How we handle your information.

// 01 Who we are

The data controller.

Ashton Strategies LLC, doing business as Ashton Advisors. Houston, Texas, United States. For any privacy question, email brandon@ashtonstrategies.com and we'll respond within five business days.

// 02 What we collect

Two kinds of data.

Information you give us when you fill in a form or email us directly:

• The project intake form on the Contact page: first and last name, work email, organization, role, engagement type, relevant practice, project description, and timing.
• The newsletter signup on the Insights page: email address only.
• Anything you include in an email to brandon@ashtonstrategies.com or a phone or LinkedIn message.

Information collected automatically through standard web hosting:

• Server logs at our hosting provider (Netlify): IP address, browser type, pages viewed, referrer, timestamps. Used for security and basic operational analytics, not for advertising.
• No third-party advertising trackers or cross-site cookies are loaded by this site.

// 03 How we use it

To respond, to follow up, to send what you asked for.

• Inquiry follow-up. If you submit the contact form, Brandon reads it personally and replies, typically within two business days.
• Newsletter delivery. If you subscribe, we send periodic updates from the practice — typically once a month. You can unsubscribe in one click from any message.
• Engagement administration. If we work together, we use your contact data for project communication, billing, and references you authorize.
• Site operation. Server logs are used to keep the site running and to detect abuse.

We do not sell, rent, or trade your personal information. We do not use your data to build advertising audiences.

// 04 Who we share it with

The software stack behind the practice.

We rely on a small number of vetted third parties to run the practice. Each is bound by their own privacy commitments. Personal data you provide may transit through providers in the first three categories below; the remaining categories support the practice but do not routinely process client personal data.

Website & client communications:

• Netlify — website hosting and form submissions. Form data is stored in the Netlify dashboard and emailed to brandon@ashtonstrategies.com.
• Google Workspace — email, calendar, document storage, and Google Voice for the practice.
• Microsoft 365 — Word, PowerPoint, and Excel for client deliverables and analysis.
• DocuSign — engagement agreements, NDAs, e-signatures, and contract storage.
• Squarespace — domain registrar for ashtonstrategies.com.
• Future newsletter platform — if and when the newsletter ships through a dedicated email service (e.g., MailerLite, Substack, or similar), the provider will be listed here.

AI tooling used in the work (governed by the Responsible AI page):

• Anthropic Claude (including Claude for Work) — primary AI assistant on enterprise tier with no-training defaults.
• Microsoft 365 Copilot — AI features within the Office productivity suite.
• Google Workspace Gemini — AI features within Workspace boundaries.
• Aragon AI — AI-generated professional portrait imagery (no client data involved).
• Canva (including AI-assisted features) — visual design and brand assets.

Research subscriptions (these do not receive your personal data — listed for transparency on what informs the practice):

• The Wall Street Journal · The New York Times — for market and industry context.

We will disclose information if required by law, valid legal process, or to protect the rights and safety of the practice and others. We do not transfer data outside the United States except as part of these service providers' standard operations.

// 05 How long we keep it

Until it stops being useful, or you ask us to delete it.

• Form submissions: retained while a conversation or engagement is active, then archived for up to two years for follow-up reference, then deleted.
• Newsletter subscriptions: retained until you unsubscribe.
• Engagement records: retained for the period required by tax, accounting, and professional obligations (typically seven years), then deleted.
• Server logs: retained per Netlify's standard retention (typically 30 days for raw logs).

// 06 Your rights

Access, correct, delete, opt out.

Regardless of where you live, you can email brandon@ashtonstrategies.com to:

• Ask what information we hold about you
• Correct anything that's wrong
• Have your information deleted (subject to legal retention obligations)
• Unsubscribe from the newsletter (one click in any email)
• Withdraw consent you previously gave

Residents of California (CCPA/CPRA), the European Union (GDPR), and the United Kingdom (UK GDPR) have additional statutory rights, including the right to data portability and the right to lodge a complaint with a supervisory authority. We honor those rights regardless of where you live.

// 07 Security

Reasonable, proportionate, never absolute.

We use industry-standard practices — encrypted transport (HTTPS), reputable cloud providers, multi-factor authentication on practice accounts, and access limited to the principal — to protect the data we hold. No system is perfectly secure; if a meaningful breach occurs that affects you, we'll notify you and the appropriate authorities as required by law.

// 08 Children

Not the audience.

This site is intended for business professionals. We do not knowingly collect information from anyone under the age of 18.

// 09 Changes to this policy

Versioned, dated, posted here.

When we update this policy, the new version and effective date will be posted at the top of this page. For material changes, we'll note them in the next newsletter.