Legal

Privacy policy

This website does not set cookies, does not run analytics, and does not carry advertising or tracking pixels. There is no form to fill in and no account to create. If you want the short version: we do not collect anything about you here, and we do not sell information about anybody.

The rest of this page explains that in detail, discloses the one place where information reaches someone else anyway, and describes separately how we handle data inside a paid engagement — because that is a different question with a different answer.

1. Who we are

Vanelytics LLC is a Michigan limited liability company. We build data infrastructure, reporting, AI and automation for other companies. In this policy, "we", "us" and "our" mean Vanelytics LLC, and "you" means a visitor to this website.

For anything in this policy, you can reach us at griffen@vanelytics.com.

2. What this policy covers — and what it does not

This policy covers vanelytics.com and the email address above.

3. What we collect from visitors to this website

Nothing that you have to give us, because there is nowhere on this site to give it. This site is static pages. It has no contact form, no newsletter signup, no login, no chat widget, no comments, and no shopping cart.

We do not set cookies. We do not use Google Analytics or any other analytics tool. We do not use advertising pixels, conversion tags, session-replay or heatmap tools, or any product that records what you do on the page. We do not fingerprint your device or build a profile on you.

The one exception we want to be straight about

Hosting logs. Like essentially every web server, the service that hosts this site keeps automatic access logs. A log entry can include your IP address, the page requested, the date and time, your browser and operating system type, and the page that referred you. This is a byproduct of delivering a web page, not something we set up to learn about you. These logs exist for security and reliability — spotting attacks and outages. We do not use them for marketing, we do not try to identify individuals from them, and we do not combine them with anything else.

No third-party requests at all

Loading a page on this site contacts our server and nothing else. Every asset — the stylesheet, the images, the typefaces — is served from vanelytics.com. In particular, our fonts are self-hosted rather than loaded from Google Fonts or any other font service, so your IP address is not disclosed to a third party in order to render the page. Our host delivers pages from its own network of servers, which is part of the hosting service described in Section 7 rather than a separate party your browser is sent to. Beyond that, there is no third-party content delivery network, no tag manager, no embedded video, no social widget, and no external script of any kind.

We mention this because it is unusual, and because it is the difference between a site that says it collects nothing and a site where that is actually true.

If you email us

If you email the address on this site, we obviously receive whatever you put in the message — your name, your email address, your company, and whatever you tell us about your systems. We hold it because you asked us a question and we need it to answer. We keep business correspondence for as long as it is useful for the relationship and for our own records, and we do not add you to any marketing list on the strength of one email.

4. How we use what little we have

• To serve you this website and keep it available and secure.
• To reply to you if you contacted us.
• To keep ordinary business records and meet our legal and tax obligations.

That is the complete list.

5. What we never do

• We do not sell personal information. We never have, and this is not a policy we intend to revisit.
• We do not share or disclose personal information for anyone's targeted advertising, ours or a third party's.
• We do not track you across other websites or apps.
• We do not use your information, or a client's data, to train our own AI models or anyone else's.
• We do not rent, trade, or publish contact details.

6. Do Not Track and Global Privacy Control

California law asks us to tell you how we respond to Do Not Track signals, so: this site has nothing to switch off. We do not perform the cross-site tracking that a Do Not Track or Global Privacy Control signal is designed to stop, whether or not your browser sends one. If we ever add anything that does, we will honor those signals and update this page before it goes live.

7. Who else touches this information

We keep this list short deliberately. No third party is contacted when you load a page. Behind the scenes, the only third parties involved at all are:

• Our web host, which serves these pages and keeps the access logs described above.
• Our email provider, which carries messages you send us.
• Our professional advisers — such as an accountant or attorney — where correspondence is relevant to their work for us.

We may also disclose information if a law, subpoena, or court order requires it, or where we need to in order to protect our legal rights or someone's safety. If we are ever compelled to hand over information about you and we are permitted to tell you, we will.

We do not currently transfer personal information outside the United States, other than as an incidental consequence of the hosting described above.

8. How long we keep things

• Hosting logs: a short rolling window, typically weeks rather than years, after which they are overwritten.
• Email correspondence: for as long as it is useful to the relationship, and then as long as our record-keeping and tax obligations require.

9. Client data in an engagement

This is the part that matters most for a company that hires us, so it is worth stating plainly.

• You own it. Every engagement runs in accounts and a database that belong to the client. We operate that infrastructure; we do not hold your data in a Vanelytics-owned product, and there is no copy of it inside a platform of ours that you cannot see.
• We act only on your instructions. We use client data solely to perform the services in the written agreement. We do not use it for our own purposes, do not sell or share it, and do not use it to train models.
• Contracted, not assumed. Our client agreements carry the data-protection terms that applicable privacy laws require of a service provider or processor, including purpose limitation, confidentiality, security obligations, assistance with consumer rights requests, restrictions on subcontracting, and return or deletion of data when the engagement ends.
• Regulated data. Where a client is subject to a sector-specific regime — for example a dealership arranging financing, which brings it under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule — we will enter the service-provider terms that regime requires and support the client's oversight and assessment obligations.
• Security. We use access controls and least-privilege credentials, multi-factor authentication on the accounts we touch, encryption in transit and at rest where the platform supports it, and monitoring on the pipelines we run.
• Subprocessors. Where a cloud, database, or AI provider is needed to deliver the service, we identify it to the client and it is bound by terms consistent with ours.

If you are an individual whose information sits in a system we operate for one of our clients, your request goes to that client, who is the party responsible for it. Send it to us and we will pass it along and help them answer, but we cannot act on their data on our own initiative.

10. Security and breach notification

We take reasonable administrative and technical measures to protect information in our care, and we keep our own attack surface small on purpose — a static website with no database and no forms cannot leak a customer list it never had. No method of transmission or storage over the internet is completely secure, and we do not claim otherwise.

If a security breach affecting personal information does occur, we will notify affected individuals and any other parties as required by the Michigan Identity Theft Protection Act and any other applicable law, without unreasonable delay, and we will notify an affected client under the terms of our agreement with them.

11. Children

We sell to businesses. This website is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, email us and we will delete it.

12. Your choices and your rights

Michigan does not currently have a comprehensive consumer privacy statute, and Vanelytics is well below the size and volume thresholds that make the California and other state privacy laws apply to us as a business in our own right. We are not going to hide behind that.

If you believe we hold personal information about you and you want to know what it is, have it corrected, or have it deleted, email griffen@vanelytics.com and we will handle it as though those rights applied. We will respond within 45 days, we will not charge you, and we will not treat you differently for asking. In practice the answer for a website visitor is usually that we hold nothing but a fading server log. If your request concerns data in a client's system, see Section 9.

13. Changes to this policy

If we change this policy we will update the effective date at the top and post the revised version here. If we ever start collecting something we do not collect today — a contact form, analytics, a booking tool — we will update this page at the same time as that change goes live, not after it.

14. Contact

Questions about this policy, or about how we would handle your company's data in an engagement:

• Email: griffen@vanelytics.com
• Vanelytics LLC, Michigan, United States