- Home
- Privacy policy
Legal
Privacy policy.
What this site collects, why it collects it, how to switch it off, and how to make us delete it. It is short because the site does very little.
We, The Intentional Company, a consulting and coaching practice operating from the State of Georgia in the United States, understand that your privacy is important to you. We are committed to respecting it and to protecting the personal data you entrust to us.
This privacy notice describes how we handle and protect your personal data (the “Privacy Notice”) when we collect it through theintentional.co and any related digital assets (collectively, our “Sites”), and through our externally facing business activities, such as inquiries, the newsletter, and the correspondence that follows from them, when we interact with you and collect data from you for use by and on behalf of The Intentional Company. In the language of data protection law, this notice covers the situations in which we act as the data controller: where we, rather than somebody else, decide why and how your personal data is used.
Depending on the nature of your relationship with us, a different agreement may govern instead:
- If you are a client, the engagement contract we signed with you governs the information gathered in the course of that engagement. Where that contract says something different about confidentiality or data handling, the contract governs that engagement.
- If you are an employee of a client, we may receive your personal data from your employer rather than from you. Our use of it is governed by our agreement with your employer.
- If you are a service provider to us, or an employee of one, the agreement between us governs.
We have no subsidiaries or affiliates. There is no other entity behind this one, and nobody else is collecting on our behalf.
Please note that the rules and regulations implementing various data privacy laws continue to change. We work to keep up with them, and we update our processes, our disclosures, and this notice as those rules settle. The effective date at the top of this page tells you when we last did.
For the purposes of this Privacy Notice, personal data means information about an identified or identifiable individual, and does not include information that cannot be attributed to an identifiable individual, such as aggregate counts or information of an anonymous nature (collectively, anonymous data). Most of what this site collects is anonymous data.
You are not required to share your personal data with us. Failing to do so may mean we cannot reply to you, send you the newsletter you asked for, or scope a piece of work — but nothing on this site is gated behind giving us information, and there is no part of it you have to identify yourself to read.
By accessing our Sites, or taking part in the activities described above, you confirm that you have read and understood the terms of this Privacy Notice. If you do not understand or agree with any part of it, please contact us at privacy@theintentional.co for clarification before proceeding, and we will explain it or answer the question directly.
If you are a California resident, or a resident of any other state or country with a privacy statute of its own, see your rights below. Rather than offer rights only where a law compels them, we extend the same set to everyone, wherever you are.
Who we are
The Intentional Company is a consulting and coaching practice operating from the State of Georgia in the United States. This policy covers theintentional.co and the forms on it. It does not cover the separate agreements that govern a client engagement. Where an engagement contract says something different about confidentiality or data handling, the contract governs that engagement.
What we collect
Only what you type. There are exactly two places on this site that send anything anywhere.
The contact form
- Email address. Required, because a reply has to go somewhere.
- Message. Required. Whatever you choose to tell us.
- First and last name, company. Optional. Leave them blank and the form still sends.
- Interest and timeline. Two dropdown selections, so the reply is relevant.
The newsletter signup
- Email address. That is the entire form. No name, no company, no segmentation questions.
Collected automatically
Google Analytics 4 runs on this site. What it reports back to us is aggregate and does not identify you:
- Pages viewed, and the order you viewed them in.
- Session duration, meaning roughly how long a visit lasted.
- Approximate region, derived from IP address at about the level of a country or a metro area. We never see the IP address itself: Google discards it rather than passing it to us or storing it.
- Referral source, meaning the search engine, link, or post you arrived from.
- Device basics, meaning browser, operating system, and whether the screen is a phone or a desktop.
- A few interactions: which call-to-action button was clicked, how far down a page you scrolled, and clicks on links leaving this site. These tell us which pages are read and which are abandoned halfway. They are counted, not attached to a person.
We cannot see who you are from any of this. There is no user ID, no cross-site tracking, no Google Signals, and no advertising features turned on. We look at it in aggregate to work out which pages are worth keeping. If you reject analytics, or your browser sends a Global Privacy Control signal, none of it is collected. See your choices.
Region detection
Because the site is a set of static files with no server logic of its own, working out whether you are in the European Economic Area or the UK, and therefore whether you get a consent banner, requires one lookup from your browser to a geolocation service. That service sees your IP address and returns a two-letter country code. It returns nothing else, we store nothing but the country code, and we cache it in your browser for twenty four hours so it is not asked again on every page. The providers are named under who else touches it.
