Privacy policy.

Booking form. When you fill the booking form at /book, we collect the fields you fill in: name, work email, company name, phone, industry, team size, the service you are interested in, and any message you add. We also record the URL parameter that told us where you came from (for example source=home-hero) so we can attribute which page sent you. We store that submission in Supabase and forward it to our team by email.

Careers form. When you apply at /careers, we collect the fields you fill in: name, email, phone, school, expected graduation year, LinkedIn URL, area of interest, and anything you write in the application note. We store that submission in Supabase and forward it to our team by email.

Email. If you email us directly at cmyers@bsideadvisors.com, we collect whatever is in the email and whatever your email client sends along with it (usually your name, email address, and subject line).

Newsletter form. When you enter your email address into the B:Side Way signup form on this site, we relay that email to Substack so it can subscribe you to The B:Side Way. We do not retain a local copy of your email address after the relay succeeds.

Server logs. Our hosting provider (Vercel) keeps standard server logs for security and debugging. Logs include timestamps, IP addresses, and URLs requested. We do not combine these logs with form submissions to profile visitors.

Abuse-prevention data. To slow down spam and scripted form abuse, we store a hashed version of the submitting IP address in a separate rate-limit table. We use that hash only to enforce submission limits. We do not store the raw IP address in the form-submission tables.

Web analytics. We use Vercel Web Analytics for cookie-free page-view data and a small set of on-site events, such as clicks on booking and email calls-to-action and successful form submissions. Those events tell us which page the action happened on and which non-personal labels were attached to the action (for example service interest or CTA source). We do not send your name, email, phone number, or message body into analytics.

What we do not collect. This site does not run Google Analytics, Meta Pixel, LinkedIn Insight, or any advertising pixel. We do not set analytics cookies. We do not fingerprint your browser. We do not track you across sites.

We use your booking-form data to respond to you, schedule a scoping call, and send you a confirmation email. A senior advisor reads your submission. We do not run it through a lead-scoring system or sell it to anyone.

We use careers-form data to review apprenticeship applications, reply to candidates, and keep a record of past applications so we can evaluate fit over time.

Email you send to us is used to respond to the email. That is it.

Server logs are used for debugging outages, investigating security incidents, and keeping the site fast. They are not used for marketing analysis.

The hashed-IP rate-limit records are used to block form abuse. They are not used to identify you, enrich a profile, or track you across the web.

Web analytics are used to see which pages get read, which booking and email calls-to-action get clicked, and which services generate real inbound demand. We use that to improve the site, not to build ad audiences or follow you around the web.

Newsletter signup data is used for one thing: handing your email to Substack so it can add you to the B:Side Way mailing list and send the essays.

Resend. Booking-form submissions and careers-form submissions are sent to our team via Resend, a transactional-email provider. Resend sees the fields needed to deliver those emails for the time it takes to deliver them. Resend's privacy policy governs that transit.

Supabase. Form submissions and hashed-IP rate-limit records are stored in Supabase, our hosted Postgres provider. Supabase stores the form records so they are not dependent on inbox retention alone.

Vercel. The site is hosted on Vercel. Vercel sees standard HTTP request data (IP, user agent, URL) as any web host would. Vercel also processes the anonymous page-view and custom-event analytics described above. Vercel's privacy and security policies govern their side.

Substack. If you use the B:Side Way newsletter form on this site, your email address is passed to Substack. Substack runs the newsletter and processes that email under its Terms, Information Collection Notice, and Privacy Policy.

Nobody else. We do not share your data with marketing vendors, ad networks, data brokers, or affiliates. We do not sell your data. We do not use it to train AI models.

Booking-form submissions, careers-form submissions, and email correspondence are kept as long as your active conversation or candidate review with us, plus 24 months afterward for historical context on how we have worked with you.

Newsletter signup emails are passed through to Substack and are not stored locally by B:Side Advisors after a successful relay. Substack's own retention rules apply once it receives your email.

You can ask us to delete your data at any point. Email cmyers@bsideadvisors.com. We will confirm deletion within 30 days. Some records may survive in backups for another 30 to 90 days before they rotate out.

You can ask us to:

• Tell you what data we hold about you.
• Correct anything that is wrong.
• Delete your data.
• Export a copy of your data.
• Stop processing your data for any purpose other than responding to you.

Email cmyers@bsideadvisors.com. We will respond within 30 days. These rights apply regardless of whether the law in your jurisdiction requires them (GDPR, CCPA, or none of the above).

This site is not directed at children under 18 and we do not knowingly collect data from anyone under 18. If you believe we have received data from a minor in error, email us and we will delete it.

In transit. The site runs on HTTPS end-to-end. Form submissions are encrypted in transit to Vercel, then to Supabase and Resend. Newsletter signup emails are encrypted in transit to Vercel, then relayed to Substack over HTTPS.

At rest. Form submissions live in Supabase and in our internal review inboxes. Those systems are protected by their own access controls and provider security layers. The rate-limit records store only a hashed IP value, not the raw IP address. Newsletter signup emails are not written to Supabase by this site.

What we do not store. We do not store passwords, credit card numbers, social security numbers, bank account numbers, protected health information, or any other special-category data on the site. If your scoping call requires sharing sensitive data, we will move the conversation to a secure channel (encrypted email, signed portal, or in-person) before any of that changes hands.

If we update this policy, the "Last updated" date at the top will change. Material changes will be announced with a visible banner at the top of the site for at least 30 days. If a change would reduce your rights, we will notify you by email where we have your address.