Privacy Policy

1. Purpose and scope

This Privacy Policy explains how Ardenloft Method handles personal information in connection with this website, business enquiries and remote AI consulting engagements. We provide workflow assessment, tool selection guidance, adoption planning, AI output review procedures and initial consultations. The policy covers information associated with these activities and explains the choices and rights that may be available to you.

Ardenloft Method is responsible for personal information it collects for its own business purposes. Third-party platforms and tools may have separate responsibilities and privacy terms. The address, email and phone number at the end of this policy can be used for privacy questions or requests. This policy does not represent that every visitor has identical rights under every privacy law; applicable rights depend on jurisdiction and whether the relevant law applies to the business or processing activity.

2. Information entered in the current website form

The current project request interface asks for a name, business name, email address, phone number, selected service, a description of the request and permission to be contacted. In this version, the form validates these fields in the browser and displays an on-page confirmation. It does not send the completed fields to Ardenloft Method, take payment or write the entered request into a business database.

The request information remains in the page while you complete the form and is reset after the confirmation is shown. The form does not add the information to cookies, local storage or session storage. Browser features such as autofill, saved form entries, screenshots or extensions are controlled by your browser and device rather than by Ardenloft Method. A confirmation message is not evidence that a consultant has received the request. If server-side collection is added, the privacy notice and collection arrangements will be updated before that version is used.

3. Information provided through other communications

If you contact us through an agreed communication channel, arrange a consultation or enter a consulting agreement, we may receive your name, business role, contact details, enquiry content, project requirements, correspondence and documents you choose to provide. Project administration may also involve an accepted proposal, delivery information, billing contact details, payment status and records needed for accounting or legal obligations.

Please share only information relevant to the task. Avoid sending passwords, private access keys, full payment-card numbers, government identification numbers, health information or other sensitive personal data in an initial enquiry. Where a project genuinely requires personal information, the parties should agree on a suitable secure channel, a lawful basis and the minimum information needed before it is shared. Redacted examples and non-identifying process descriptions are preferable whenever they meet the project’s needs.

4. Technical website information

The website is intended to operate on Shopify. Hosting and platform systems may process technical information needed to provide the page, maintain security and respond to network requests. This can include an IP address, browser and device characteristics, requested page, referring address, request timestamps and technical logs. The precise information and cookie behaviour depend on the live storefront, its platform settings and any installed apps.

The supplied custom website sections do not add a separate advertising pixel, third-party analytics tag or behavioural profiling service. They include visual animation, navigation, a testimonial slider and browser-side form validation. Fonts can be served within the section code, and visual assets are served through the storefront’s uploaded files. Platform-level features or apps can still process data independently of those custom sections. Our Cookie Policy explains these distinctions and the choices available through the live site and your browser.

5. Purposes for handling information

Where information is actually received, we use it to understand an enquiry, discuss a possible engagement, prepare and perform an agreed service, deliver recommendations, answer questions, manage correspondence and maintain reasonable business records. Information may also be needed to issue invoices, reconcile payments, resolve a concern, protect systems, investigate misuse or meet a legal obligation.

We do not require unrelated personal information to provide an initial discussion. Contact details supplied for a project are used for project-related communication. They are not automatically treated as consent to promotional messaging. If we introduce an optional mailing list or similar activity, it will have an appropriate notice and choice. We do not represent that browser-side form entries have been received or are used for these business purposes when the form has not transmitted them.

6. Legal bases where applicable

Where a law requires a legal basis for processing, the basis may be steps requested before entering an agreement, performance of an agreement, compliance with a legal obligation, a legitimate interest assessed against the individual’s rights, or consent where consent is necessary. For example, discussing a requested consultation may support pre-contractual steps, while maintaining required accounting records may support a legal obligation.

Consent is used where required for a particular optional activity and can be withdrawn for that activity. Withdrawal does not make earlier lawful processing unlawful and does not prevent processing that has a separate valid basis. We will not assume that accepting general website terms supplies every consent that a specific privacy or electronic-communications law may require.

7. Service providers and disclosure

We may use providers that support website hosting, business email, remote meetings, document delivery, accounting, secure storage or payment administration when those providers are needed for the actual engagement. A provider should receive only information relevant to its role and be subject to suitable contractual and security arrangements. We do not list a particular meeting, storage or payment provider as being in use unless it has actually been selected.

