Privacy Policy

This Privacy Policy describes how Gemstone Consulting Services, LLC (“Gemstone,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information in connection with the website located at scalewithstone.com, including its application and scheduling tool (collectively, the “Site”).

This Policy applies solely to information collected through the Site and through correspondence initiated from it. It does not apply to information processed by Gemstone in the course of performing services for a client under a written engagement agreement, which is governed by the confidentiality, security, and data processing provisions of that agreement.

Gemstone Consulting Services, LLC is the controller responsible for the personal information described in this Policy. Gemstone is a single-operator consultancy based in the United States that builds custom operational software for small and mid-sized businesses.

You may contact us regarding this Policy at connor@scalewithstone.com.

We collect only the information necessary to respond to you and to keep the Site operating securely. Specifically:

Application information

When you apply for a scoping call, the application asks for your first and last name, work email address, phone number, company name, company website (optional), and role. It then asks about your business: its industry, how many people work there, its approximate annual revenue, any regulatory or confidentiality obligations that apply to it, how it runs today, what frustrates you about it, why you are looking now, the kind of relationship you are looking for, and how you heard about us. Each step is saved when you submit it, so if you stop partway through, we keep what you have submitted so far and may follow up with you about it. We store this information in our own database and customer relationship management system, linked to a record of you and your company.

How you found the Site

When you arrive at the Site, our server records how you got here in a cookie on your browser: the campaign tags in the link you followed (such as utm_source, utm_medium and utm_campaign), an advertising click identifier if the link carried one (such as LinkedIn’s li_fat_id or Google’s gclid), the page you landed on (its address and campaign tags only), the domain of the site that referred you, and when. It keeps the first such visit and the latest one. If you then apply for a call, both are saved with your application, so we know what introduced you to Gemstone and what brought you back. A link we send you personally works the same way and lets us connect your application to our earlier conversation with you. The cookie holds no name, email address or other contact detail.

Site visits

We count visits to the Site with PostHog, an analytics service provided by PostHog, Inc. Your browser sends PostHog, through our own domain, a record of each page you view: its address with campaign tags only, the domain of the site that referred you, and standard browser and device information. PostHog receives your IP address as part of that request and may use it to estimate a general location, such as your country or city. Visitors are anonymous: we never tell PostHog who you are, including after you apply. We use it only to understand how many people visit and which channels bring them.

Booking information

When you choose a time for the call, our servers send your name, email address, phone number, time zone, and chosen time, and the email addresses of any colleagues you invite, to Cal.com, Inc., a third-party scheduling service, which books the call on our behalf, creates the video meeting, and sends the calendar invitation and confirmation emails to you and to them. Cal.com notifies our systems of the booking and of any later change you make to it, and we keep a record of it with your application.

Colleagues you invite

If you invite colleagues to the call, we receive the email addresses you enter for them and use them only to invite them to that call and to keep a record of who attended. Please invite only people who expect to hear about the call.

Call recordings and transcripts

Calls booked through the Site are held on Zoom, a video conferencing service provided by Zoom Communications, Inc. We record and transcribe these calls by default, including what you and any colleagues who join say and show on the call, and we keep the recording and transcript with our record of the call, you, and your company. If you would prefer that a call not be recorded, tell us before or at the start of the call and we will not record it. We may use Claude, an AI service provided by Anthropic, PBC, to review a transcript, for example to recall what was discussed or to prepare for a follow-up.

Correspondence

If you email us, we receive your email address, the contents of your message, any attachments, and associated message metadata. We retain this correspondence in our email systems.

Technical and log information

Our hosting and infrastructure providers automatically record standard server log data when a page is requested, which may include IP address, user agent string, requested URL, referring URL, and timestamp. This data is generated by the infrastructure layer for security, abuse prevention, and operational purposes.

We do not require you to provide any personal information in order to browse the Site. All information described above is provided by you voluntarily, recorded about how you arrived and what you viewed as described above, or generated automatically by infrastructure in the ordinary course of serving a web request.

For clarity, and as of the effective date of this Policy:

• The Site does not offer user accounts, and we do not collect usernames or passwords through it.
• The Site does not process payments and does not collect payment card or bank account information.
• The Site contains no contact forms, comment fields, or newsletter signup other than the application and scheduling tool described above.
• We do not collect special categories of personal information, such as health, biometric, genetic, precise geolocation, racial or ethnic origin, religious belief, or sexual orientation data.
• We do not knowingly purchase, rent, or otherwise acquire personal information about you from data brokers.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising.
• Web fonts used by the Site are served from our own infrastructure rather than requested from a third-party font provider, so no font-related request is made to any third party from your browser.

The Site sets cookies only on its own domain. It does not use advertising pixels, web beacons, or any technology that tracks you across other websites, and no third-party scheduling tool is embedded in the Site. The cookies it sets are:

Attribution cookie

Set by our server, it records how you found the Site, as described under “How you found the Site” above, and lasts for ninety (90) days from the last visit that changed it. It cannot be read by scripts on the page or by any other website. We use it only to record where an application came from; it is never sold or used for advertising. It is not set for visits by automated software, such as search engine crawlers or the services that build a preview when a link is shared.

Analytics cookie

Set by PostHog, it holds a random identifier so that pages viewed in one visit are counted as one visit, together with the campaign tags of the visit, as described under “Site visits” above. It is not set if your browser sends a Global Privacy Control signal (see below).

While you complete an application, the Site keeps a reference to it in your browser’s session storage, so that you can continue where you stopped if the page reloads. Session storage is not a cookie: it is not sent to us with your requests, it is not readable by other websites, and your browser clears it when you close the tab. It is strictly necessary for the application to work and is not used for advertising or tracking.

