Privacy Policy.

Inquiries you submit. When you use the contact form, we collect the name, email address, optional company name, and message you provide. We use that information to reply to you and, where appropriate, to continue a sales or engagement conversation.

Calls you book. When you book a call with the scheduler on our contact page, we collect your name, email address, the time you choose and your time zone, whether you want a video call or a phone call, your phone number if you choose a phone call, a colleague’s email address if you add one, and any note. We use that information to book the call, to hold the call with you, and to follow up with you if a booking cannot be confirmed. Where it goes is described below.

Standard server logs. Our web server records routine technical information about each request — IP address, user-agent string, requested URL, timestamp, and HTTP status. This is used for security, abuse prevention, and operational diagnostics. Logs are not joined to inquiry data or used for advertising.

Notes on private engagement pages. Clients and counsel we work with can leave signed notes on the access-controlled pages we share with them. We record the name entered, the date and time, and the text of the note; each note is delivered to our internal Slack so we can follow up. Those pages are not part of the public site, and nothing there is collected from ordinary visitors.

Aggregate traffic analytics. We use Google Analytics on the public pages of this site to count traffic — how many people reached which page, what referred them, and the general device and region the request came from. It sets a cookie so a returning visitor is not counted twice. It also records, as a bare count, that a call was booked or a contact form was sent from a page. That count carries no name, email address, message or booking detail. We read all of it in aggregate, to learn which pages do their job. We do not use it to build a profile of you, we have not connected it to any advertising product, and the private pages we share with clients and counsel are excluded from it entirely.

Mobile numbers for our texts. If you agree to get our texts, we keep your mobile number and the texts. The text messages section below says what we keep and why.

What we do not collect. No advertising or remarketing pixels. No session recording, no heatmaps, no scroll-replay. No fingerprinting. No data brokers, and no audience lists sold or shared with anyone. We do not attempt to identify an individual visitor from analytics, and nothing in it is joined to your inquiry, your intake responses, or anything in an engagement.

Two more cookies, and neither is about you. When Floburn personnel sign in to the site’s private administrative area, that sign-in sets a single authentication cookie so they stay signed in. And when a client or counsel we work with opens a private page with the passkey we sent them, that unlock sets a single cookie scoped to that page so they are not asked for the passkey again for a week. Both do nothing on any public page, and neither tracks anyone.

Inquiry submissions are delivered to our internal Slack workspace so the team sees them in real time, and to our Google Workspace email account so they can be replied to. Once an inquiry becomes an active conversation, the relevant details are entered into Agent Floburn, our internal application for keeping track of inquiries and client relationships. Agent Floburn is operated by Floburn Inc; it is not a third-party service.

If you book a call with the scheduler on our contact page, our server sends what you enter there to Cal.com, Inc., the scheduling service we use, to create the booking: your name, email address, the time you chose and your time zone, whether you chose a video call or a phone call, your phone number if you chose a phone call, a colleague’s email address if you add one, and any note. Cal.com holds the booking and emails the confirmation under its own published privacy practices, and the booking is delivered to us. If something goes wrong between our server and Cal.com, online booking is paused for the day, or our spam check stops the booking, our server keeps a record of the attempt, with those details, so we can follow up with you; it is kept as an inquiry is. When the problem is between our server and Cal.com, the attempt is also sent to our internal Slack, like a contact-form inquiry. Cal.com’s own embedded scheduler appears only on some of the private pages we share with clients. There, what you enter goes to Cal.com directly, and the scheduler may set cookies of its own, under Cal.com’s practices rather than ours.

Some of the private pages we share carry a video hosted on YouTube. Nothing on the page contacts YouTube until you press play. The video then plays from YouTube’s privacy-enhanced service (youtube-nocookie.com), operated by Google, which may store information on your device under Google’s practices rather than ours.

We do not sell, rent, or share inquiry data with advertisers, data brokers, or marketing partners. We do not share it with other clients. We use it to talk to you, and to remember the conversation.

The vendors we rely on to receive and route this information — Slack Technologies (Salesforce), Google Workspace, Cal.com for scheduling, and Twilio for text messages — each maintain their own published privacy practices and security commitments under their standard business terms.

