Privacy Policy

Version: 1.7

Effective date: [DATE OF PUBLICATION]

Last updated: [DATE OF PUBLICATION]

1. Who We Are

This Privacy Policy (available at https://innercoretech.com/privacy-policy/) explains how InnerCore Global, LLC (Prestonsburg, KY), doing business as InnerCore Technologies ("InnerCore Technologies," "InnerCore," "we," "us," or "our") collects, uses, and protects personal information when you visit innercoretech.com (the "Site") or contact us through it.

InnerCore is a managed IT and security services provider. We take the protection of information seriously, and we apply the same practical, security-first approach to our own Site that we bring to our clients.

This policy covers the Site only. It does not cover the information we process on behalf of our clients when we deliver managed services. That information is governed by the client's service agreement with us (including our Master Services Agreement and any data processing terms).

Your use of the Site is also governed by our [Terms of Use](/terms/).

InnerCore Global, LLC is responsible for the personal information described in this policy (in European and UK terms, the "controller"). You can reach us by email at privacy@innercoretech.com or through the contact form on the Site.

2. The Short Version

• We collect the information you choose to send us through our contact and consultation form, plus limited technical information when you browse the Site.
• We use it to respond to you, provide the information or services you request, and keep the Site working and secure. We don't add inquiry contacts to marketing email lists.
• We measure everyday traffic and performance with cookieless, aggregated tools. Google Analytics, which uses cookies, runs only if you click "Accept" on our cookie banner.
• We do not sell your personal information. We do not "share" it for cross-context behavioral advertising, and we do not run paid advertising.
• We keep inquiry information for a limited time and protect it with reasonable safeguards.
• You can ask us to access, correct, or delete your information by emailing privacy@innercoretech.com.

3. Information We Collect

3.1 Information you give us

When you fill out our contact or consultation form, we collect the information you enter:

• Name
• Company name
• Work email address
• Phone number (optional)
• The service or topic you are interested in (chosen from a list)
• Your message, and any details you choose to include about your organization or IT needs

Please don't include sensitive information (such as passwords, health information, or financial account numbers) in the form. We don't need it to respond to an inquiry.

What happens to your submission. When you submit the form, our server checks it is filled in correctly and runs the spam checks described in Section 3.3. It then sends your name, company, work email, phone number (if provided), topic, and message directly to HubSpot, our customer relationship management (CRM) system, where we receive, track, and answer inquiries. Your submission is stored in HubSpot's United States data center. At the same time, an email alert containing your submission is sent to our business mailbox, hosted on Microsoft 365, so our team can respond quickly. The website itself does not save, store, or log the contents of your submission.

The form has no sign-up or consent checkboxes, and submitting it doesn't subscribe you to anything.

If you email us directly, we collect the information you provide in that email.

3.2 Information collected automatically

When you visit the Site, our hosting provider, Vercel Inc., and the services described below may automatically collect limited technical information, such as:

• IP address and approximate location (city or region level) derived from it
• Browser type, device type, and operating system
• Pages viewed, referring website, and the date and time of your visit
• Basic request log data used to keep the Site available and to block abuse

Our hosting provider keeps standard request and runtime logs (for example, the time of a request, the page requested, the response status, browser type, and the server region that handled it) for a short period under its standard settings, as described in Section 6. We do not add your form contents or IP address to any logs of our own.

3.3 Cookies, analytics, and spam protection

We use two kinds of analytics: cookieless tools that measure everyday traffic and performance, and Google Analytics, which uses cookies and runs only with your consent.

Cookieless traffic and performance measurement (Vercel Web Analytics and Vercel Speed Insights): We use Vercel Web Analytics to count visits and see which pages are popular, and Vercel Speed Insights to measure how quickly our pages load. These tools:

• Do not use cookies and do not store anything on your device to recognize you.
• Do not track you across other websites and do not build a profile of you.
• Report only aggregated statistics to us. We cannot use them to identify you or reconstruct your browsing.
• Use a short-lived visitor count. To count unique visits without cookies, Vercel creates a one-way code (a hash) from technical details of your request. The code resets every day, so the same visitor can't be followed from one day to the next, and the data is not tied to your IP address.