Most browsers allow you to block or clear cookies and other stored site data. Doing so will not affect your ability to browse the Site or apply for a call, though an application in progress may need to be started again, and we will not know how you found the Site.

We use PostHog to count visits to the Site and to see which channels, such as LinkedIn, search engines, or a referral, bring visitors. It measures page views and their campaign tags only: it does not record your screen or your mouse movements, does not capture what you type, does not build advertising profiles, and does not track you across other websites. Visitors are never identified to it. Its data is sent through our own domain and used solely to understand and improve how people find the Site; it is never sold or used for behavioral advertising.

PostHog does not run on pages that are private to an individual, such as the page for booking a follow-up call, and does not run at all if your browser sends a Global Privacy Control signal.

We use personal information to:

• Review your application, prepare for the call, and assess whether Gemstone is a good fit for your business.
• Schedule, confirm, reschedule, and conduct the call you requested.
• Record and transcribe the call, and review its recording and transcript, including with AI tools, to keep an accurate record of what was discussed and to follow up on it.
• Follow up with you about an application you started but did not finish, or a call you booked.
• Respond to your inquiry and correspond with you about a prospective engagement.
• Operate, maintain, secure, and troubleshoot the Site, including detecting and preventing abuse, spam, and fraudulent bookings.
• Maintain business records and comply with applicable legal, tax, and regulatory obligations.
• Establish, exercise, or defend legal claims where necessary.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects, and we do not use it to send marketing communications unless you have separately asked us to.

Where the General Data Protection Regulation or comparable law applies to our processing, we rely on the following legal bases: performance of steps taken at your request prior to entering into a contract, in respect of booking and responding to your inquiry; our legitimate interests in operating, securing, and improving the Site, in keeping an accurate record of our calls, and in pursuing prospective business relationships, balanced against your rights and freedoms; your consent, where we have asked for it; and compliance with legal obligations to which we are subject.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising purposes. We disclose personal information only in the following circumstances:

Service providers

We use vendors to host the Site and its database, measure Site traffic, provide scheduling and video meetings, record and transcribe calls, provide the AI tools we use to review transcripts, deliver email, and provide calendar and infrastructure services. These providers process personal information on our behalf, under contract, and only as necessary to provide their services to us.

Legal compliance

We may disclose personal information where we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Gemstone, our clients, or others.

Business transfer

If Gemstone is involved in a merger, acquisition, reorganization, financing, or sale of all or part of its assets, personal information may be transferred as part of that transaction, subject to the terms of this Policy or a successor policy providing comparable protection.

With your direction

We may disclose information to others where you direct or authorize us to do so.

We retain personal information only for as long as necessary for the purposes described in this Policy, or for as long as required by applicable law. Applications (including incomplete ones), booking records, and correspondence relating to a prospective engagement that does not proceed are generally retained for a limited period sufficient to maintain a record of the inquiry and any follow-up, after which they are deleted or archived. Correspondence and records relating to an engagement that does proceed are retained in accordance with the applicable engagement agreement and our legal, tax, and accounting obligations. Server log data is retained on the retention schedule of the relevant infrastructure provider, which is typically short. The attribution cookie expires from your browser ninety (90) days after the last visit that changed it; what it recorded is kept with your application if you apply. Visit records held by PostHog are retained for the period its service provides for our account.

Recordings and transcripts of calls are retained indefinitely, unless you ask us to delete them.

You may request deletion of your information at any time as described below.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, access controls limiting access to information to those who need it, and reputable infrastructure providers.

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You should not transmit confidential or sensitive information to us through the Site before an appropriate confidentiality agreement is in place.

Depending on where you reside, you may have rights in relation to your personal information, including the right to request access to it; to request correction of inaccurate information; to request its deletion; to request a portable copy; to object to or request restriction of certain processing; to withdraw consent where processing is based on consent; and to be free from discrimination for exercising these rights.

You may also ask us not to record a call, before or at the start of the call, and ask us at any time to delete the recording or transcript of a call.

To exercise any of these rights, email connor@scalewithstone.com with a description of your request. We will acknowledge your request and respond within the period required by applicable law, and in any event will aim to respond within thirty (30) days. We may need to verify your identity before acting on a request, which we will ordinarily do by corresponding with you at the email address associated with the information in question. An authorized agent may submit a request on your behalf with proof of authorization.

If you are located in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority. If you are a Florida resident or a resident of another U.S. state with an applicable consumer privacy law, you may have the rights described above to the extent that law applies to us.

The Site is directed to businesses and is not intended for children. We do not knowingly collect personal information from anyone under the age of eighteen (18), and in no case from a child under thirteen (13). If we learn that we have collected personal information from a child in violation of applicable law, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at connor@scalewithstone.com.

Gemstone is based in the United States, and the Site and its supporting infrastructure are operated in the United States. If you access the Site or contact us from outside the United States, you understand that your personal information will be transferred to, stored in, and processed in the United States, where data protection law may differ from that of your jurisdiction. Where required, we implement appropriate safeguards for such transfers.

The Site does not track visitors across websites or for advertising purposes. If your browser sends a Global Privacy Control signal, the Site does not load PostHog, so your visits are not counted or sent to it. The attribution cookie is still set, because it is how an application records where it came from, and it is never used for advertising or shared with any third party. Browsers do not apply the older “Do Not Track” signal consistently, so the Site does not respond to it separately; Global Privacy Control is the signal it honors.

The Site may link to third-party websites or services that we do not operate. This Policy does not apply to those destinations, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any third-party site you visit.

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the effective date shown at the top of this page. Material changes will take effect upon posting to the Site. We encourage you to review this Policy periodically.

Questions, requests, or complaints regarding this Policy or our handling of personal information may be directed to Gemstone Consulting Services, LLC by email at connor@scalewithstone.com.