Information may be disclosed when required by a valid legal process, to protect lawful rights or security, or in connection with a legitimate business reorganisation subject to appropriate safeguards. We do not sell personal information obtained for consulting enquiries. The supplied custom sections do not perform targeted advertising or disclose form entries to advertising partners. If platform apps introduce additional sharing, the live privacy and cookie settings must accurately reflect that activity.

8. AI tools and project materials

Our services concern AI tools, but consulting about a tool does not automatically authorise uploading client information into it. Before a project involves use of a third-party AI service with client materials, we discuss the proposed use, the information involved, relevant provider terms and any necessary authorisation. Where possible, we use redacted or non-identifying examples.

Do not assume that all AI providers offer the same confidentiality, retention, training or geographic processing options. Appropriate settings depend on the selected service and plan. You remain responsible for having a lawful basis to share information about your staff, customers or other individuals. Where we process personal data solely on a client’s documented instructions, the parties should agree on the relevant data-processing terms and responsibilities before the processing begins.

9. Retention and deletion

We keep information actually received only for as long as reasonably needed for the purpose for which it was collected, the agreed engagement, legitimate business administration or applicable legal obligations. Retention depends on the record type. An unanswered enquiry does not require the same retention as an accepted agreement, invoice, delivery record or unresolved dispute.

Project materials should be removed or returned when they are no longer required, subject to an agreed retention arrangement and lawful obligations. We may need to retain limited information for accounting, security, legal claims or evidence of compliance. Backups may take additional time to expire under a normal backup cycle, and access to information retained for a limited purpose should be restricted. The current browser-side form does not create a retained server-side request record.

10. Security

We use reasonable organisational and technical precautions appropriate to the information and the way it is handled. These can include access controls, limited sharing, suitable provider settings and secure transmission channels when they are needed. We aim to minimise the amount of personal information required for a project and avoid unnecessary collection of sensitive details.

No website, email service or online storage system can be guaranteed completely secure. You should also protect your devices and avoid sharing access credentials through ordinary enquiry channels. If a security incident involving personal information creates a notification obligation, we will respond in accordance with the requirements that apply to the incident. This policy is not a promise that a particular security certification or audit has been obtained.

11. International processing

Remote communications and third-party platforms can involve processing in locations other than where you live. The relevant locations depend on the service provider, account settings and the agreed engagement. We do not promise that all website or consulting data stays within a particular country solely because the business has a Kentucky mailing address.

Where applicable law restricts an international transfer, appropriate arrangements must be used before the transfer occurs. These may include recognised transfer mechanisms, contractual safeguards or another legally available basis. You may contact us for information relevant to a specific engagement and the providers actually used for it.

12. Your choices and privacy rights

Depending on the law that applies, you may be able to request access to personal information, correction of inaccurate information, deletion, a copy in a portable format, restriction of processing, objection to certain processing, withdrawal of consent or an opt-out from defined advertising or sale-related activities. Some rights apply only when statutory conditions are met. Certain business, legal, security or accounting records may be exempt from deletion or subject to a lawful retention requirement.

To make a request, use the contact details below and explain the information or activity involved. We may ask for proportionate information to confirm identity and prevent unauthorised disclosure. We will respond within the period required by the applicable law and explain a refusal or limitation where required. If a law provides an appeal process, you may ask us to review a decision using the same contact details. Where available, you may also contact the relevant privacy regulator. We do not discriminate against an individual for exercising applicable privacy rights.

13. Children, automated decisions and external services

The website and consulting services are intended for adults and businesses, not children. We do not knowingly request children’s personal information for these services. If you believe a child has provided personal information through another communication channel, contact us so the situation can be assessed and the information handled appropriately.

The custom request interface does not make automated decisions with legal or similarly significant effects. Selecting a service or showing a confirmation is an interface function, not a suitability or credit decision. Any third-party tools discussed in an engagement operate under their own terms and notices. Their processing should be reviewed before you adopt them; a recommendation is not a substitute for checking their current data practices.

14. Updates and questions

We may update this policy to reflect changes in the website, providers, services or applicable requirements. The last updated date identifies the current version. A material change to collection should be explained at the point where information is requested, and consent will be sought where required. Please contact us if you need clarification about information actually received, a planned engagement or a privacy request.