Privacy policy.

Adhere Labs is a US-based technology services company headquartered at 2010 Crow Canyon Place, San Ramon, CA 94583. This policy explains how we handle personal information collected through www.adherelabs.com, through email correspondence, and in the course of delivering work to our clients.

Who this policy covers

This policy applies to visitors to our website, people who contact us through the audit or project forms, and people who correspond with us by email about a possible or existing engagement. It also explains, at a high level, how we treat data belonging to our clients and their customers while we are working for them.

Adhere Labs sells to businesses, not to consumers. The personal information we collect is overwhelmingly business contact information given to us voluntarily by someone who wants to talk to us.

What we collect

Information you give us

• Form submissions. When you submit the audit form or the project form, we receive your name, email address, company name, industry, the service area and timing you selected, and whatever you write in the message field.
• Email correspondence. If you email us, we receive your email address, your message, any attachments you send, and the ordinary metadata your mail provider attaches.
• Engagement information. If you become a client, we collect the contact details, credentials and business information required to deliver the work, plus billing details needed to invoice you.

Information collected automatically

• Server logs. Our hosting provider records standard request logs — IP address, user agent, requested URL, referrer, timestamp and response status. These are generated automatically for every website and are used for security, abuse prevention and diagnostics.
• Rate-limiting data. Our form endpoint temporarily holds the IP address of recent submissions in memory so that a single source cannot flood the form. This data is transient and is not written to a database.
• Analytics. Where analytics are enabled, we collect aggregate usage data — pages viewed, approximate location at city or region level, device and browser type, and how visitors arrived at the site.

We do not ask for and do not want sensitive personal information — government identifiers, health information, precise geolocation, biometric data or financial account numbers — through this website. Please do not send it through the forms.

Why we use it, and on what basis

• To respond to you. Form submissions and emails are used to reply, schedule an audit call, ask follow-up questions and scope work. This is the purpose you submitted the information for.
• To deliver services. Where you are a client, we use your information to perform the agreement between us.
• To operate and secure the site. Logs and rate limits protect the site and our mail account from abuse. This rests on our legitimate interest in running a secure service.
• To improve what we publish. Aggregate analytics tell us which pages are useful. This also rests on legitimate interest, and the data is not used to build profiles of individuals.
• To meet legal and accounting obligations. Invoices, contracts and related records are retained as required by law.

We do not use website form submissions to build marketing lists, and we do not add you to a newsletter because you asked for an audit. If we ever start a mailing list, joining it will be an explicit, separate opt-in.

Third-party processors

We keep our vendor list deliberately short. We use third-party services in the following general categories, and each acts as a processor on our behalf under its own terms:

• Hosting and content delivery — serving this website and running the form endpoint.
• Transactional email — delivering form submissions to our inbox and sending our replies.
• Analytics — measuring aggregate site usage.
• CRM and productivity tools — tracking conversations, proposals and project documentation.
• Payment and accounting providers — invoicing clients. Card details, where applicable, are handled by the payment provider and are not stored by us.

We share personal information with these providers only to the extent needed to run our business, and we do not sell it, rent it or trade it. We may also disclose information where we are legally required to do so, or where it is necessary to establish or defend a legal claim.

Cookies and analytics

This website's core content does not require cookies to function. Where analytics are enabled, the analytics provider may set a first-party cookie or use similar storage to distinguish one visit from another. Embedded third-party resources — web fonts and images loaded from external hosts — will see your IP address as part of serving those files.

You can block or delete cookies in your browser settings, and most browsers offer a "do not track" or global privacy control signal. Blocking cookies will not prevent you from reading anything on this site or submitting a form.

How long we keep things

• Form submissions and email: kept while the conversation is live and for a reasonable period afterwards, so we can pick up a thread that goes quiet and resume it later.
• Client engagement records: kept for the duration of the engagement and afterwards as needed for support, warranty and legal purposes.
• Financial records: kept for the period required by US tax and accounting rules.
• Server logs: retained for a short operational window by our hosting provider and then rotated out.

You can ask us to delete your information sooner. See your rights below.

Security

We take reasonable and appropriate measures to protect the information we hold: transport encryption across the site, credentials and API keys stored in environment variables rather than in code, access limited to the people who need it, and rate limiting on the public form endpoint. During client engagements we prefer client-owned credentials with scoped permissions over shared or over-privileged accounts.

No system is perfectly secure, and we make no guarantee that a determined attacker can never succeed. If a breach affecting personal information occurs, we will notify affected parties and any required authorities as the law requires.

Client data during an engagement

You own your accounts, your workflows, your code and your data. When we build automations, software, campaigns or operations processes for a client, we work inside accounts the client owns and controls. We access client systems and client data only to the extent needed to deliver the agreed work.

• We do not use client data or the personal information of a client's customers for our own purposes.
• We do not sell client data, and we do not share it with other clients.
• Where a client's data passes through an AI model or a third-party platform as part of a system we build, that arrangement is described in the statement of work for the engagement.
• On request, or at the end of an engagement, we return or delete the working copies of client material we hold and hand over the accounts and documentation.

For personal information belonging to a client's own customers, the client is the controller and Adhere Labs acts as a processor under the engagement agreement. Requests from those individuals should go to the client in the first instance.

Children's privacy

This is a business-to-business website. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has submitted information through this site, email us and we will delete it.

California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the following rights over the personal information we hold about you:

• The right to know what categories of personal information we have collected, where it came from, why we collected it, and who we disclosed it to.
• The right to delete personal information we hold about you, subject to the exceptions the law allows — for example, records we must keep for tax or legal reasons.
• The right to correct inaccurate personal information we hold about you.
• The right to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information.
• The right to non-discrimination for exercising any of these rights. We will not treat you differently because you made a request.

Adhere Labs does not sell personal information, and does not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months, and we have no plans to start.

To make a request, email hello@adherelabs.com with the subject line "Privacy request". We will verify your request by replying to the email address associated with the information — that verification step protects you from someone else making a request in your name. An authorized agent may make a request on your behalf with written permission. We respond within the timeframes the law requires.

International transfers

Adhere Labs operates from the United States, and the providers we use process data on servers primarily located in the United States. If you contact us from outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from those in your country. By contacting us, you understand that this transfer takes place. Where a client engagement requires specific safeguards for cross-border transfers, those are agreed in the engagement contract.

Changes to this policy

We update this policy when our practices change or when the law requires it. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle information you have already given us, we will make a reasonable effort to tell you directly.

Contact us

Questions, requests or complaints about this policy can go to hello@adherelabs.com, or by mail to Adhere Labs, 2010 Crow Canyon Place, San Ramon, CA 94583, United States. We read everything that arrives there and reply within one business day.