Server logs
Our hosting provider keeps standard server logs, which include the IP address of the requesting device, the pages requested, and timestamps. These are ordinary web server records used to keep the site running and to investigate abuse. We do not build profiles from them, join them to form submissions or to analytics, or use them for marketing.
Why we collect it
- To answer you. Contact form details are used to reply to your inquiry and, if it goes further, to scope a possible engagement.
- To send the newsletter. Your email is used to send the newsletter you asked for, and for nothing else.
- To see which pages earn their place. Analytics tells us which pages get read and which get abandoned, so the next thing written is closer to what someone actually wanted. That is the whole use. It does not feed advertising, scoring, or a sales list.
- To keep the site working. Server logs support availability, security, and troubleshooting.
We do not sell personal information. We do not share it with advertisers, data brokers, or partners. We do not use it to train machine learning models. If any of that ever changes, this policy changes first and the change is dated at the top.
Who else touches it
A short list, and it is the whole list. Each has its own privacy policy.
- Web3Forms receives contact form submissions and relays them to our email. See the Web3Forms privacy policy.
- Kit, formerly ConvertKit, stores newsletter subscriptions and sends the newsletter. See the Kit privacy policy.
- Cal.com handles call bookings. When you book a first call, it receives the details you enter on the booking page and adds the call to our calendar. See the Cal.com privacy policy.
- Google provides Google Analytics 4 and processes the page view data described above. Advertising features, Google Signals, and ad personalisation are all switched off on our property, so the data is not used to build advertising audiences. See the Google privacy policy and how Google uses data from sites that use its services.
- GeoJS, and as fallbacks ipapi.co and ipwho.is, answer the single country-code lookup described above. Whichever one answers sees your IP address in the course of answering. We ask for the country field only, we receive nothing else, and the lookup does not run at all if your browser sends a Global Privacy Control signal.
Beyond those two, our email provider and our hosting provider necessarily handle the data in transit and at rest. We may also disclose information where the law requires it, which has not happened to date.
Cookie policy
Everything this site stores in your browser, by category. These are the same three categories as the toggles in the cookie preference center, and the two are kept deliberately in step: if a row appears here it appears there, and the other way round. Nothing is left off, including the entries that are technically browser storage rather than cookies.
There is no session recording, no heat mapping, no fingerprinting, and no tracking pixel of any kind. Open your browser tools on any page here and check the list against what you find.
Necessary
Always on. These exist so the site can honour the choice you made, and there is no version of the site that works without them. They are first-party, they never leave your browser, and no third party can read them.
| Name | Type | Expires | What it is for |
|---|---|---|---|
ic_consent_v1 | Local storage | 12 months | Your cookie choice and the date you made it. Without it we would ask again on every page. The date is what makes the choice expire after twelve months rather than standing forever. |
ic_geo_v1 | Local storage | 24 hours | The two-letter country code from the region lookup, so the lookup runs once a day instead of once a page. No IP address, no city, no coordinates. |
Analytics
On by default outside the European Economic Area and the UK, which is the opt-out model those jurisdictions use. Off by default inside them until you accept. Off entirely, everywhere, if your browser sends Global Privacy Control. Set by Google Analytics 4.
| Name | Type | Expires | What it is for |
|---|---|---|---|
_ga | Cookie | 13 months | Tells one browser apart from another so two visits from you are not counted as two people. A random number, not a name. Google's own default for this is two years; we set it to thirteen months, which is the shorter period European regulators treat as reasonable. |
_ga_YPKR242GT6 | Cookie | 13 months | The same thing, scoped to this specific property, and it holds the session state so a visit is not counted twice while you read three pages. |
If you decline analytics, neither cookie is written. Google Analytics remains loaded but is held in a consent-denied state, which means it sets nothing and stores nothing. The page-level interaction events described above are held back entirely rather than sent in anonymised form.
Advertising — not currently active
Nothing in this category runs on this site today. No advertising platform is connected to it, no ad account is live, and no cookie or pixel in this category is written for any visitor in any region. The toggle exists in the preference center so the control is already there, already working, and already respecting a decision you made earlier, on the day advertising does start.
If that changes, this section gets the cookie names and this policy's effective date changes with it, before the first ad runs rather than after. Advertising consent signals are currently forced to denied for every visitor regardless of what is ticked, so accepting all today does not quietly pre-authorise something for later.
