We collect the least we can get away with.

What is collected, and why

There are four situations in which this site handles information about you. Nothing outside these four is collected.

1. When you send a conversation request

The form at cultmath.com/request asks for your name, email address, and role, and asks you to describe the decision or problem you are facing. It also has optional fields for your company, company size, timeline, and how you found me.

That information is used for one purpose: to read your request and reply to it. It is not added to a mailing list. You will not receive a newsletter you did not ask for.

2. When you submit a form inside a Google ad

CULT+MATH sometimes runs advertising on Google. If an ad carries a form, the name, email address, company, and answers you provide there are passed to me by Google and used the same way as a request sent through this site: to read it and reply.

Google's own handling of that submission is governed by Google's privacy policy, not this one. Google also sets advertising cookies in its own products. It does not set any on this website.

3. When you open a private client or working page

Some pages under /clients and /for are password protected. When you sign in, a session cookie is set so that you are not asked for the password on every page. That cookie holds a signed session token and nothing else. It is HttpOnly, Secure, restricted to that one client area, and it expires on its own.

It is a functional cookie. It does not follow you, it cannot be read by other sites, and it is not used for advertising or measurement.

4. When you browse a public page

Public pages on this site carry a Google advertising tag, account AW-18400942856. It exists for one reason: CULT+MATH runs advertising on Google, and the tag reports back whether an advertisement led to a conversation request. Without it there is no way to tell a working advertisement from a wasted one.

The tag sets cookies in your browser and sends Google information about your visit, including your IP address, the page you are on, and whether you completed a request. Google may use this to measure and personalise advertising under its own terms.

The tag is deliberately absent from every private page. It does not run on client deliverables under /clients, on working pages under /for, or on the sign-in page. Client engagement material is not Google's business, and those pages are excluded from advertising measurement by design rather than by oversight.

Consent settings are applied before the tag loads. Visitors from the European Economic Area, the United Kingdom and Switzerland have advertising and analytics storage set to denied by default, so no cookies are set for them and advertising identifiers are stripped from any request. This site does not show a consent banner; it withholds the storage instead.

If you would rather not be measured at all, any mainstream ad or tracker blocker will stop the tag, and nothing on this site breaks when it does. Google also offers its own ad settings and opt-out tools.

5. Ordinary server records

This site is hosted on Vercel. Like any web host, its servers keep short-lived technical records of requests, which include IP addresses and browser information. These are used to keep the site running and to investigate abuse or errors. I do not build profiles from them and do not connect them to any form submission.

Typography on this site loads from Google Fonts, which means your browser contacts fonts.googleapis.com and fonts.gstatic.com. Google receives your IP address as part of that request. It is a genuine third-party contact and worth naming rather than burying.

What this site does not do

Stated plainly, because most policies bury it:

• No analytics product. There is no Google Analytics and no alternative analytics tool here. The only tag on the site is the advertising tag described above, and it measures advertisements, not your reading.
• No tracking on private pages. Client and working areas carry no tag at all. Pages under /for additionally enforce a security policy that would block one at the browser level.
• No sale of personal information. Your information is not sold, rented, licensed, or traded, and it never will be. Under California law this also means no sharing for cross-context behavioural advertising.
• No profiling and no automated decisions. Nothing about you is scored by a machine. A person reads what you send.
• No sensitive information wanted. Please do not send health, financial account, government identifier, or similarly sensitive details through a form. If you send them anyway, they will be deleted.

If any of this changes, this page changes in the same commit as the code that changed it. A privacy policy that lags the software it describes is not a policy, it is a decoration.

Who else handles your information

Running even a small business means using other companies' software. These are the only ones that touch anything you send. Each is used for the single job listed and nothing more.

Beyond these, information is disclosed only where the law requires it, or where it is necessary to establish or defend a legal claim. If CULT+MATH LLC were ever sold or merged, information would transfer with the business, and this page would say so before it happened.

Some private client deliverables use additional services chosen for that engagement. Where that applies, it is set out in the agreement with that client rather than here, because it is their data and their contract governs it.

How long it is kept

• Conversation requests are kept for as long as the relationship is live, and for up to two years after the last contact, so that a later conversation can pick up where the previous one left off. Ask sooner and it goes sooner.
• Session cookies for private pages expire on their own within hours. Nothing persists after that.
• Advertising cookies set by the Google tag follow Google's own retention, typically up to two years, and can be cleared from your browser at any time.
• Server records are retained on the host's standard schedule, which is a matter of weeks, not years.
• Client engagement material is governed by the agreement with that client, which sets its own retention and deletion terms.

Your rights

Depending on where you live, you may have legal rights over your information under the Texas Data Privacy and Security Act, the California Consumer Privacy Act, the UK and EU General Data Protection Regulation, or a comparable law. Those rights generally include the following:

• Access. Ask for a copy of what is held about you.
• Correction. Ask for anything inaccurate to be fixed.
• Deletion. Ask for it to be erased.
• Portability. Ask for it in a form you can take elsewhere.
• Objection. Ask that it stop being used for a particular purpose.
• No retaliation. Exercising any of these rights costs you nothing and changes nothing about how you are treated.

These requests are honoured for everyone who asks, wherever they live. A firm this size may fall outside some of these statutes. That is not a reason to make people argue about jurisdiction to get their own information back.

There is no account to log into and no dashboard to navigate. Write to me, tell me what you want done, and it gets done. Expect a reply within thirty days, and usually much sooner.

Where the GDPR applies, the lawful bases relied on are your consent when you choose to send a form, and legitimate interests in operating a secure website and responding to enquiries. Consent can be withdrawn at any time. Nothing in the four situations above involves an international transfer beyond the ordinary use of the United States services named above.

Security, and its limits

This site is served over HTTPS. Private client areas sit behind password authentication with signed, expiring, HttpOnly session cookies scoped to a single client's pages. Access is granted on a least-privilege basis, meaning each client area can reach only its own material. Credentials and keys are held as environment variables and are never committed to the code repository. A content security policy restricts what any page is permitted to load.

No system is perfectly secure, and anyone claiming otherwise is selling something. What is promised here is a specific standard of care, not a guarantee. If a breach ever affected your information, you would be told directly and promptly rather than through a legal notice buried on a webpage.

Children, and changes to this page

This site is built for business audiences and is not directed at children. Information is not knowingly collected from anyone under 18. If you believe a child has sent something through a form here, tell me and it will be deleted.

If this policy changes, the effective date at the top changes with it, and the substance of the change is described here rather than quietly slipped in. Material changes will be summarised in this section for a reasonable period after they take effect.

Change log · August 20, 2026: first published version. Amended the same day to disclose the Google advertising tag added to public pages, the cookies it sets, the regional consent defaults, and how to opt out. The earlier claim that this site carried no advertising tag was accurate when written and is no longer, which is why it was removed rather than left standing.