How we handle your information.

Introduction

Rosalind Gash ("we," "us," or "our") operates rosalindgash.com (the "Site"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our contact form.

We respect your privacy and are committed to protecting your personal data. This policy will inform you about how we handle your personal data, your privacy rights, and how the law protects you.

Information We Collect

Contact Form Data

When you submit our contact form, we collect:

• Your name
• Email address
• Role or title (optional)
• Company name
• Company website (optional)
• SaaS business model description
• Revenue range
• Timeframe for engagement (optional)
• Current billing, accounting, and payroll systems (optional)
• Primary financial questions
• Available data sources (optional)
• Module preferences (optional)
• Professional support status (accountant, tax adviser)

Analytics Data

With your consent, we use Cloudflare Web Analytics to understand how visitors use our site. This service collects:

• Pages visited
• Time spent on pages
• Referring websites
• Device type and browser information
• Aggregated, anonymized usage data (Cloudflare Web Analytics is privacy-first and does not use cookies or collect personally identifiable information)

Technical Data

Our server automatically collects:

• IP address (for rate limiting and security purposes)
• Browser type and version
• Time zone and location data (approximate, based on IP)
• Page response times and error logs

How We Use Your Information

We use the information we collect to:

• Respond to inquiries: Contact form data is used solely to evaluate engagement fit and respond to your questions
• Improve our services: Analytics help us understand which pages are most useful
• Prevent abuse: IP-based rate limiting prevents spam and malicious submissions (5 submissions per hour per IP address)
• Comply with legal obligations: We may retain certain information to comply with tax, accounting, or legal requirements

Legal Basis for Processing (GDPR)

If you are from the European Economic Area (EEA), our legal basis for collecting and using your personal information depends on the data and context:

• Consent: You provide explicit consent when submitting the contact form or accepting cookies
• Legitimate interests: We have a legitimate interest in responding to inquiries and preventing spam
• Legal obligations: We may need to retain certain data to comply with tax or accounting laws

How We Share Your Information

We do not sell, rent, or trade your personal information.

We may share your information only in these limited circumstances:

• Service providers: We use Cloudflare (analytics), Google Workspace (email hosting), and our VPS hosting provider. These parties are contractually obligated to keep your data confidential
• Legal requirements: We may disclose information if required by law, court order, or government regulation
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred (you will be notified via email and/or prominent notice on our website)

Data Retention

• Contact form submissions: Retained for 3 years or until you request deletion
• Analytics data: Cloudflare retains aggregated analytics for 6 months
• Rate limiting data: IP addresses are stored in memory for 1 hour and automatically deleted
• Server logs: Retained for 30 days for security and debugging purposes

Your Privacy Rights

All Users

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data (subject to legal retention requirements)
• Opt-out: Decline analytics cookies via our cookie consent banner

GDPR Rights (EEA Residents)

You also have the right to:

• Data portability: Receive your data in a machine-readable format
• Restrict processing: Request that we limit how we use your data
• Object: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent at any time (does not affect lawfulness of prior processing)
• Lodge a complaint: File a complaint with your local data protection authority

CCPA Rights (California Residents)

You have the right to:

• Know what personal information is collected, used, shared, or sold
• Delete personal information held by us
• Opt-out of the sale of personal information (we do not sell data)
• Non-discrimination for exercising your CCPA rights

Cookies and Tracking

We use minimal browser storage and may load privacy-focused analytics only with your consent. You can control your preferences through the consent banner that appears on your first visit.

Technologies We Use

Essential preference storage:We use your browser's local storage to remember whether you accepted or declined optional analytics. This prevents the consent banner from appearing on every visit.

Optional analytics: If you consent, we load Cloudflare Web Analytics to understand general website traffic and performance. Cloudflare Web Analytics does not use cookies, track individual users across websites, or collect contact-form contents.

You may decline optional analytics and continue using the website, including the contact form.

Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: All data transmitted to/from our site uses HTTPS (TLS 1.2+)
• Access controls: Environment files and database credentials are stored with restricted permissions
• Rate limiting: Prevents brute-force attacks and spam (5 submissions/hour per IP)
• Honeypot protection: Contact form includes hidden fields to detect bots
• Server hardening: Systemd service runs with minimal privileges (NoNewPrivileges, ProtectSystem, PrivateTmp)

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us, and we will delete it.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. Our VPS hosting is located in [Server Location - check with hosting provider]. We ensure appropriate safeguards are in place for international transfers.

Third-Party Links

Our website may contain links to third-party websites (e.g., portfolio examples, case studies). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will provide prominent notice (e.g., banner notification or email if you submitted a contact form).

Consent version: When we make significant changes, the cookie consent banner will reappear to obtain fresh consent.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

• Email: hello@rosalindgash.com
• Subject line:"Privacy Request"

We will respond to all requests within 30 days.

Data Protection Officer

For GDPR-related inquiries, you may contact our designated privacy contact at hello@rosalindgash.com.