Privacy Policy

This policy explains how Jade Operating Co. LLC, a Wyoming limited liability company ("we", "us"), handles personal information collected through this website, jadeandlloyd.com. It does not cover the services we provide to clients under contract, which are governed by that engagement's own agreement — except for the Google account connection described under "Connecting a Google account" below, which this policy covers.

For any privacy question, or to exercise the rights described below, contact us at privacy@jadeandlloyd.com.

We keep collection deliberately small. For each thing we collect, here is the purpose and our legal basis under the GDPR:

• Your email address, if you join our notify list, so we can tell you once when we open more widely. Basis: your consent, which you can withdraw at any time.
• The details you submit if you apply to work with us, such as your name, email, and a few questions about your business. We process this to evaluate and respond to your inquiry, and we store it in our own customer-records system. Basis: steps taken at your request before any engagement.
• Your email address for follow-up and our newsletter, if you apply or inquire about working with us. We send a short follow-up series about your inquiry and, afterwards, an occasional newsletter. Basis: our legitimate interest in following up and staying useful. You can opt out at any time, and one unsubscribe stops every email from us.
• Technical and security data, your IP address and basic request information, processed by our hosting and anti-abuse providers to keep the site available and prevent spam and abuse. We do not store your IP address in our own application logs. Basis: our legitimate interest in operating a secure site.
• Usage analytics, to understand how the site is used, so we can improve it. In the EU, EEA, UK, and California we ask for your consent first (basis: consent); elsewhere in the United States it runs on a notice-and-opt-out basis, and you can opt out at any time, including via Global Privacy Control. We use no session recording, our analytics builds no advertising profiles, and we instruct our provider to discard your IP address.

If you use our platform — our operations console — you can connect your own Google account so the platform can act in it on your behalf. This section describes how we access, use, store, and share Google user data when you do, and it applies in addition to the rest of this policy. You can use the platform without connecting Google, and you can disconnect at any time.

Sending email. With your permission, we use Gmail's send-only capability to send individual business emails — such as a client snapshot or proposal, sometimes with a PDF attached — from your own mailbox, so the message appears in your Sent folder and threads with the recipient. We only ever send a message you have reviewed and approved in the platform; we never send automatically. We request the send-only permission and nothing more: we do not read, search, list, or modify any existing email in your mailbox.

Creating documents. With your permission, we use Google Drive's per-file capability to create documents — such as a review copy of a proposal — in your Drive. This permission lets our application access only the files it creates; we cannot see, open, or change any of your other Drive files.

What we store. The only Google credential we retain is a token used to perform these actions, which we hold encrypted and which you can revoke at any time, either from within the platform or from your Google account's security settings. We also store the email address of the connected account as a label, so you can see which account is connected. We do not copy, store, or retain the contents of your mailbox or your Drive.

How we use it, and what we don't. We use Google user data only to provide these features to you. We do not sell it, use it for advertising, use it to train generalized artificial-intelligence or machine-learning models, or let anyone read it except where you direct us to, where you give consent, where needed for security, or where required by law. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies are small files a site stores on your device. We use a minimal set, in two groups. Strictly necessary cookies keep the site working and secure and cannot be switched off. Analytics cookies are optional. In regions where we ask for consent they are set only after you accept, and elsewhere you can opt out at any time. We use no advertising or marketing cookies.

The strictly-necessary group covers a cookie that remembers your privacy choices, and short-lived storage our anti-abuse provider may set to confirm a form submission is human. If you start our application form, your answers are saved in your browser's own storage so you can finish later on the same device; they never leave your device through that storage, are removed when you submit, and expire on their own within seven days. The analytics group covers optional product-analytics cookies, set only with your consent. We also measure traffic with a cookieless tool that stores nothing on your device, and the rate-limiting that protects our forms runs on our servers using no cookies.

Managing your choices. You can change your choice at any time from the "Manage cookies" or "Your Privacy Choices" link in the footer. In regions where we ask for consent first (the EU, EEA, UK, and California), a banner offers the choice on your first visit and we set no optional cookies until you accept. Elsewhere in the United States, analytics runs with an opt-out available, and we honor the Global Privacy Control browser signal as an opt-out. You can also block or delete cookies in your browser settings, though some essential features may then not work. Declining analytics never limits your access to the site.

We do not sell your personal information, we do not share it for cross-context behavioral or targeted advertising, and we do not disclose it to third parties for their own marketing. We disclose personal information only to the categories of service providers we rely on to run the site and respond to you, and only as needed for them to perform services for us under contract:

• Hosting and infrastructure providers, to run and secure the website and to host our own customer-records system, where inquiry and application details are stored.
• Email and communications providers, to manage the notify list, send the updates you ask for, and send our follow-up and newsletter emails.
• Scheduling and booking providers, if you book a call with us, to manage that scheduling.
• Security and anti-abuse providers, for rate-limiting and bot protection.
• Analytics providers, to measure site usage, subject to the choices described under Cookies above.

We may also disclose personal information where required by law, to comply with legal process, or to protect our rights, safety, or property. We will update these categories if our providers change. You can request more specific information about the providers in a category by contacting us at privacy@jadeandlloyd.com.

We are based in the United States. If you are in the EEA or UK and provide information to us, it will be transferred to and processed in the United States. Where our service providers process personal data outside the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum), and the EU–US Data Privacy Framework where a provider is certified under it.

We keep your notify-list email until you unsubscribe or ask us to delete it. We keep the application and inquiry details you send us, in our customer-records system, for as long as needed to evaluate and respond to your inquiry, then for up to twenty-four months after our last contact with you, after which we delete or anonymize them. Security data such as IP addresses is processed transiently and not stored in our application logs. Analytics data, where collected, is retained only as long as needed for the analysis and per the provider's settings.

If you are in the EEA or UK, you may request access to, or the correction, deletion, or restriction of, your personal information; object to certain processing; ask for data portability; and withdraw consent at any time (without affecting processing already carried out). You may also lodge a complaint with your local data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk).

If you are a California resident, you may request to know the categories and specific pieces of personal information we have collected, its sources, and the purposes; and you may request that we delete or correct it. You may opt out of any "sale" or "sharing" of your personal information, though we do neither, so there is nothing to opt out of. For California visitors we ask for your consent before setting optional analytics (the same prior-consent approach we use in the EEA and UK), and you can change that choice at any time from the "Your Privacy Choices" link in the footer; we also honor the Global Privacy Control browser signal as an opt-out, even if you previously allowed it. You also have the right not to be discriminated against for exercising these rights. We do not disclose personal information to third parties for their own direct marketing, so California's "Shine the Light" law requires no sharing disclosure from us.

To exercise any right, contact us at privacy@jadeandlloyd.com. We may need to verify your identity before acting on a request. You may also use an authorized agent to submit a request on your behalf; we may verify the agent's authority as well as your identity. We aim to respond within 45 days of a verified request; where a request is complex we may extend by up to a further 45 days and will let you know if we do.

This site and our services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We use reasonable technical and organizational measures to protect personal information, including access controls, encryption in transit, and provider-level safeguards. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may update this policy from time to time. The "last updated" date above reflects the current version, and we will post material changes on this page.

EEA/UK residents may also contact their local data protection authority; in the UK, the Information Commissioner's Office (ico.org.uk).