Privacy Policy

1. Who is responsible for your information

Kavanos LLC is the business that operates the Site and is the "controller" of the personal information described in this policy for the purposes of the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, and similar laws. Under US state privacy laws, we are the "business" or "controller." We are based in Los Angeles, California, United States. You can reach us about privacy at hello@allyiseman.com.

2. Information we collect

Information you give us. When you submit a proposal through the form at /propose, we collect what you choose to enter, which may include:

• your name, email address, organization, and role
• details of the opportunity, such as the engagement type, project name, dates, location or format, audience, and any links you share
• a budget range, which we keep private and never display
• how you heard about Ally, and any message you write

When you email us, we receive your email address, the contents of your message, and anything you attach.

Information collected automatically. When you visit the Site, we and our service providers collect limited technical information, including your IP address, browser and device type, operating system, referring page, the pages you view, and the date and time of your visit. Our hosting provider records this in server logs for security and reliability, and, only if you accept analytics cookies, Google Analytics collects it to help us understand how the Site is used (see section 6).

Information we do not ask for. The Site is not designed to receive sensitive information, such as details about your health, sex life, sexual orientation, or finances. Please do not include it in the proposal form or in email. We do not knowingly collect payment card information on the Site.

3. How we use your information, and our legal bases

• To review and respond to your proposal or inquiry, and to plan and deliver any engagement we agree on. Legal basis: to take steps at your request before entering into a contract, and to perform that contract. Where you contact us on behalf of an organization, we rely on our legitimate interest in responding to and managing business inquiries.
• To keep a record of proposals and correspondence. Legal basis: our legitimate interest in running and protecting our business.
• To operate and secure the Site. Legal basis: our legitimate interest in a secure, working website. To understand which pages are useful through Google Analytics, only if you accept analytics cookies. Legal basis: your consent, which you can withdraw at any time (see section 6).
• To comply with the law, respond to lawful requests, and establish, exercise, or defend legal claims. Legal basis: legal obligation and legitimate interest.

We do not use your information for automated decision-making that has legal or similarly significant effects on you, and we do not sell it or rent it to anyone.

4. Who we share it with

We share personal information only with service providers who process it on our behalf, under contracts that require them to protect it and use it only to provide their service to us:

• Vercel, which hosts the Site and keeps server logs
• Notion, where submitted proposals are stored
• Resend, which delivers the email notification of a new proposal
• Google, which provides Google Analytics
• our email provider, which hosts the mailbox at hello@allyiseman.com

We may disclose information if the law requires it, to respond to a valid legal process, to protect the rights, safety, or property of Ally Iseman, our clients, or others, or in connection with a merger, sale, or transfer of our business, in which case the information remains protected by this policy or one at least as protective.

5. Third-party services you choose to use

Some features of the Site take you to, or load content from, services run by other companies. Each of them handles your information under its own privacy policy, and we are not responsible for their practices:

• Newsletter. When you enter your email in the newsletter box, you are taken to Substack to confirm your subscription. Substack hosts the newsletter under its own privacy policy. As the publisher, we receive your email address and subscription details, and we use them only to send you the newsletter. Legal basis: your consent. You can unsubscribe from any issue.
• Videos. Video players on the Site show a still image first. YouTube loads only when you press play, and from that moment Google may set cookies and collect information. See Google's privacy policy.
• Programs, coaching applications, and trips. These links open websites operated separately, including passport2pleasure.com and a third-party travel booking site, each with its own terms and privacy policy.
• Social media. Links to Instagram, LinkedIn, TikTok, Substack, and similar platforms take you to sites governed by those platforms' policies.

