How we handle your information.

This policy covers hyphaeadvisory.com and the inquiries, calls, emails and text messages that come from it. Hyphae Advisory Inc. ("Hyphae Advisory", "we") is responsible for the personal information described here. Work we do for a client under a signed engagement is covered by that engagement's own terms.

Phone numbers and text messages

We do not share, sell, rent or transfer your mobile phone number or your text-message consent to third parties or affiliates for their marketing or promotional purposes. Text-message opt-in data and consent are never shared with anyone except the providers that deliver our messages, and only so they can deliver them.

We send text messages only if you check the box on our form agreeing to receive them. That box is optional and is never checked for you. Messages are about your inquiry and any calls you schedule with us: replies, scheduling and reminders. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. You can also opt out by email at [email protected]. We honor opt-out requests promptly and within ten business days at the latest. The full program terms are in our Terms.

When you opt in, we record the date and time, the wording you agreed to, your phone number, your name and the IP address the form was sent from, so that we can show when and how consent was given.

What we collect

What you type into our form. Name, work email, phone number, company, company website, your role, annual revenue band, industry, where your recent customers came from, and anything you add in the message field. We save what you type as you go, before you press the button, so that nothing is lost if you leave the page. A form you start but don't send is kept and may be followed up, as described below.

What you give us for a guide. When you download one of our guides: your first and last name, email and LinkedIn profile URL. We use them to email you the guide and may follow up once about it.

How you reached the form. The page whose button you clicked, the service you were reading about, the first page you visited on our site, the site that referred you, and any campaign tags in the link you followed (UTM parameters). This is stored in your browser and sent only with the form.

Technical information. Your IP address and basic request data, which our hosting and security providers process to deliver the site and block abuse.

Analytics, only if you allow it. If you choose "Allow" on our cookie notice, HubSpot's tracking code records the pages you visit and, once you give us your email, connects those visits to your contact record.

What you tell us later. Emails, calls, meeting notes and text messages exchanged with us.

We don't need sensitive information such as health or financial account details, and we ask you not to send it. Our site and services are meant for business owners and managers, not for anyone under 18.

Why we use it

• To reply to your inquiry, decide whether we can help, and arrange calls. The form's required fields are what we need to do that; without them we can't respond.
• To follow up once on a form you started but didn't send, by email or phone. If you checked the text-message box, we may also text you.
• To keep a record of our conversations with your company in our CRM.
• To understand which pages and campaigns bring useful inquiries, using the attribution fields above and, if you allowed it, HubSpot analytics.
• To keep the site secure and to meet legal obligations, including keeping proof of consent.

If you are in the European Economic Area or the United Kingdom, we rely on our legitimate interest in responding to business inquiries and running our business for the first, third and fifth uses, and on your consent for text messages and analytics cookies. You can withdraw consent at any time; doing so doesn't affect what was done before.

Who else handles it

We don't sell personal information, and we don't share it for cross-context behavioral advertising. These service providers process it for us, under contracts that limit them to providing their service:

• HubSpot, our CRM, which stores contact records and inquiry details, and runs the analytics described above if you allow it.
• Laravel Cloud, which hosts the website and its database.
• Cloudflare, which delivers the site and protects it from attacks.
• Our email and text-message providers, which deliver messages we send you.

If you ask about Data Advisory, we share your details with the data lab that licenses the records only after you agree to an introduction. We may also disclose information when the law requires it, to protect our rights, or to a buyer if our business is sold, in which case this policy continues to apply to it.

Where it is stored

Our providers store and process information in the United States and other countries where they operate, so it may be handled outside the province, state or country where you live, and may be accessible to courts and authorities there. For information about people in the European Economic Area and the United Kingdom, those transfers rely on the safeguards in our providers' data processing terms, such as the European Commission's Standard Contractual Clauses.

How long we keep it

• Inquiries, including forms that were started but not sent: up to three years after our last contact with you, unless you ask us to delete them sooner.
• Clients' records: for the length of the engagement and as long afterward as tax and contract law require.
• Proof of text-message consent and opt-outs: at least four years after the consent ends, because consent may need to be shown in a dispute.
• Analytics cookies: as set by HubSpot, up to 13 months; you can remove them at any time.

Cookies and similar technology

Two kinds are always on, because the site doesn't work without them: a session cookie and a security token that let the form submit safely (hyphae-website-session, XSRF-TOKEN), and Cloudflare's bot-protection cookie (__cf_bm). The site also keeps two small items in your browser's storage: an identifier that ties your form saves together, and the first-visit details described above. Neither identifies you to anyone until you send the form.

HubSpot's analytics cookies (such as __hstc, hubspotutk, __hssc and __hssrc) are off unless you choose "Allow." We also treat a Global Privacy Control signal from your browser as a "no." You can change your choice at any time with "Cookie settings" at the bottom of every page.

Your rights

You can ask us what information we hold about you and for a copy of it, ask us to correct it, ask us to delete it, withdraw consent, or object to how we use it. Depending on where you live (for example California and other US states, Canada, Quebec, the European Economic Area or the United Kingdom), you may have further rights, such as receiving your information in a portable format or limiting its use. We won't treat you differently for using any of these rights.

Send requests to [email protected]. We may ask you to confirm your identity, and we reply within 30 days. You can also complain to your data protection authority, such as the Office of the Privacy Commissioner of Canada, Quebec's Commission d'accès à l'information, or the authority in your EU country or the UK.

Security

Information travels over encrypted connections, access to our systems is limited to the people who need it, and our providers keep their own security programs. No system is perfectly secure; if a breach puts your information at real risk, we will tell you and the authorities as the law requires.

Who is responsible

The person in charge of protecting personal information at Hyphae Advisory is our Founder, reachable at [email protected]. Questions and complaints about this policy go to that person, who acknowledges them within five business days and answers within 30 days.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use information we already hold, we will tell you before it applies to that information.