Privacy Policy

We sell governance and compliance services. It would be strange to write a privacy policy nobody can read, so this one is in plain language. If anything here is unclear, email us and we will explain it.

This policy explains how Jecovia, LLC ("Jecovia," "we," "us"), handles personal information collected through jecovia.com and through direct correspondence with us.

Jecovia is a technology consultancy based in New York, United States. You can reach us at info@jecovia.com.

Back to top

If you become a client, the data we handle inside an engagement — your systems, your employee records, your patient or customer data, your contracts — is not governed by this policy. That information is covered by your engagement agreement, any non-disclosure agreement, and where applicable a Business Associate Agreement under HIPAA or a data processing agreement.

In those engagements Jecovia typically acts as a service provider or business associate processing data on your instructions, not as an independent controller. Nothing on this page overrides those agreements. Where the terms conflict, the engagement agreement wins.

This policy also does not cover third-party websites we link to. Their practices are their own.

Back to top

We only ask for what we need to respond to you.

• Through the contact form: your name, company name, email address, optional phone number, company size range, the reason you're reaching out, and whatever you write in the message field.
• Through email or a scheduled call: anything you choose to send us, including attachments. If you email us a copy of a contract, an audit request list, or a system inventory, we treat it as confidential and we do not retain it beyond what's described in Section 8.

Please don't send us sensitive data through the website. Do not submit Social Security numbers, financial account numbers, health or patient information, credentials, API keys, or copies of identification through the contact form or by unencrypted email. If an engagement requires that kind of material, we will set up a secure channel first.

Back to top

When you visit the site, our hosting provider records standard technical data in its server logs, such as IP address, browser type, the page requested, and timestamps. We use this only to keep the site working and detect abuse.

We use Google Analytics to understand how the site is used: which pages and articles people read, how they found the site (for example a search engine, LinkedIn or a link from another site), roughly where they are (country and city, worked out from the IP address), the type of device and browser, and whether a contact form was sent. Google Analytics does not log or store IP addresses, and we never send it your name, email or anything you type into a form. We see these numbers only as totals in reports, not as a record of any one person.

How it starts depends on where you are, which we work out from your connection (we don't store it):

• In the European Union and European Economic Area, the United Kingdom and Switzerland, Google Analytics doesn't load and nothing is sent to Google unless you click Allow in the cookie banner.
• Everywhere else, including the United States, Google Analytics is on when you arrive, and a notice at the bottom of the page lets you turn it off. If your browser sends a Global Privacy Control signal, we treat it as turning analytics off.

Wherever you are, you can change your choice at any time with "Cookie settings" at the bottom of every page, and your choice always takes priority.

When you send the contact form, it also includes, automatically: the address of the page you sent it from, the page that referred you to the site, and any campaign tags (UTM values) in the link you followed. Links we share on LinkedIn carry UTM tags so we can tell a visit came from LinkedIn.

Back to top

The only cookies on the public site are Google Analytics' first-party cookies (named _ga and _ga_ followed by an ID), which tell one visit from another and last up to two years. They are set only when analytics is on for you, as described in section 4. If you choose "No thanks" or "Turn off", or your browser sends Global Privacy Control, they aren't set, and any already set are deleted. We keep your choice in your browser's storage so we don't ask on every page, and ask again after a year.

The contact form's spam protection works without cookies. Staff who sign in to our private admin area use browser storage to stay signed in; visitors never do.

We do not use advertising cookies, retargeting pixels, social media trackers, or session-recording tools. Google Analytics' advertising features (Google signals and ad personalization) are turned off, and we don't link Analytics to any advertising account.

Back to top

We use personal information only to:

• Respond to your inquiry and schedule a conversation
• Prepare and send a scoped proposal if there's a fit
• Deliver services you've engaged us for, and communicate about them
• Send occasional written material you specifically asked to receive, such as a checklist or a newsletter — never without your request
• Maintain security, prevent fraud and spam, and keep records of our own business decisions
• Meet legal, tax, insurance, and professional obligations

We do not use your information to train machine learning models, and we do not feed client or prospect material into public AI tools.

