Privacy & Cookie Policy

This Privacy & Cookie Policy explains how Thinking Bytes (“Thinking Bytes”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you visit thinking-bytes.com (the “Site”) or interact with us, and how we use cookies and similar technologies.

Thinking Bytes is a company incorporated in Massachusetts, United States. We are the data controller for personal data processed through the Site within the meaning of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA (“CCPA”).

1. Contact

• Legal name: Thinking Bytes
• Jurisdiction: Massachusetts, United States
• Privacy contact: privacy@thinking-bytes.com
• General contact: hello@thinking-bytes.com

2. Information we collect

2.1 Information you provide

• Contact form and email: name, email address, company, and the contents of your message when you contact us via the Site, email, or a booking link.
• Bookings and meetings: calendar availability, name, email, and meeting notes when you book a call via our scheduling provider.
• Marketing subscriptions: email address and preferences if you subscribe to our newsletter or updates.
• Client communications: information shared during engagements, including documents, credentials you choose to share, and project materials.

2.2 Information collected automatically

• Server and security logs: IP address, user-agent, referrer, request path, and timestamps — collected by our hosting and CDN provider (Cloudflare) for security, abuse prevention, and service delivery.
• Device and browser data: approximate location (derived from IP), browser type, operating system, screen size, and language.
• Cookies and similar technologies: see Section 9: Cookies for details. We do not set non-essential cookies without your consent where required by law.
• Analytics: where enabled and where you have consented, aggregated usage metrics such as page views, referrers, and events.

2.3 Information from third parties

We may receive information from social platforms, form providers, CRM systems, and payment processors you interact with in connection with our services.

3. How we use your information

• To respond to inquiries, provide quotes, and communicate with prospects and clients.
• To deliver, administer, and improve our consulting and advisory services.
• To operate, secure, and maintain the Site and prevent fraud or abuse.
• To send service-related messages and, with your consent where required, marketing emails.
• To comply with legal obligations, enforce our terms, and defend legal claims.
• To measure the performance of the Site via analytics (only with consent where required).

4. Legal bases (EU / UK / Switzerland)

If the GDPR or UK GDPR applies to you, we rely on the following legal bases:

• Contract (Art. 6(1)(b)): to respond to your inquiries and deliver services you have requested.
• Legitimate interests (Art. 6(1)(f)): to secure the Site, prevent abuse, maintain server logs, and carry out limited direct B2B outreach where permitted.
• Consent (Art. 6(1)(a)): for non-essential cookies, analytics, and marketing communications. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to comply with accounting, tax, and other statutory requirements.

5. Who we share information with

We do not sell personal information. We share it only with the following categories of recipients, under contractual safeguards:

• Hosting & CDN: Cloudflare, Inc. (United States) — hosts the Site and routes traffic.
• Email infrastructure: Cloudflare Email Routing and Google LLC (Google Workspace) — receive and deliver email.
• Scheduling: Cal.com, Inc. — manages booking requests.
• Analytics, CRM, and email marketing providers — where enabled and listed in Section 9: Cookies.
• Professional advisors such as lawyers, accountants, and auditors, under confidentiality obligations.
• Authorities and others where required by law, court order, or to protect rights, property, or safety.
• Successors in interest in the event of a merger, acquisition, financing, or sale of business assets.

6. International transfers

We operate from the United States. Personal data may be transferred to, and processed in, countries outside your country of residence, including the United States. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where available, adequacy decisions or the EU–U.S. Data Privacy Framework.

7. Retention

• Contact form and email inquiries: up to 24 months after last contact.
• Client records and contracts: duration of engagement plus statutory retention (commonly 6–10 years for accounting).
• Server logs: up to 30 days for operational logs, longer for security incidents.
• Marketing subscriptions: until you unsubscribe or become inactive for 24 months.

8. Your rights

8.1 EU / UK / Swiss residents

Subject to the GDPR or UK GDPR, you have the right to access, correct, erase, restrict, or object to processing of your personal data, receive it in a portable format, withdraw consent at any time, and lodge a complaint with your local supervisory authority. A list of EU authorities is at edpb.europa.eu; in the UK, the ICO.

8.2 California residents (CCPA / CPRA)

If you are a California resident you have the right to:

• Know what personal information we collect, use, disclose, or sell/share.
• Request deletion or correction of your personal information.
• Opt out of the “sale” or “sharing” of personal information and of targeted advertising.
• Limit the use of sensitive personal information.
• Be free from discrimination for exercising your rights.

We do not sell personal information and do not knowingly share it for cross-context behavioral advertising. You may still submit an opt-out request via privacy@thinking-bytes.com or by enabling the Global Privacy Control (GPC) signal in your browser, which we honor.

8.3 Other U.S. states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of targeted advertising, sale, and certain profiling.

8.4 How to exercise your rights

Email privacy@thinking-bytes.com with your request. We may need to verify your identity before responding. We will respond within the timelines required by applicable law (typically 30 days under GDPR; 45 days under CCPA).

9. Cookies and similar technologies

9.1 What are cookies?

Cookies are small text files placed on your device when you visit a website. “Similar technologies” include localStorage, sessionStorage, pixels, and SDKs that perform comparable functions. We refer to all of them as “cookies” in this policy.

9.2 Categories we use

Strictly necessary — required for the Site to function. No consent required.

• theme (localStorage) — stores your chosen color theme.
• tb_consent (localStorage) — records your cookie preferences.
• Cloudflare security cookies such as __cf_bm — distinguish humans from bots.

Analytics — help us understand how visitors use the Site. Loaded only after you opt in.

Marketing & advertising — measure campaign performance. Loaded only after you opt in.

Third-party embeds — Cal.com may set cookies when you interact with the booking widget.

9.3 Managing preferences

When you first visit the Site from a region where consent is required, you see a cookie banner. You can change your choices any time via the “Cookie preferences” link in the footer, or by clearing the tb_consent value from your browser's storage. We honor the Global Privacy Control (GPC) signal. Because there is no common standard for Do Not Track (DNT), we do not currently respond to DNT headers.

10. Children

The Site is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

11. Security

We implement technical and organizational measures appropriate to the risk, including TLS in transit, access controls, and least-privilege principles. To report a vulnerability, see our security.txt.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced on the Site and reflected in the “Last updated” date above.

14. Contact

For privacy questions or to exercise your rights: privacy@thinking-bytes.com.