What we collect. Floburn Inc. sends the Floburn MicroForensics sign-off texts. They are sample texts for a MicroForensics demonstration, or for testing MicroForensics while we set it up with a client. You get them if you choose OK on our offer letter or our engagement letter, or if someone who signs either letter lists you. In each case, we collect the mobile number and the record of when and how its owner agreed. We also keep the texts we send, any replies, and whether each text was delivered.

Why. Only to send the texts that person agreed to, to honor STOP and HELP replies, and to keep a record of what was sent. What the texts are for, how often they come, and how to stop them are on our text message terms page.

Who sees it. Texts are delivered by Twilio Inc., the messaging service we use, under its own published privacy practices. Floburn staff who run the demonstration or the test see the numbers, the texts and the replies.

Never for marketing. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

How long. A demonstration’s texts, and the numbers in our texting service, are deleted within 30 days of the demonstration, or of the last test, at Floburn and at Twilio. The signed letter keeps your OK or No and the number you gave, as the record of when you agreed. It also keeps the name and number of each person you listed, as the record that you confirmed they agreed. We keep the record of any STOP reply for four years.

On this website, nothing. Nothing you submit here — a contact-form inquiry, a note on a private engagement page, a booking — is read, sorted, or answered by an AI model. People read it.

In the MicroForensics service, your payroll and timekeeping records are handled by ordinary code. The software that collects, stores and seals a client’s payroll and timekeeping records is ordinary deterministic code. No AI model sits in that path: None decides what a record says, none decides whether a rule was broken, and none changes anything in the record.

Where we do use it. At the edges of the service: to draft plain-language text for a person to edit, to translate worker-facing text for a person to check, and to sort exceptions for a person to review. Every such call is logged with what went in and what came out, and only the content the task needs is sent. The providers are commercial AI services engaged under business terms; they process that content on our instructions, and we do not permit them to train on it. We use no client data to train anything ourselves.

A client’s choices. A client can ask for any AI-drafted text to be reviewed by a person, or ask that no AI model be used on its engagement at all. Both are written into our engagement agreements, and where a client’s contract sets an option, that contract governs.

Inquiry records are retained for two years from the date of last contact, after which they are deleted from our internal systems. If a conversation becomes an active engagement, the retention clock resets to the date the engagement ends; we keep records of completed engagements for the period required by our contract, our tax and accounting obligations, and any applicable legal or regulatory hold.

Notes left on private engagement pages follow the engagement rather than the inquiry clock: They are kept while the engagement’s records are kept, and deleted with them. A commenter can ask us to delete a note at any time.

Server logs are retained for a short operational window (typically 30 to 90 days) and then rotated.

You can ask us, at any time, to tell you what we have on file about you, correct anything that is wrong, or delete it. Email hello@floburn.com and we will respond within thirty days. We will not retaliate for any privacy request and we do not require an account or payment to make one.

If you are a California resident, you have the rights described in the California Consumer Privacy Act, as amended by the California Privacy Rights Act — including the right to know, to delete, to correct, and to limit use of sensitive personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, so there is no opt-out signal to honor; we honor Global Privacy Control headers as a confirmation of that posture.

If you are in the European Economic Area or the United Kingdom, you have the rights described in the General Data Protection Regulation and the UK GDPR, including access, rectification, erasure, restriction, portability, and objection. Our lawful basis for processing inquiry data is the legitimate interest of responding to a business inquiry you initiated, and your consent where consent applies.

Floburn.com is served over HTTPS. Inquiry submissions are transmitted over TLS to Slack and Google Workspace, both of which encrypt data in transit and at rest under their standard terms. Access to internal systems is limited to Floburn personnel with a business need.

No system is perfectly secure. We will notify affected individuals and the appropriate authorities of a confirmed personal-data breach in accordance with applicable law.

Floburn provides services to businesses. Through floburn.com, we do not knowingly collect personal information from anyone under sixteen. A worker’s information that reaches us from their employer is part of the employer’s records, handled under the employer’s contract with us. If you believe a minor has submitted information through floburn.com, email hello@floburn.com and we will delete it.

If we update this policy, we will change the “Last updated” date at the top and, for material changes, post a notice on the homepage for a reasonable period. Continued use of the site after a change indicates acceptance of the updated policy.

Questions, requests, or complaints about this policy or our handling of your information:

Floburn Inc
hello@floburn.com

If you are not satisfied with our response, EEA and UK residents may lodge a complaint with their local data protection authority; California residents may contact the California Privacy Protection Agency.