PRIVACY POLICY

Stone Harp Analytics | https://stoneharpanalytics.com | Effective Date: April 9, 2026

1. Introduction and Scope

Stone Harp Analytics ("we," "us," or "our") is committed to protecting the privacy and personal information of all visitors to our website located at https://stoneharpanalytics.com (the "Website"). This Privacy Policy explains what information we collect, how we use and protect it, with whom we share it, and the rights you have in relation to your personal data.

This Privacy Policy applies to information collected through the Website only. It does not apply to information collected through any separate client contracts, statements of work, or professional service engagements, which may be governed by their own data processing terms.

By using the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Privacy Policy, please discontinue use of the Website.

2. Data Controller

For purposes of applicable data protection law, the data controller responsible for personal information collected through this Website is:

Stone Harp Analytics

Location: Sioux Falls, South Dakota, United States

Email: contact@stoneharpanalytics.com

Phone: (312) 788-8499

3. Information We Collect

We collect two categories of information through the Website: information you provide directly to us, and information collected automatically.

3.1 Information You Provide Directly

When you use our contact form or otherwise communicate with us through the Website, you may provide us with personal information including:

Your full name;
Your email address;
Your phone number (if provided);
Your organization or employer (if provided);
The content of your message or inquiry.

We do not require you to create an account to use the Website, and you are not obligated to provide this information. However, failure to provide requested contact information may prevent us from responding to your inquiry.

3.2 Information Collected Automatically

When you visit the Website, certain information is automatically collected through cookies and similar tracking technologies, including:

Your IP address and approximate geographic location;
Browser type, version, and language settings;
Operating system and device type;
Pages visited on the Website and time spent on each page;
Referring URL (the page you visited before arriving at our Website);
Date and time of your visit;
Other technical interaction data generated by your browser.

This data is collected using cookies and analytics tools, as further described in Section 5 (Cookies) below.

4. How We Use Your Information

We use the information we collect for the following purposes:

To respond to your inquiries, questions, and requests submitted through our contact form;
To understand how visitors interact with the Website in order to improve its content, usability, and performance;
To analyze Website traffic trends and user behavior using aggregated, anonymized analytics data;
To protect the security and integrity of the Website, detect and prevent fraudulent or malicious activity;
To comply with our legal obligations, enforce our Terms and Conditions, and protect our legal rights;
To send you information about our services, if you have requested it (you may opt out at any time).

We process your personal information only where we have a lawful basis to do so. Our legal bases for processing include: (a) your consent (where applicable); (b) our legitimate business interests in operating the Website and communicating with prospective clients; and (c) compliance with applicable legal obligations.

5. Cookies and Tracking Technologies

Cookies are small text files placed on your device when you visit a website. We use the following types of cookies on the Website:

5.1 Strictly Necessary Cookies

These cookies are essential for the Website to function correctly. They do not collect any personally identifiable information and cannot be disabled without affecting basic Website functionality.

5.2 Analytics and Performance Cookies

We use analytics cookies — including those provided by Google Analytics — to collect anonymized information about how visitors use the Website. This helps us understand which pages are most popular, how users navigate through the Website, and where we can make improvements. The data collected is aggregated and does not directly identify individual users.

Google Analytics may set the following cookies: _ga, _gid, _gat, and related variants. These cookies collect data such as your IP address (which Google anonymizes), browser type, pages visited, and time on site. For more information on Google Analytics and its privacy practices, please visit: https://policies.google.com/privacy

5.3 Tracking and Targeting Pixels

The Website may use tracking pixels or similar technologies to understand user behavior and measure the effectiveness of our Website. These technologies may collect information about your visits to the Website and may link this data with information from other sources.

5.4 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can instruct your browser to refuse cookies or delete existing cookies. However, if you choose to disable cookies, some features of the Website may not function as intended. For more information on managing cookies, visit www.allaboutcookies.org.

To opt out of Google Analytics tracking, you may install the Google Analytics Opt-out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout

6. Third-Party Service Providers

We may share your personal information with trusted third-party service providers who assist us in operating the Website and delivering our services. These providers are contractually obligated to use your information only as instructed by us and in accordance with applicable data protection law.

Third-party providers used in connection with this Website may include:

Google LLC (Google Analytics) — Website analytics and visitor behavior analysis;
Web hosting and infrastructure providers — to host and deliver the Website;
Email service providers — to receive and respond to contact form submissions.

