Privacy Policy

1. Information We Collect

Information you provide directly

• Contact form submissions. Our contact form collects your name, email address, and phone number (required), and optionally your role, company details, and technology goals. Submissions are routed to our lead-management systems so we can respond to your inquiry.
• Client Portal accounts. If you are a client, we collect your email address to authenticate you via secure magic link, along with support tickets, project information, and messages you submit through the portal.
• Team Portal accounts. Jonsen LLC personnel authenticate via Microsoft Entra single sign-on. Employee profile data is governed by internal policy.
• Email communications. If you correspond with us by email, we retain those communications.
• Careers inquiries. Information you submit through our careers terminal (dev.jonsenllc.com) or by email.

Information collected automatically

• Analytics and advertising data. With your consent, we use Google Tag Manager, Google Analytics 4, and Google Ads conversion tracking. These tools collect device and browser information, approximate location, pages viewed, referral source, and interaction events (such as form submissions) via cookies and similar technologies. Nothing loads until you make an affirmative choice on our cookie banner.
• Enhanced Conversions. When you submit our contact form, your email address and phone number are converted to an irreversible hashed value (SHA-256) client-side by Google's tooling before transmission to Google for advertising measurement. We do not send your plaintext contact details to advertising platforms.
• Network and security data. Our site is delivered through Cloudflare's content delivery network, which processes IP addresses and request metadata for performance and security (e.g., DDoS mitigation, bot filtering).
• Server and application logs. Standard logs including IP address, timestamps, and pages requested.

Information we do not collect

We do not knowingly collect information from children under 16. Our Services are business-to-business and not directed to children. We do not sell personal information.

2. How We Use Information

We use the information we collect to:

• Respond to inquiries and route new business leads to the right team member;
• Provide, operate, and secure the Client Portal, including support tickets and project updates;
• Send transactional emails (e.g., sign-in links, ticket updates). We honor unsubscribe requests via the unsubscribe link in our emails and maintain a suppression list;
• Measure marketing performance, including which campaigns and channels produce inquiries (Google Analytics 4, Google Ads conversion tracking), only after consent;
• Improve the site and our service offerings;
• Comply with legal obligations and enforce our Terms of Service.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects.

3. AI Features

Portions of our internal tooling and portal experience use AI services (including Anthropic Claude and Google models via a secured gateway) to assist our team and generate portal content such as dashboards. Client Portal data is not used to train third-party AI models. AI-generated output within any portal is assistive in nature; where AI processes information you submit, it is processed under the same confidentiality and security controls described in this policy.

4. How We Share Information

We share personal information only with service providers who process it on our behalf under appropriate safeguards:

We may also disclose information: (a) to comply with law or valid legal process; (b) to protect the rights, safety, or property of Jonsen LLC, our clients, or others; or (c) in connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to previously collected data.

We do not sell personal information, and we do not share it with third parties for cross-context behavioral advertising beyond the Google advertising measurement described above and only when you have consented.

5. Cookies and Tracking Choices

Our site uses Google Consent Mode v2 with all non-essential signals denied by default. Nothing analytics or advertising loads until you make an affirmative choice on our cookie banner.

You can control tracking in several ways:

• Cookie preferences. Use the "Cookie preferences" link in our site footer to review or change your choice at any time — turning a category off is as easy as turning it on.
• Global Privacy Control. We honor GPC signals. If your browser sends GPC, we keep analytics and advertising off by default and record your GPC signal instead of prompting you.
• Browser controls. Most browsers let you block or delete cookies.
• Google opt-outs. Install the Google Analytics Opt-out Add-on or adjust Google Ads settings.
• Do Not Track. Our site does not currently respond to DNT signals, but the controls above remain available.

We keep an anonymous ledger of consent decisions (no name, no email, no raw IP address — only a hashed value) so we can honor your choice and demonstrate compliance. This ledger is never sold or shared for advertising.

6. Data Retention

We retain personal information only as long as needed for the purposes above: contact form leads for the duration of our business relationship or prospective relationship; portal account data while your account is active and for a reasonable period thereafter; transactional email and suppression records as needed to honor your preferences; and analytics data per Google's configured retention settings. We delete or de-identify data when it is no longer needed.

7. Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including: row-level security on all application database tables, role-based access controls, single sign-on with multi-factor authentication for staff, encryption of stored credentials (AES-256), encryption in transit (TLS), and edge security via Cloudflare. No method of transmission or storage is 100% secure; if we learn of a breach affecting your personal information, we will notify you as required by law.

8. Your Rights (Colorado Privacy Act)

Colorado residents have the right to:

• Access the personal information we hold about you and receive a portable copy;
• Correct inaccurate personal information;
• Delete personal information we hold about you;
• Opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. (We do not sell personal information; we honor GPC as a universal opt-out signal for targeted advertising.);
• Appeal a denied request within a reasonable time.

To exercise any right, email hello@jonsenllc.com with "Privacy Request" in the subject line. We will verify your identity and respond within the time required by applicable law (generally 45 days, with one 45-day extension where reasonably necessary). We will not discriminate against you for exercising your rights.

9. U.S. Processing

We are based in the United States and process data on U.S.-based infrastructure. If you access the Services from outside the United States, you understand your information will be transferred to and processed in the U.S. This policy is written for a U.S. audience.

10. Client Engagements

Data we process on behalf of clients under a consulting engagement (for example, within a client's own systems) is governed by the applicable engagement agreement, not this policy. This policy covers our own website and portals.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by a new "Last Updated" date and, where appropriate, notice on the site or by email. When we make a material change, we bump our internal policy version so the cookie banner reappears and you can review your choices. Continued use of the Services after changes take effect constitutes acceptance.

12. Contact Us

Jonsen LLC Denver, Colorado hello@jonsenllc.com