6. Cookies and analytics

Cookies are small files a website stores in your browser. The Site uses as few as possible:

• Analytics cookies. Google Analytics sets cookies (named _ga and _ga_KCRJQGMJ4L, kept for up to 13 months after your last visit) to count visits and see which pages are read. Wherever you are, a banner asks first, and Google Analytics does not load, and sets no cookies, until you press Accept. We use Google Analytics for measurement only, with Google signals and ad personalization turned off. We do not use it for advertising, and we do not combine it with information that identifies you by name.
• Your cookie choice. The Site remembers whether you accepted or declined in your browser's local storage, so you are not asked on every page. This is strictly necessary to respect your choice and needs no consent.
• Strictly necessary cookies. A cookie is set only for Ally and her team when they sign in to edit the Site. Visitors do not receive it.
• Video cookies. YouTube may set cookies once you press play on a video (see section 5).

Changing your mind. Saying no is as easy as saying yes. Select Cookie Settings at the bottom of any page and press Decline. We then delete the Google Analytics cookies the Site set and stop loading Google Analytics. Your browser settings let you block or delete cookies too. The Site works fully if you decline.

Browser signals. If your browser sends a Global Privacy Control signal, we treat it as Decline: Google Analytics does not load and no banner appears, though you can still choose Accept under Cookie Settings. It counts as a request to opt out of any sale or sharing of personal information too, which we do not do in the first place. There is no common industry standard for Do Not Track signals, so the Site does not respond to them separately.

7. How long we keep it

We keep proposals and related correspondence for as long as we need them to respond to you, to carry out and document any engagement, and to meet our legal, tax, and accounting obligations. We review proposals every quarter and delete those that did not lead to an engagement once two years have passed since our last contact. Google Analytics data is kept for no longer than 14 months. Our email delivery provider keeps copies of the notification emails that carry your proposal for 30 days, and the request logs our hosting provider makes available to us are kept for no more than 30 days. When we no longer need information, we delete it or make it anonymous.

8. How we protect it

The Site is served only over an encrypted (HTTPS) connection. Access to proposals is limited to Ally and the people who help her run her business, and our service providers are required to keep information secure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities when the law requires it.

9. International transfers

We are based in the United States and the United Kingdom, and our service providers may process information in the United States and other countries. When we transfer personal information out of the UK, the European Economic Area, or Switzerland, we rely on an adequacy decision or on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as offered by our providers.

10. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and receive a copy of it
• correct information that is inaccurate or incomplete
• have your information deleted
• receive your information in a portable format
• object to, or ask us to restrict, how we use your information
• withdraw consent at any time, where we rely on consent, without affecting what we did before
• opt out of the sale or sharing of personal information and of targeted advertising (we do neither)
• not be treated differently for exercising any of these rights

To make a request, email hello@allyiseman.com with the subject line "Privacy request." We may need to confirm your identity before we act on it, and we will respond within the time the law requires, within one month for requests under UK or EU law, and within 45 days for requests under US state law, extended only where the law permits. You may use an authorized agent, and we may ask for proof that the agent acts for you.

If we decline your request, you may appeal by replying to our decision with the subject line "Privacy appeal," and we will answer within the time the law requires. If you remain unsatisfied, you may contact your state attorney general.

If you are in the UK, you have the right to complain to the Information Commissioner's Office. If you are in the European Economic Area, you may complain to your local data protection authority. We would welcome the chance to address your concern first.

11. California residents

In the past 12 months we have collected the following categories of personal information described in the California Consumer Privacy Act: identifiers (such as name, email address, and IP address), professional or employment-related information (such as organization and role), commercial information (such as the details of a proposed engagement), and internet or other network activity (such as pages viewed). We collect them from you and from your device, for the purposes described in section 3, and disclose them only to the service providers listed in section 4, and to Substack when you subscribe to the newsletter. We have not sold or shared personal information, as those terms are defined in California law, and we have no actual knowledge of selling or sharing the information of anyone under 16. We do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit it.

Under California's "Shine the Light" law, California residents may ask whether we have disclosed personal information to third parties for their own direct marketing. We have not.

12. Children

The Site is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make a material change, we will post a prominent notice on the Site, and where the law requires it, we will ask for your consent.

14. Contact

Kavanos LLC, attention: Privacy, Los Angeles, California, United States. Email hello@allyiseman.com.