Privacy Policy

1. Overview

Cresthaven Analytics LLC ("Cresthaven") respects your privacy. This Privacy Policy describes how we collect, use, and protect your personal information when you use our website and services.

2. Information We Collect

Account Information: When you subscribe, we collect your name, email address, company name (if provided), and sector preference. This information is necessary to deliver your intelligence briefs and manage your subscription.

Payment Information: Payment processing is handled entirely by Stripe. We do not store, access, or process your credit card numbers, bank account details, or other payment credentials. Stripe's privacy practices are governed by their own privacy policy.

Website Usage: We collect minimal, standard web analytics data (page views, browser type, referring URLs) to improve our website experience. We also use a small number of third-party marketing analytics tools to measure campaign performance. See Section 11 for the full list and opt-out instructions.

3. How We Use Your Information

We use your information solely for the following purposes:

• Delivering intelligence briefs and digest emails to your inbox
• Managing your subscription and billing through Stripe
• Communicating service updates, maintenance notices, or policy changes
• Responding to your inquiries or support requests
• Contacting professionals at businesses about our service (see Section 12)

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Data Sources

The intelligence content in our briefs is derived exclusively from publicly available government and institutional sources. We do not collect, process, or incorporate any personal data of third parties into our intelligence products.

5. Data Retention

We retain your account information for as long as your subscription is active and for a reasonable period afterward to fulfill legal obligations and resolve disputes. You may request deletion of your account data at any time by contacting us.

6. Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information. All data transmission uses TLS encryption. Access to subscriber data is restricted to authorized personnel only.

7. Legal Basis for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information only when we have a lawful basis to do so under Article 6 of the GDPR (and corresponding provisions of the UK GDPR). The bases we rely on are:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to deliver intelligence briefs, operate your subscriber portal, manage billing through Stripe, and provide customer support.
• Legitimate interests (Art. 6(1)(f)): Processing necessary for our legitimate interests in operating, securing, and improving the service — including website analytics, fraud and abuse prevention, service monitoring, and defending legal claims — provided those interests are not overridden by your rights and freedoms.
• Consent (Art. 6(1)(a)): Processing based on the consent you give us for specific purposes, such as receiving optional marketing communications or non-essential cookies. You may withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)): Processing necessary to comply with applicable law — including tax, accounting, and record-keeping requirements — and to respond to lawful requests from public authorities.

Data controller: Cresthaven Analytics LLC is the controller of your personal information. For questions about our lawful bases, to exercise your rights, or to object to processing based on legitimate interests, contact [email].

International transfers: Personal information may be transferred to and processed in the United States and other jurisdictions where we or our service providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for such transfers.

8. Your Rights

You may request access to, correction of, or deletion of your personal information at any time by contacting [email]. We will respond to valid requests within 30 days.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to: object to processing based on legitimate interests; request restriction of processing; request data portability; withdraw consent where processing is based on consent; and lodge a complaint with your local data protection supervisory authority. UK residents may contact the Information Commissioner's Office (ICO); EU residents may contact the relevant supervisory authority in their member state.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to subscribers via email. The "last updated" date at the top reflects the most recent revision.

10. Contact

For privacy-related inquiries, contact [email]. For general support, contact [email].

11. Marketing Analytics and Tracking Pixels

We do not currently run third-party advertising pixels or ad-conversion tracking on this site. No Meta Pixel, LinkedIn Insight Tag, or server-side ad-conversion events are active. Our traffic measurement is aggregate and cookieless, provided by our infrastructure provider, and does not build advertising profiles or share your identity with ad platforms.

If we introduce advertising pixels in the future, we will update this section before they go live.

• Browser-level controls: most browsers offer "Do Not Track" settings and built-in tracker blockers; nothing on this site works against them.
• Account deletion or contact: if you have a Cresthaven Analytics subscription and want a hard delete of any associated identifiers, email [email].

We do not sell visitor data to third parties.

12. Business Contacts

To tell professionals about Cresthaven Analytics, we collect the name, job title, employer and work email address of people at businesses our briefs are built for, such as firms on the UK Financial Conduct Authority register. We get these details from public sources (regulator registers, company websites and professional networking profiles) and from a business data provider, and we check that each address can receive mail before we use it. The service providers that help us find, check and send these emails act only on our instructions.

We use these details only to send business emails about our service, and no more than four to any one person. Our lawful basis is legitimate interests (Art. 6(1)(f) of the GDPR and UK GDPR): we have weighed our interest in reaching the people our service is designed for against their interests, and we contact people only in roles where our briefs are relevant to their work. In the UK we do not email sole traders, or partnerships that the law treats as individuals, unless they have agreed to hear from us.

Every email names Cresthaven Analytics and includes a way to unsubscribe. If you unsubscribe or object, we stop contacting you on every channel and keep only your email address on a do-not-contact list, so that we never contact you again. We delete all other details 12 months after our last contact. To ask what we hold about you, or to have it deleted, contact [email].