We do not sell, rent, lease, or trade your personal information to third parties for their own marketing purposes.

7. Disclosure of Your Information

In addition to sharing with service providers as described above, we may disclose your personal information in the following circumstances:

Legal compliance: Where required by law, court order, or government authority, including in response to a valid subpoena, legal process, or regulatory request;
Protection of rights: To protect the rights, property, safety, or security of Stone Harp Analytics, our clients, the public, or others;
Business transfers: In connection with a merger, acquisition, reorganization, sale of assets, or other business transaction, in which case your information may be transferred to the acquiring entity, subject to the same privacy commitments described in this Policy;
With your consent: For any other purpose disclosed to you at the time of collection, with your express consent.

8. International Data Transfers

Stone Harp Analytics is located in the United States. If you are accessing the Website from outside the United States, your personal data will be transferred to, stored, and processed in the United States, which may not provide the same level of data protection as the laws of your home country.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, please note that such transfers to the United States are made subject to appropriate safeguards in accordance with applicable data protection law. Where required, we rely on mechanisms such as Standard Contractual Clauses (SCCs) approved by the European Commission or other equivalent transfer mechanisms to ensure that your personal data is adequately protected when transferred internationally.

By using the Website, you acknowledge and consent to the transfer of your personal data to the United States as described in this Policy.

9. Your Privacy Rights

Depending on your jurisdiction, you may have certain rights with respect to your personal information. We honor such rights to the extent required by applicable law.

9.1 Rights Under GDPR (EEA, UK, and Switzerland Residents)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you may have the following rights under the General Data Protection Regulation (GDPR) or equivalent legislation:

Right of access: The right to obtain a copy of the personal data we hold about you;
Right to rectification: The right to have inaccurate or incomplete personal data corrected;
Right to erasure: The right to request deletion of your personal data, subject to certain exceptions;
Right to restriction of processing: The right to request that we limit the ways in which we use your data;
Right to data portability: The right to receive your personal data in a structured, machine-readable format;
Right to object: The right to object to processing based on our legitimate interests;
Rights related to automated decision-making: The right not to be subject to solely automated decisions that produce legal or similarly significant effects.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your personal data in accordance with applicable law.

9.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to know: The right to know what personal information we collect, use, disclose, and sell about you;
Right to delete: The right to request deletion of your personal information, subject to certain exceptions;
Right to correct: The right to request correction of inaccurate personal information;
Right to opt-out of sale or sharing: We do not sell or share personal information for cross-context behavioral advertising;
Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined under CCPA;
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

9.3 How to Exercise Your Rights

To exercise any of the rights described above, please contact us using the contact information in Section 12 of this Policy. We will respond to all verifiable requests within the timeframes required by applicable law (generally 30 days, or as extended in accordance with applicable law). We may need to verify your identity before fulfilling your request.

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including to respond to your inquiries, comply with our legal obligations, resolve disputes, and enforce our agreements.

Contact form submissions and related correspondence are typically retained for a period of three (3) years from the date of last contact, or longer if required by applicable law or if necessary for an ongoing business relationship.

Analytics data collected through Google Analytics is retained in accordance with Google's data retention settings, which we have configured to the minimum period reasonably necessary for analytical purposes.

When personal data is no longer needed, we take steps to securely delete or anonymize it.

11. Data Security

We take reasonable and appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include the use of secure communication protocols (HTTPS/TLS), access controls, and periodic review of our data handling practices.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You provide information at your own risk. If you believe your personal data has been compromised, please contact us immediately.

12. Children's Privacy

The Website is not directed at, and we do not knowingly collect personal information from, children under the age of 13 (or under the age of 16 for residents of the European Economic Area). If we become aware that we have inadvertently collected personal information from a child below the applicable age threshold, we will take prompt steps to delete such information. If you believe we have collected information from a child in this manner, please contact us at contact@stoneharpanalytics.com.

13. Links to External Websites

The Website may contain links to external websites operated by third parties. This Privacy Policy applies solely to our Website. We are not responsible for the privacy practices of any third-party websites and encourage you to review the privacy policies of any websites you visit via links from our Website.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or for other operational, legal, or regulatory reasons. When we make material changes, we will update the "Effective Date" at the top of this Policy.

We encourage you to review this Privacy Policy periodically. Your continued use of the Website after any changes have been made constitutes your acceptance of the revised Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Stone Harp Analytics