies

The Site uses cookies, pixels, and similar technologies to function and to measure performance. Broadly, they fall into three categories:

The cookies currently set on the Site are primarily those of HubSpot (our CRM and marketing platform) and Google Analytics. HubSpot cookies typically include hubspotutk, __hstc, __hssc, and __hssrc. Google Analytics cookies typically include _ga and a property-specific _ga_* cookie.

Your choices. You can refuse or delete cookies through your browser settings; every major browser publishes instructions for doing so. Blocking analytics and functional cookies will not prevent you from using the Site. You can also opt out of Google Analytics across all sites using Google's browser add-on at tools.google.com/dlpage/gaoptout.

Global Privacy Control and Do Not Track. Browsers and extensions differ in how they signal privacy preferences. We honor the Global Privacy Control (GPC) signal where our platforms support it. Because there is still no uniform industry standard for "Do Not Track" browser headers, we do not currently respond to them separately.

7. Analytics and Marketing Platforms

• HubSpot — our customer relationship management and marketing platform. HubSpot hosts our forms, stores contact records, tracks Site activity associated with a known contact, and sends our email. HubSpot processes this information as our service provider under its own agreement with us.
• Google Analytics — measures Site traffic and usage patterns. We use it for traffic and content reporting only. We do not enable Google's advertising-audience or ad-personalization features on our property, and we do not use analytics data to build or share advertising audiences.

We do not currently run third-party advertising networks, ad-retargeting pixels, or identity-resolution services on the Site. If that changes, we will update this Policy and, where required, obtain your consent before the change takes effect.

8. Artificial Intelligence and Automated Tools

We use artificial intelligence tools, including large language models, in our internal operations and in delivering consulting services — for example, to summarize meeting notes, draft documentation, analyze system configurations, and prepare deliverables.

We want to be specific about what this means for your information:

• We do not use personal data to train large language models. We do not train, fine-tune, or otherwise develop AI models using personal information collected through the Site or received from clients, and we do not sell or otherwise make personal information available to third parties for that purpose.
• We select tiers that restrict provider training. Our policy is to use enterprise or business-tier AI services and, where the provider offers the setting, to configure them so that the provider does not use our content to train its models. We maintain an internal list of approved AI tools, and our policy prohibits entering client or prospect information into consumer-grade or free-tier tools. Provider terms are set by the providers and can change; where a provider's terms no longer meet this standard, our practice is to change tools or change tiers.
• Our process requires human review. AI-assisted output is reviewed by a person before it is relied upon or delivered. We do not use automated processing to make decisions about you that produce legal effects or similarly significant effects.
• We limit what goes in. We minimize the personal information included in AI-assisted workflows and apply the same confidentiality obligations to AI-assisted work as to all other work. Some client engagements restrict or prohibit AI use entirely; where a client restriction applies, it governs.
• Profiling. We use our CRM to organize and prioritize business inquiries, which may include lead scoring and drawing inferences about what a prospective client needs. This informs who we follow up with and what we say. It does not produce any automated decision with a legal or similarly significant effect on you, and you may object to it using the contact details in Section 17.

If you have questions about how AI tools are used in a specific engagement, ask us — we will explain the tools involved and the safeguards applied.

9. How We Share Information

We share personal information only as follows.

Service providers and contractors. These act on our behalf and are bound by contract to use the information only to provide services to us:

• CRM and marketing automation
• Website hosting and content delivery
• Analytics
• Email delivery
• Cloud file storage and document collaboration
• Calendar and scheduling
• Project management
• Accounting and invoicing
• AI-assisted productivity tools
• Independent contractors and subcontractors who assist in delivering services, each bound by confidentiality obligations no less restrictive than those we owe our clients, and by our Vendor Policy

Third parties. These are not service providers, and disclosure to them is not for a commercial business purpose of theirs:

• Professional advisors — our attorneys, accountants, and insurers, where reasonably necessary
• Parties to a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy continuing to govern the information transferred
• Government and legal recipients — where we are required by law, subpoena, or court order, or where disclosure is necessary to protect our rights, the safety of any person, or to investigate fraud or a security incident

What we don't do. We do not disclose personal information to third parties in exchange for money. We do not share personal information for cross-context behavioral advertising, and we do not run advertising pixels or identity-resolution services on the Site. We contract with our analytics and CRM providers on terms restricting them to processing our data on our behalf. See Section 13.2 for what this means under California law.

10. Data Retention

We keep personal information only as long as we need it for the purpose we collected it, and then delete or anonymize it. Retention by category of personal information:

We do not collect sensitive personal information through the Site.

Where you ask us to delete your information, we will do so unless we are required or permitted by law to retain it, in which case we will tell you which exception applies.

11. Security

We maintain a written information security program with administrative, technical, and physical safeguards designed to protect personal information. Its main elements are:

• Encryption of data in transit and at rest, where supported by the systems in use
• Multi-factor authentication on business systems that support it
• Role-based, need-to-know access controls
• Individually named accounts as the default, with shared credentials prohibited except for a named, MFA-protected white-label account provisioned by a client in that client's own tenant and granted without administrative rights where the platform allows
• Current software versions and managed devices
• Contractual security obligations on our subcontractors and vendors, set out in our Vendor Policy
• Documented incident reporting, investigation, and remediation procedures

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any applicable regulator without undue delay and as required by applicable law, including California Civil Code § 1798.82 and Massachusetts General Laws chapter 93H. Where a client agreement sets a specific notification timeframe, that timeframe governs our obligations to that client.

12. International Data Transfers

We are based in the United States, we serve clients in the United States, and our service providers are primarily located in the United States. We do not target or market our services to individuals in the European Economic Area, the United Kingdom, or Switzerland.

