Privacy.

The website

Analytics. We use Umami, which is cookieless. It records page views, referring sites, browser, device type, and country. It does not use cookies, collect anything that identifies you personally, or track you across other websites. The analytics script loads from this site’s own domain, which is why you won’t see a third-party analytics request. That’s why there’s no cookie banner on this site: there are no cookies to consent to.

Do Not Track. Because we don’t track you across sites or build a profile of you, there’s nothing for a browser’s Do Not Track signal to switch off. We treat every visit the same way whether the signal is on or not.

The ROI Readiness Scorecard. Your answers are scored in your browser. Nothing is sent anywhere unless you choose to enter your email at the end. If you do, we send you your results and store your email address, grade, score, and lowest-scoring area in our CRM. Grayson may also send you one personal note about your results. Beyond that, we won’t email you unless you contact us.

The intake form. If you book an intro call, ask a question, or request an engagement, we keep what you submit: your name, contact details, company, role, and what you told us about the problem. We use it to reply, to prepare for the conversation, and to remember it afterward.

What we don’t do. We don’t sell your data, share it with advertisers, run ad-tracking pixels, or add you to a mailing list you didn’t ask for.

Who processes it

We use a small number of third-party services to run the practice. Netlify hosts the site and receives intake form submissions. n8n passes form and Scorecard submissions on to HubSpot, which is our CRM. AgentMail sends the Scorecard results email and our internal notifications. Proton hosts our inbox, so it holds anything you email us. Umami provides the analytics described above. Each holds only what it needs to do its job, and we don’t use any service that resells personal data.

Where your data actually lives

Storage. Engagement materials live in a dedicated cloud workspace for your engagement, on Kymata-controlled accounts. Nothing is stored on employer systems or employer hardware, and no client data touches any system that belongs to another company either of us works for.

Access. Only the people staffed on your engagement can open it. For most engagements that is two people, and we tell you which two before you send anything.

Subprocessors. Analysis happens in the tools named above plus the cloud storage and spreadsheet software the workspace runs on. We don’t upload client data to systems we haven’t told you about, and we don’t put identifiable client data into third-party AI tools.

Deletion. We keep engagement materials for twelve months after delivery so we can answer follow-up questions, then delete them. Ask for deletion sooner and we’ll do it and confirm in writing. Our own working notes and the deliverable we wrote for you are what we retain.

All of this sits underneath whatever NDA we sign, which we’ll sign before any sensitive briefing and can send first if you prefer.

Client data during an engagement

Engagements involve real business data: financials, spend records, reporting exports, sometimes customer or user data. We treat it as confidential, we use it only for your engagement, and we don’t reuse it elsewhere.

Who sees it. Client data is accessible to Kymata personnel working on your engagement, all of whom are bound by confidentiality obligations no less protective than those in your statement of work.

How long we keep it. For the length of the engagement and twelve months after delivery, as described under Deletion above. If you want it gone sooner, tell us and we’ll delete it and confirm in writing.

What we publish. Nothing about your engagement, ever, without your written permission. If we ever want to describe work we’ve done for you, we ask first and you decide.

Your choices

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email info@kymataconsulting.com and we’ll handle it. There’s no form and no process, because we’re small enough that a message reaches a person.

Changes

If we change how we handle data, we’ll update this page and change the date at the top. We won’t quietly start doing something this page says we don’t do.

Questions about any of this are welcome. info@kymataconsulting.com