Your choices
Three ways to turn analytics off, in rough order of how little effort they take.
- Global Privacy Control. If your browser sends a GPC signal, this site reads it on every page load and switches analytics and advertising off before anything is set. You do not have to click anything, and no banner appears to ask. Brave and the DuckDuckGo browser send it by default; Firefox has it in settings. This is how we honour CCPA and CPRA-style opt-outs without putting a popup in front of every American visitor.
- Cookie preferences. There is a "Cookie preferences" control in the footer of every page on this site. It opens the same preference center the banner opens, it works whether or not you ever saw a banner, and it works as many times as you like. You do not have to clear cookies by hand to change your mind.
- Google's own opt-out. The Google Analytics opt-out browser add-on blocks Google Analytics across every site you visit, not just this one.
Blocking scripts in your browser, or an ad blocker, also works. Nothing on this site breaks when analytics is blocked, because nothing here depends on it.
If you are in the European Economic Area or the UK, analytics stays off until you accept, and you are asked once with a banner. Your answer is stored for twelve months, after which we ask again rather than assuming the answer still holds. Everywhere else, analytics is on unless you turn it off, which is the standard the law in those places sets.
How long we keep it
- Enquiries that do not become engagements. Kept for up to twenty four months, then deleted.
- Enquiries that become engagements. Kept for the life of the engagement and for seven years after it ends, which is the ordinary retention period for business and tax records.
- Newsletter subscriptions. Kept until you unsubscribe. Every issue carries a one click unsubscribe link, and unsubscribing removes you from the list rather than suppressing you on it.
- Analytics. Event and user-level data is kept for fourteen months, which is the shortest retention Google Analytics 4 offers beyond two months, and then deleted automatically. Aggregate reports, meaning counts with nothing underneath them, persist longer inside Google's reporting. The
_gacookies in your own browser expire after thirteen months. - Cookie choices. Your decision is stored in your browser for twelve months and then expires, at which point you are asked again. It is stored on your device only; we never receive a copy.
- Server logs. Retained on our host's standard schedule, typically no more than thirty days.
Your rights
Georgia has no comprehensive consumer privacy statute at the time of writing. Rather than offer rights only to the residents of states and countries that mandate them, we extend the same set to everyone who contacts us, wherever you are.
- Access. Ask what we hold about you and we will tell you.
- Correction. Ask us to fix anything inaccurate.
- Deletion. Ask us to delete it, and we will, except where a record must be kept for tax or legal reasons.
- Portability. Ask for a copy in a common format.
- Objection. Ask us to stop using it, including opting out of the newsletter at any time.
Email privacy@theintentional.co with the request. We reply within thirty days, usually within two working days. There is no charge, and there is no form to fill in. If you are in the European Economic Area or the United Kingdom, you also have the right to complain to your supervisory authority.
Security
The site is served over HTTPS, so form submissions are encrypted in transit. Access to the inbox and the newsletter account is protected by strong, unique credentials and multi factor authentication. Client information gathered during an engagement is held under the confidentiality terms of that engagement, on a need to know basis.
No system is perfect, and claiming otherwise would be the kind of sentence this practice exists to argue against. If we ever learn of a breach affecting your information, we will tell you and the relevant authority without undue delay.
Children
This site and this practice are for adults in a professional context. We do not knowingly collect information from anyone under sixteen. If you believe a child has submitted information here, email us and it will be deleted.
Changes to this policy
When this policy changes, the effective date at the top changes with it. Material changes, meaning anything that widens what we collect or who receives it, are recorded in the list below and stay there. We do not backdate revisions, and we do not quietly retitle an old policy as a new one.
- 29 September 2026. Cal.com was added as the booking tool for first calls. This is a material change because it adds a recipient: if you book a call, Cal.com receives the details you enter on the booking page. Nothing changes if you don't book. The list of service providers above names it.
- 11 September 2026. Google Analytics 4 was added to the site, which until then ran no analytics at all. This is a material change: it introduced the first cookies this site has ever set. It brought no advertising, no pixel, no session recording, and nothing that identifies you by name. The cookie policy lists exactly what it sets, and your choices covers how to switch it off.
How to reach us
Questions about this policy, or any request about your information, go to privacy@theintentional.co. That address is monitored by both founders, not a ticketing system and not an unread alias. A postal address is available on request for formal correspondence.
This policy is governed by the laws of the State of Georgia, United States, without regard to conflict of law principles.