Privacy notice | Data Fact Tree

1. Who is responsible

Data Fact Tree, LLC, a Virginia limited liability company based in Alexandria, Virginia, decides how and why personal information collected through this site is used. Questions and requests: info@datafacttree.com.

2. What we collect and why

2.1 When you browse

Our own analytics script records, for each page you view: the page path (never the query string), the site you came from (domain only), the device class (phone, tablet, or desktop), and any campaign tags in the link you followed. It also records what you do on the page: which buttons, filters, and cards you use, how far you scroll, how long the page is open, which outside links you follow, and the steps of a booking. Each record carries a random visitor id and a random session id. It never records your IP address, your name, your email, or the full URL.

The purpose is to learn which pages and which sources lead to inquiries, so we can write more of what is useful. We may also show different wording to different visitors to see which reads better; that assignment uses the random id only.

The visitor id lives in one first-party cookie, dft_vid, valid for 13 months, with no other content. Your browser also keeps, in its own storage: a session id that expires after 30 minutes of inactivity, the page you landed on, and the first and most recent source you arrived from (kept until you clear site data). While you are booking a call, a random id reserves your chosen time for ten minutes; this works even with analytics off. None of that storage is read by anyone but this site.

If your browser sends a Do Not Track or Global Privacy Control signal, we honor it: the cookie is not set and no events are recorded. If you are in the EU or UK and prefer no analytics cookie at all, turn on either signal and nothing is set.

2.2 When you send a brief

We keep your name, email address, company name, your message, and, if the form asks and you answer, the timeframe and budget range you chose. We also keep the source and campaign tags of the visit, the random visitor id from the cookie (which connects your visit history to your message), and any notes we add after reading it. We use this to reply to you and to prepare for a call. We do not add you to a mailing list.

2.3 When you book a call

We keep your name, email address, company name if given, your notes, the time you chose and your time zone, the source of the visit, the random visitor id, a cancellation token that only you receive, and any notes we add after the call. We send you a confirmation email with a calendar link, and a note to ourselves. We keep a log of each email sent (recipient, subject, time, and whether sending succeeded).

2.4 When you email us

We keep the correspondence for as long as we are in contact, as any business does.

2.5 What we do not do

No third-party analytics, advertising pixels, or social-media trackers on any page.
No selling, renting, or sharing of personal information, and no cross-context behavioral advertising.
No profiling and no decisions about you made by automated means.
No sensitive personal information: we do not ask for it and do not knowingly collect it.
No content directed at children, and no knowing collection from anyone under 16. If you believe a child has sent us information, email us and we will delete it.

3. Who processes it on our behalf

The site and its small backend run on infrastructure we rent. These providers act on our instructions under their own contracts and security commitments, and see only what their service needs:

Cloudflare, Inc. hosts the site, runs the code that handles bookings and messages, and delivers our email. Cloudflare sees the network traffic to the site, as any host does, under its own privacy policy.
A managed PostgreSQL database hosted in the United States stores bookings, messages, usage events, and the email log.
YouTube (Google LLC), only for research entries that embed a video. The thumbnail loads from Google wherever the entry is listed. The player loads from youtube-nocookie.com, the privacy-enhanced embed, only when you press Play.

Fonts are served from this site, not from a font service. We disclose personal information only to these processors, to professional advisers under confidentiality, to a successor if the firm is sold or merged (under this notice), or where the law requires it.

4. How long we keep it

Usage events: 13 months as individual events, then summarized into daily totals that contain no visitor ids, and deleted.
Briefs, bookings, and the email log: for as long as we are in contact. We review stored briefs and bookings at least once a year and delete those older than three years since the last contact. Deleted earlier on request.
Email correspondence: as above.

5. Your choices and rights

Whoever you are and wherever you live, you can ask us to:

Tell you what we hold about you and send you a copy.
Correct anything that is wrong.
Delete your brief, your booking, the email log entries, and any usage events tied to your visitor id.
Stop analytics for your browser: turn on Do Not Track or Global Privacy Control. Deleting the dft_vid cookie gives you a new random id but does not stop recording. Nothing on the site changes either way.

Email info@datafacttree.com from the address you used with us so that we can match the request; we will not ask for anything more unless we cannot find you. We answer within 30 days and confirm by email. There is no charge, and we will not treat you differently for asking. If we refuse a request, reply to our answer to appeal; we respond to appeals within 60 days and tell you how to contact the Virginia Attorney General or the consumer-protection authority where you live.

Residents of California, Virginia, and other US states with privacy laws: the rights above are how we meet those laws. We do not sell or share personal information, so there is nothing to opt out of; we honor Global Privacy Control as an opt-out signal in any case.

Visitors outside the United States: this site is operated from the United States and your information is stored there. We process what you send us because you asked us to reply or to hold a time. We process the analytics in section 2.1 because we have a legitimate interest in understanding what visitors find useful; you can object at any time by the means above.

6. How we protect it

Every connection to the site is encrypted (HTTPS). Stored data is reachable only by us, through authenticated access. The booking and message endpoints validate every input and rate-limit abuse, and secrets are never stored in the code. No system is perfectly secure, so we keep as little as we can, for as short a time as we can.

7. Changes to this notice

When this notice changes, the effective date at the top changes with it; earlier versions are available on request. If a change affects what we do with information you have already given us, we will email everyone who has sent a brief or booked a call before it takes effect.

8. Contact

Data Fact Tree, LLC, Alexandria, Virginia. info@datafacttree.com.