Back to top

Our whole business model is that we're paid by clients and nobody else. That extends to data.

• We do not sell personal information.
• We do not rent, trade, or license contact lists.
• We do not share your information with software vendors, resellers, or referral partners — not as a lead, not as an introduction, not for a fee.
• We do not use your inquiry as an example, case study, or reference without your written permission.

If a vendor ever contacts you claiming Jecovia referred you, that did not come from us. Tell us and we will look into it.

Back to top

Back to top

We share personal information only with service providers who help us operate, and only to the extent they need it.

Contact form submissions are sent to HubSpot, which stores and processes them for us: your name, email, phone (if given), company, role, company size, reason, timeline, services of interest, your message, the page you sent it from, the referring page and any UTM values. HubSpot's own privacy policy also applies to that processing.

When analytics is on for you, Google receives the usage information described in section 4 as our service provider for Google Analytics. Google's privacy policy also applies to that processing, and you can also block it with Google's browser add-on (tools.google.com/dlpage/gaoptout).

We share articles on LinkedIn. When you view or interact with our posts on LinkedIn, LinkedIn's own privacy policy applies, not this one.

We will also disclose information where we are legally required to — a subpoena, a court order, a regulatory demand — or where necessary to protect our rights or someone's safety. If we receive a legal demand for your information, we will notify you unless we are prohibited from doing so.

If Jecovia is ever acquired or merged, information may transfer as part of that transaction. You would be notified before your information became subject to a different policy.

Back to top

• Access controls — people get only what their role requires
• Encryption in transit (TLS) across the site
• Secrets kept out of source code

No system is perfectly secure, and we won't claim otherwise. If a breach affects your personal information, we will notify you and any required regulator within the timeframes the law sets.

Back to top

Wherever you live, you may ask us to:

• Access — tell you what personal information we hold about you
• Correct — fix anything inaccurate
• Delete — remove your information, subject to legal retention requirements
• Port — send you a copy in a portable format
• Opt out — stop receiving any communication from us
• Object or restrict — limit how we use your information

Email info@jecovia.com with your request. We will confirm receipt within 10 business days and respond substantively within 45 days. There is no charge, and we will not treat you differently for asking.

We may need to verify your identity before acting, which usually means confirming you control the email address on file. An authorized agent may act for you with written permission.

Back to top

Under the CCPA as amended by the CPRA, California residents have the rights listed in Section 11, plus the right to know the categories of personal information collected, the sources, the business purpose, and the categories of third parties it's disclosed to — all of which are described in Sections 3, 4, 6, and 9 above.

Jecovia does not sell personal information and does not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding twelve months. We do not knowingly collect the personal information of anyone under 16.

We do not use or disclose sensitive personal information for any purpose beyond what is permitted without a right to limit.

Back to top

You have substantially the rights described in Section 11, including the right to appeal a denial. To appeal, reply to our decision with the word "Appeal" and a brief explanation. We will respond within 45 days. If we deny the appeal, you may contact your state Attorney General.

Back to top

Jecovia operates in the United States. If you contact us from outside the US, your information will be processed in the US and may be processed by our providers in other countries, which may have different data protection laws than your country.

Where the GDPR or UK GDPR applies, our lawful bases are: legitimate interests (responding to a business inquiry, securing our site), performance of a contract (delivering engaged services), consent (any material you asked to receive, which you may withdraw at any time), and legal obligation (tax and regulatory records). You may lodge a complaint with your supervisory authority.

Back to top

The site is meant for business audiences. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, email info@jecovia.com and we will delete it.

Back to top

If we change this policy we will update the "last updated" date at the top. For changes that materially affect how we handle information already collected, we will notify anyone with an active engagement or an open inquiry by email before the change takes effect.

Back to top

Questions, requests, or complaints:

We answer privacy inquiries ourselves. There is no ticketing system and no form.

Contact us

Back to top