For each page view, Vercel Web Analytics may record the time, the page address (with any query strings and page fragments removed), the referring site, approximate location (country, region, and city), device type, operating system, and browser. For each measurement, Vercel Speed Insights may record the page, network speed type (such as 4G), browser, device type, operating system, country, and page-loading performance scores. Because these tools don't use cookies or identify you, they run without asking for consent through the cookie banner. More information is in Vercel's documentation (https://vercel.com/docs/analytics/privacy-policy and https://vercel.com/docs/speed-insights/privacy-policy) and Vercel's Privacy Notice (https://vercel.com/legal/privacy-notice).

Google Analytics 4 (only if you accept): For more detailed insight into how visitors use the Site, we use Google Analytics 4, a web analytics service provided by Google LLC. When you first visit the Site, our cookie banner asks whether you accept analytics cookies, with equal "Accept" and "Decline" buttons. Google Analytics does not load, and no analytics cookies are set, unless and until you click "Accept." If you decline or ignore the banner, Google Analytics stays off. Your choice is saved in your browser (using local storage or a small cookie) so we don't ask again on every page, and you can change it at any time with the "Cookie settings" button in the Site footer.

If you accept, Google Analytics uses cookies and similar technologies to collect information such as pages visited, time on page, device and browser type, and approximate location. Google Analytics 4 does not log or store full IP addresses. We use this information in aggregate to improve the Site, and we do not use it to identify you personally. We have configured Google Analytics to limit what it collects and keeps: all Google consent settings start as "denied," and clicking "Accept" turns on analytics storage only. Advertising storage and advertising personalization always stay off, Google Signals is turned off, and analytics data is kept for 2 months. We do not use Google Analytics for remarketing or advertising.

You can also block Google Analytics by installing Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout) or by blocking cookies in your browser. To learn more, see Google's explanation of how it uses information from sites that use its services (https://policies.google.com/technologies/partner-sites).

Spam and abuse protection: To protect our contact form from spam and automated abuse, we use three measures:

• Google reCAPTCHA v3. This invisible service checks whether a form submission is likely coming from a person or an automated program, without asking you to solve a puzzle. To do this, Google collects information such as your IP address, browser and device details, and how you interact with the page, and may set a cookie used for security. reCAPTCHA loads only on our contact page. It is needed to keep the form secure, so it runs there without consent through the cookie banner. The notice below appears under the form's submit button: This site is protected by reCAPTCHA and the Google Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms) apply.
• A hidden "honeypot" field. This is a form field that people don't see but automated programs often fill in. It collects no information about you.
• Rate limiting. To block floods of automated submissions, we allow about five submissions per 10 minutes from each IP address. To do this, the IP address a submission comes from is held briefly in server memory for that 10-minute window only. It is never written to storage or logs.

Strictly necessary cookies: Some cookies are needed for the Site to function, load securely, and protect our forms from abuse. These include the browser storage (local storage or a small cookie) that remembers your cookie-banner choice and, on the contact page only, the security cookie that reCAPTCHA may set. They do not require consent and cannot be switched off through our Site, but you can block them in your browser settings (some parts of the Site, such as the contact form, may then not work).

Social media links and third-party content: The Site footer contains plain links to our LinkedIn and Facebook pages. These links run no scripts and send nothing to those networks until you click them. When you follow one and leave the Site, LinkedIn's or Facebook's own privacy policy applies. The Site has no social media embeds, share buttons, tracking pixels, video embeds, or chat widgets. We do not use the HubSpot tracking code, HubSpot embedded forms, or HubSpot cookies on the Site. Our server sends form submissions to HubSpot behind the scenes, so HubSpot doesn't track your browsing. The Site uses only your device's built-in system fonts (no externally loaded fonts such as Google Fonts).

4. How We Use Your Information

We use personal information to:

• Respond to your inquiries and consultation requests
• Provide the information, proposals, or services you ask for
• Follow up about your inquiry, if you have asked us to contact you
• Operate, maintain, and improve the Site
• Protect the Site, our business, and our visitors from spam, fraud, and security threats
• Comply with legal obligations and enforce our rights

No marketing lists. We use the information you send through the contact form only to respond to your inquiry and any related follow-up. We do not add inquirers to marketing email lists. If we ever offer marketing emails, we will ask for your consent where required and update this policy first.

We do not use your information to make automated decisions that have legal or similarly significant effects on you.

5. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (targeted advertising based on your activity across other websites).