If you access the Site or contact us from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where we do transfer personal information from the EEA, the UK, or Switzerland to the United States in the course of a business relationship, we put appropriate safeguards in place, which for our current providers means the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum incorporated into those providers' terms.

13. Your Privacy Rights

13.1 Rights We Extend to Everyone

Regardless of where you live, you may ask us to:

• Access — tell you what personal information we hold about you and confirm how we use it
• Correct — fix information that is inaccurate or incomplete
• Delete — erase your personal information, subject to legal retention requirements
• Port — provide your information in a portable format, or transfer it to another organization where technically feasible
• Opt out of marketing — stop sending you marketing email, which you can also do using the unsubscribe link in any message
• Withdraw consent — withdraw a consent you previously gave, without affecting processing that already took place

We will not discriminate against you, deny you services, or charge you different prices for exercising any of these rights.

How to make a request. Contact us using the details in Section 17. We will ask for information reasonably necessary to verify your identity before acting, and we will not use that verification information for any other purpose. You may use an authorized agent, provided the agent supplies proof of your written authorization.

Our response time. We acknowledge requests within ten (10) business days and respond substantively within forty-five (45) calendar days. If we need more time, we will tell you within that period and may extend by up to an additional forty-five (45) days. A request to opt out of the sale or sharing of personal information, or to limit the use of sensitive personal information, is actioned within fifteen (15) business days and is not subject to extension. For requests made under the GDPR or UK GDPR, we respond within one (1) month, extendable by up to two (2) further months for complex requests, with notice to you.

13.2 California Residents

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), California residents have the right to:

• Know the categories and specific pieces of personal information we have collected, the categories of sources, the business purposes for collecting it, and the categories of third parties to whom we disclose it
• Delete personal information we have collected, subject to statutory exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information. We do not disclose personal information to third parties in exchange for money, and we do not share personal information for cross-context behavioral advertising. Our analytics and CRM providers are engaged under terms restricting them to processing personal information on our behalf and for our business purposes. If you would nonetheless like us to treat your information as opted out of any sale or sharing, tell us using the contact details in Section 17 and we will do so.
• Limit the use and disclosure of sensitive personal information. We do not collect sensitive personal information through the Site.
• Non-discrimination for exercising any of these rights

Categories of personal information we collect (as defined by the CCPA): identifiers (name, email, phone, IP address, unique online identifiers); commercial information (services inquired about or purchased); internet and network activity (browsing and interaction data on the Site); professional or employment-related information (employer, job title); geolocation data (approximate, derived from IP); and inferences drawn from the above to characterize a prospective client's needs.

We disclose these categories to the service providers and contractors listed in Section 9 for the business purposes described in Section 5, and to the third parties listed in Section 9 for the limited purposes stated there. Retention periods for each category are in Section 10.

Children's information is addressed in Section 14.

13.3 Residents of Other U.S. States

Around twenty U.S. states now have comprehensive privacy laws granting rights to access, correct, delete, and port personal information, to opt out of targeted advertising, the sale of personal data, and certain profiling, and to appeal a denied request. Most of these laws apply only to organizations above a stated size threshold, and as a small professional services firm we are below the threshold for most or all of them.

We nonetheless honor requests of the kinds described in Section 13.1 from any U.S. resident who asks, as a matter of practice, and will handle your request consistent with applicable law and within the timeframes in Section 13.1.

If we deny your request, you may appeal by replying to our decision. We will respond to an appeal within forty-five (45) days, and will tell you within that period if we need a further extension permitted by your state's law. If we deny the appeal, we will tell you how to contact your state attorney general.

13.4 European Economic Area, United Kingdom, and Switzerland

As stated in Section 12, we do not target our services to individuals in the EEA, the UK, or Switzerland, and we have not appointed an Article 27 representative. If you are located in one of those jurisdictions and we hold your personal information — for example, because you contacted us — we will honor the rights to access, rectification, erasure, restriction of processing, objection to processing, and data portability, and you retain the right to lodge a complaint with your local supervisory authority.

Our legal bases for processing are:

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You may object to that processing at any time.

14. Children's Privacy

The Site is directed to businesses and business professionals. We do not knowingly collect personal information from children under thirteen (13) years of age, and we do not knowingly collect or process personal information from anyone under sixteen (16) for purposes requiring opt-in consent under applicable law.

If you believe a child has provided us with personal information, contact us immediately and we will delete it promptly. We encourage parents and guardians to participate in and monitor their children's online activity.

15. Third-Party Links

The Site may link to third-party websites, tools, or resources. We do not control those sites and this Policy does not apply to them. Review the privacy policy of any third-party site before providing information to it.

16. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page, post the updated Policy here, and keep a dated copy of the superseded version, available on request. If we make a material change to how we use personal information we have already collected, we will provide additional notice — by email where we have your address, or by a prominent notice on the Site — and, where required by law, obtain your consent before the change applies to that information.

We encourage you to review this page periodically.

17. Contact Us

Questions, requests, or complaints about this Policy or your personal information can reach us by any of the following methods:

• Email: privacy@cartographerconsulting.com
• Web form: the form on our contact page
• Mail: Privacy Request, Cartographer Consulting LLC, 11120 East Ocean Air Drive, Suite 101-35, San Diego, CA 92130

Privacy requests are owned by Cartographer's managing member, who is responsible for logging each request, verifying the requester, and responding within the timeframes in Section 13.1.

Cartographer Consulting LLC 11120 East Ocean Air Drive, Suite 101-35 San Diego, CA 92130