Privacy
This page is written plainly and kept short on purpose.
This policy covers information collected through ethercastle.com and through inquiries sent to us directly. Ethercastle LLC is a California limited liability company.
This policy does not cover client data. Information that Ethercastle accesses, processes, or stores during a consulting engagement — systems data, security telemetry, log and alert content, personnel records, and any personal information belonging to a client's own customers or staff — is governed by the written agreement with that client and any data processing addendum executed under it. Where those terms conflict with this page, the engagement terms control.
If you use the contact form, we receive your name, email address, subject, and message. Submissions are transmitted over an encrypted connection to our own endpoint and delivered to [email protected]. The form does not transit a third-party form service, and submissions are not stored in a database or a CRM.
Nothing on this site requires you to identify yourself. You can read every page without submitting anything.
Our hosting and content delivery providers record standard request data — IP address, browser and device type, referring page, requested URL, and timestamp. This is used to serve the site, block abuse, and diagnose errors. This log data is kept separate from anything you send us through the contact form.
We use Google Analytics 4 to understand how the site is used — which pages are read, how visitors arrive, and roughly where they are. Google Analytics sets first-party cookies and assigns your browser a randomly generated identifier so that repeat visits can be counted as one visitor rather than several. It receives your IP address in order to derive an approximate location; Google states that it does not log or store IP addresses within Analytics.
Google Signals, advertising personalization, and ads data sharing are not enabled on this property. Analytics data is not used to advertise to you, is not sold, and is not linked to anything you send us through the contact form.
If you would rather not be counted, install Google's Analytics opt-out browser add-on, or block the script with any content blocker. The site behaves identically either way, and nothing on it is gated behind measurement.
The analytics cookies described above are the only cookies we set. Our content delivery network may additionally set strictly necessary cookies for bot management and security, which keep the site available. We use no advertising cookies and allow no third-party advertising trackers here.
This site loads typefaces from Google Fonts. Your browser requests those files directly from Google, which means Google receives your IP address and user agent as part of that request. Google states that Fonts requests are not used for advertising or profiling. If you would rather avoid the request entirely, a content blocker or a locally installed copy of the fonts will prevent it.
We do not use your information for automated decision-making or profiling, and we do not add you to a mailing list. We have no newsletter. If you write to us, you get a reply, not a sequence.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not disclose your information to anyone for their own marketing purposes.
Two infrastructure providers process data on our behalf, under contract and limited to that purpose:
| Provider | Purpose |
|---|---|
| Cloudflare | DNS, content delivery, security filtering, and contact form handling |
| Amazon Web Services | Static site hosting and business email |
| Website analytics and web font delivery |
We may also disclose information where required by law, in response to valid legal process, or where necessary to protect our rights, safety, or property. If we ever receive such a demand and are permitted to tell you, we will.
Contact inquiries live in our email as ordinary business correspondence. We keep them while a conversation is active and for a reasonable period afterward as a record, then delete them. Server and security logs are retained on a short rolling window set by our providers' defaults. Analytics data is retained by Google for the period configured on the property, after which event-level records are deleted. You can ask us to delete your correspondence at any time and we will.
All traffic to this site is encrypted in transit with TLS. Access to the mailbox receiving form submissions is protected by multi-factor authentication. Administrative access to hosting and DNS is restricted and separately authenticated. No system is perfectly secure and we will not claim otherwise, but the surface here is deliberately small: a static site, no database, no accounts, no stored visitor records.
Write to us and we will tell you what we hold about you, correct it, or delete it. We will do this whether or not a particular statute obliges us to.
Under the California Consumer Privacy Act, as amended, you have the right to know what personal information is collected and how it is used and disclosed, to delete it, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be treated differently for exercising any of these rights.
As stated above, we do not sell or share personal information, and we do not collect sensitive personal information as that term is defined. To make a request, email us. We will verify it by corresponding with you at the address the information is associated with, and we will not discriminate against you for asking. You may use an authorized agent.
Because we do not sell or share personal information and do not track visitors across sites, a Global Privacy Control signal has nothing to act on here. We do not behave differently in response to Do Not Track headers.
We sometimes link to third-party resources. Their privacy practices are their own and this policy does not extend to them.
If we change this policy, the date at the top of the page changes with it. Material changes will be described here rather than quietly folded in.
Questions or requests about this policy:
Ethercastle LLC
San Francisco, California
[email protected]