We share personal information only as follows:

• Service providers. We use trusted vendors to help us run the Site and our business, such as:
  • Website hosting, cookieless traffic analytics, and performance measurement: Vercel Inc.
  • Receiving, managing, and answering inquiries: HubSpot, Inc. (customer relationship management), which processes form submissions on our behalf as our service provider ("processor")
  • Business email: Microsoft Corporation (Microsoft 365), which receives the email alert for each submission and hosts our email correspondence with you, as our service provider ("processor")
  • Detailed analytics: Google LLC (Google Analytics 4), only if you accept analytics cookies
  • Spam protection: Google LLC (reCAPTCHA v3)

  These providers may use personal information only to provide services to us, and we expect them to protect it appropriately.

• Legal and safety reasons. We may disclose information if required by law, subpoena, or court order, or when we believe in good faith that disclosure is needed to protect the rights, property, or safety of InnerCore, our clients, or others.
• Business transfers. If InnerCore is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.
• With your direction. We may share information when you ask us to or agree to it.

6. How Long We Keep Your Information

We keep personal information only as long as we need it for the purposes described in this policy:

• Inquiry and consultation information: the website itself keeps no copy. In HubSpot and in our Microsoft 365 mailbox (the submission alert and our email correspondence with you), we keep it for up to 24 months after our last contact with you, unless you become a client, in which case your information is handled under your service agreement.
• Google Analytics data: kept for 2 months, then deleted automatically.
• Vercel Web Analytics and Speed Insights: aggregated statistics that don't identify you. The daily visitor code resets every day, and visitor sessions are discarded after 24 hours.
• Rate-limiting data: IP addresses are held in server memory for 10 minutes at most and never stored or logged.
• Hosting request and runtime logs: kept by our hosting provider under its standard settings for a short period, no longer than 30 days, then deleted automatically. We don't add form contents or IP addresses to logs.

We may keep information longer where the law requires it or to resolve disputes. When we no longer need it, we delete it or de-identify it.

7. How We Protect Your Information

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encrypted connections (HTTPS) for the Site, access controls that limit who can see form submissions, and the security protections provided by our hosting provider. We also limit what we collect: the website doesn't store form submissions, and it doesn't keep IP addresses for rate limiting.

No website, internet transmission, or storage system is completely secure, so we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as required by applicable law. If you believe you have found a security issue or vulnerability on the Site, please report it to security@innercoretech.com.

8. Where Your Information Is Processed

InnerCore is based in the United States, and our service providers store inquiry data in the United States. Contact form submissions are stored in HubSpot's U.S. data center, and submission alerts and our email correspondence with you are stored in our Microsoft 365 account in Microsoft's U.S. data centers. Like most cloud providers, HubSpot and Microsoft may occasionally access data from other locations (for example, for support or security) under their data processing terms and the safeguards described in Section 10.3. To deliver pages quickly, our hosting provider's global network may briefly handle your request in a data center near you before it reaches our U.S.-based systems. If you visit the Site from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Section 10.3 explains how we protect information from the European Economic Area, the United Kingdom, and Switzerland.

9. Children's Privacy

The Site is intended for businesses and is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where local law sets a higher age). If you believe a child has provided us with personal information, please contact us and we will delete it.

10. Your Privacy Choices and Rights

10.1 Rights we offer to everyone

Wherever you live, you may ask us to:

• Tell you what personal information we hold about you and give you a copy
• Correct inaccurate information
• Delete your information
• Stop contacting you

10.2 United States state privacy rights

Several U.S. states, including California (under the California Consumer Privacy Act as amended by the California Privacy Rights Act), Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others, give residents specific privacy rights. Some of these laws apply only to businesses above certain size or data-volume thresholds, and they may not apply to InnerCore. Even so, we honor the requests described in this section for all U.S. residents.

Depending on where you live, these rights may include the right to know or access, correct, delete, and obtain a portable copy of your personal information, and the right to opt out of the sale of personal information, sharing for targeted advertising, and certain profiling. As stated above, we do not sell personal information or share it for targeted advertising, and we do not use sensitive personal information to infer characteristics about you.

Categories of personal information we collect (for California residents): identifiers (such as name, email, phone, and IP address); professional or employment-related information (such as company name); internet or other electronic network activity (such as pages viewed and browser information); and approximate geolocation derived from IP address. Sources, purposes, and recipients are described in Sections 3 through 5. In the past 12 months we have not sold or shared any of these categories.

We will not discriminate against you for exercising your privacy rights. You may use an authorized agent to submit a request on your behalf, and we may ask for proof of the agent's authority. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal."

10.3 Visitors from the European Economic Area, the United Kingdom, and Switzerland

We welcome inquiries from businesses around the world. If the EU General Data Protection Regulation, the UK General Data Protection Regulation, or similar laws apply to our handling of your information, this section applies to you.

Who is responsible. The controller of your personal information is InnerCore Global, LLC (Prestonsburg, KY), doing business as InnerCore Technologies. Contact: privacy@innercoretech.com.

Why we are allowed to use your information (legal bases).

• Legitimate interests: to respond to business inquiries and consultation requests, to follow up on them, and to keep the Site and our contact form secure, including spam protection and rate limiting. Our interest is running our business and protecting the Site, and we balance it against your rights. You can object at any time.
• Consent: for Google Analytics cookies, which load only if you click "Accept," and for any other cookie, including reCAPTCHA's, where the law treats it as non-essential and requires consent. You can withdraw consent at any time through the "Cookie settings" button in the Site footer, without affecting earlier processing.
• Steps before a contract: when you ask us for a proposal, quote, or consultation, we use your information to prepare it at your request.
• Legal obligation: when we must keep or disclose information to comply with the law.

Your rights. Subject to the law, you have the right to:

• Access your personal information and get a copy
• Correct (rectify) inaccurate information
• Have your information erased
• Restrict how we use it
• Receive it in a portable format
• Object to our use of it, including any use based on legitimate interests
• Withdraw consent at any time where we rely on consent
• Complain to a data protection supervisory authority, such as the Information Commissioner's Office (ICO) in the UK or the authority in your EU country. We'd appreciate the chance to help first, so please contact us at privacy@innercoretech.com.

To use these rights, follow the steps in Section 10.5.

International transfers. InnerCore is based in the United States, so information you send us through the Site is collected and processed in the United States. Our service providers store inquiry data in the United States. Where they receive personal information from the EEA, the UK, or Switzerland, we rely on the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework when the provider is certified under them. Our hosting provider (Vercel), our CRM provider (HubSpot), our email provider (Microsoft), and Google are certified. HubSpot's and Microsoft's data processing terms also include the Standard Contractual Clauses as a backup. Otherwise, we rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement or the UK Addendum to those clauses. You can ask us for more information about these safeguards at privacy@innercoretech.com.

10.4 Visitors from Canada and Australia

Canada. Where Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies, we collect, use, and disclose your personal information only for the purposes described in this policy, with your consent, which you can withdraw subject to legal and contractual limits. You may ask to access and correct your information. If you're not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

Australia. Where Australia's Privacy Act 1988 and the Australian Privacy Principles apply, you may ask to access and correct your personal information, and you may ask to deal with us anonymously or under a pseudonym where that's practical (we'll need some contact details to answer an inquiry). Your information will be held in the United States, as described in Section 8. If you have a complaint, contact us first. If you're not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

10.5 How to make a request

Email privacy@innercoretech.com with the subject line "Privacy Request," and tell us what you would like us to do. You can also reach us through the contact form on the Site.

To protect your information, we will verify your request, usually by confirming details you have provided to us or by replying from the email address we have on file. We aim to respond within 30 days, and no later than 45 days (or as otherwise required by law). If we need more time, we will let you know.

11. Do Not Track and Global Privacy Control

Some browsers send "Do Not Track" signals. Because there is no common industry standard for these signals, the Site does not respond to them. However, we treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of any sale or sharing of personal information and of analytics cookies for that browser, so Google Analytics will not load even if you have not used the banner. Our cookieless Vercel measurement tools (Section 3.3) don't sell, share, or track you across sites, so they are not affected. Because we do not sell or share personal information, honoring the signal does not change how we handle your information otherwise.

12. Links to Other Websites

The Site may link to websites operated by others, such as our technology partners and our LinkedIn and Facebook pages. When you leave the Site through one of these links, the other site's own privacy policy applies. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version at https://innercoretech.com/privacy-policy/, change the version number and "Last updated" date at the top, and keep an archive of prior versions available on request. If we make material changes to how we use personal information, we will provide more prominent notice, such as a notice on the Site, before the changes take effect.

14. Governing Law

This Privacy Policy is governed by the laws of the Commonwealth of Kentucky and applicable U.S. federal law, without regard to conflict-of-law rules, except where the privacy laws of your place of residence give you additional rights.

15. Contact Us

If you have questions about this Privacy Policy or how we handle personal information, contact us at:

• InnerCore Global, LLC (Prestonsburg, KY), doing business as InnerCore Technologies
• Privacy questions and requests: privacy@innercoretech.com
• Security issues or vulnerabilities: security@innercoretech.com
• Online: the contact form on the Site

Version history