Privacy Policy

We use Google Analytics to count visits and see which pages people read. That sets cookies on your device and sends data to Google, for every visitor, from the first page you open. Section 4 explains what it collects and how to opt out.

Beyond that we do not track you. No advertising pixel, no retargeting tag, no heatmap, no session recorder, no profiling, and nothing sold to anybody.

We also store what you give our AI Readiness Assessment. Your result shows on screen without an email address. Asking for the fuller report by email puts your address on our marketing list at the same time: one box, ticked when the page loads, and the report email does not send if you untick it. Every marketing email carries a one click unsubscribe link. Section 7 has the detail, including how to leave the list.

One more thing worth knowing before you read further. Our contact page and the foot of our home page embed Calendly's scheduler, and when it loads it brings a set of Calendly's own third party services with it, including Stripe, Meta, and Segment. That happens inside Calendly's frame rather than on our pages, and section 6 names every one of them.

Everything below is the same story with the detail attached.

RunSimpler is a brand of Moonbound Consulting, LLC, an Illinois limited liability company. The website is runsimpler.com. The company responsible for your personal data is Moonbound Consulting, LLC, registered at 333 West Wacker Drive, Suite 2600, Chicago, IL 60606. One business, two names, and you should not have to guess which one is accountable to you.

For personal data we handle about website visitors and our own clients, we are the controller. That means we decide why and how it is used, and we are the one you hold to account.

Privacy questions and requests go to tony@runsimpler.com, marked for the attention of Anthony Drummond, President.

This policy covers this website and the personal data we handle in the course of running our business and serving clients.

It does not cover client data we process on a client's behalf as part of delivering their work. When we run a workflow that touches a client's customer data, the client is the controller and we are the processor, and the terms are in that client's signed agreement or data processing agreement rather than here.

It does not cover websites we link to. When you follow a link away from here, you are on somebody else's terms.

Google Analytics. We use Google Analytics 4, a service from Google LLC, to understand how people find and use this site. It tells us which pages get read, roughly where visitors come from, and which links work. We use it to make the site better, and for nothing else.

It runs for every visitor, from the first page load. There is no panel asking permission and no setting to answer first. Google Analytics loads as soon as the page does and sets its cookie then, the same way for everyone. The paragraph below, on legal basis, names the two ways to stop it on your own device; neither one requires us to agree first. The one exception is the private report page that the link in our assessment email opens: Analytics is switched off there, so that page sets no analytics cookie and sends nothing about the visit to Google.

Google Analytics collects your approximate location derived from your IP address, your device and browser type, the pages you view and how long you spend on them, how you arrived here, and a randomly generated identifier stored in a cookie so repeat visits can be recognized as the same browser. It does not collect your name or your email address, and we have not configured it to receive either.

On our AI Readiness Assessment we also record four interaction events with Google Analytics: that the check was started, that a question was answered, that the result screen was reached, and that the email form was submitted. The question event carries the number of the question, so we can see where people stop. No event carries your answers, your email address, your result or anything from your report. Each one arrives like any other Google Analytics hit on this site, with the device, approximate location and page information described above, and the private report page sends none of them.

Google Analytics also collects some behavior on its own, on every page of this site, through its own automatic collection rather than anything the site sends deliberately. It records page views, the start of a session, whether it is your first visit, how long the page was in front of you, when you scroll to the bottom 90 percent of a page, when you click a link that leaves the site, and the first time you interact with a form field. That last one records only that an interaction began. None of these carries what you typed.

Google acts as our processor for this, and processes the data under its own terms. IP addresses are truncated by Google Analytics 4 before storage, so we never see your full IP address in it. We do not enable Google Signals, we do not link the property to Google Ads, and we do not use it to build advertising audiences.

Legal basis, and how to opt out. Why we do it: understanding how people use this site so we can make it better. You can tell us to stop at any time by emailing us at tony@runsimpler.com. You can also opt out anywhere, regardless of legal basis, by installing Google's browser add-on at tools.google.com/dlpage/gaoptout, or by blocking cookies as described in our Cookie Policy. Nothing on this site stops working if you do.

What we do not do.

No advertising or social pixels. No Meta pixel, no LinkedIn Insight Tag, no Google Ads tag, no TikTok pixel, no retargeting of any kind. We are not following you around the internet.

No heatmaps, session recording, or profiling. We do not record your mouse movements, replay your session, or build a profile about you. We do not use your data for automated decision making.

No Google Tag Manager, and no other analytics. Google Analytics is the only measurement tool on this site.

No selling or sharing. We do not sell your personal data and we do not share it for advertising. Section 12 says this again in the words California law uses.

Cookies, honestly. Google Analytics sets two cookies on our domain, for every visitor. Apart from those two we set none: no preference cookies, no advertising cookies, nothing else. Our Cookie Policy names every cookie individually.

Self hosted fonts. Our typefaces are served from our own domain. We do not use Google Fonts, so Google does not receive your IP address because you looked at our typography.

No account, no login, no comments. You cannot create an account on this site. The one list you can end up on is our marketing list, and the only route onto it is the email step of the AI Readiness Assessment, where the marketing box arrives ticked and the report email does not send without it. You can see your result without going near that step. Section 7 explains it.

No contact form. Our contact page offers a booking calendar, and there is no contact form of ours anywhere on this site. The only fields you can type into are Calendly's own, inside the scheduler, and the email address field at the end of our AI Readiness Assessment, which section 7 describes.

One item of local browser storage. Some animations on the site remember, within a single browsing session, that they have already played, so they do not replay every time you navigate. This is stored by your browser under a key beginning rs-arrival-fired and its value is the character 1. It contains no personal data, it is not a cookie, it is never sent to our servers, and it disappears when you close the tab. It did not write during our test run, so on many visits it does not appear at all.

A second item of local browser storage, on the assessment only. While you are part way through our AI Readiness Assessment, your browser keeps the answers you have tapped so far, so a reload or a phone call does not send you back to question one. It is stored under the key rs-ai-readiness-progress. It holds the options you chose and a timestamp, nothing that identifies you, it is not a cookie and it is never sent to our servers while you are answering. We delete it when you finish, when you choose to start again, or after 14 days, whichever comes first.

A third item of local browser storage, for the announcement bar. A thin bar at the top of most pages tells you about our AI Readiness Assessment. If you press its close button, your browser remembers that you did, so the bar does not return on every page. It is stored under the key rs-announcement-dismissed. The stored value is a short label naming the announcement you dismissed, and nothing else: no timestamp, no identifier, nothing about you. It is not a cookie and it is never sent to our servers. It is written only when you press the close button. We do not delete it on a timer. It stays until you clear your browser's site data, or until we replace the announcement with a new one, at which point we delete the old value the next time the bar loads. If your browser blocks local storage, nothing breaks and the bar simply closes for the rest of your visit and returns on your next.

Serving a web page requires receiving a request, and a request carries information about the device that made it.

Our hosting provider, Vercel Inc., processes standard server log data on our behalf. That typically includes your IP address, the page requested, the time of the request, your browser and operating system as reported by your browser, and the page you came from if your browser sent one.

We use this only to serve the site, keep it running, and investigate abuse or faults. We do not use it to build a profile of you, and we do not combine it with anything else.

We keep them because a website cannot be operated or kept secure without them.

What it is. This is the significant disclosure in this policy, so it gets its own section and plain description. Our contact page embeds a scheduler provided by Calendly LLC, so you can book a call without emailing back and forth. It runs inside a frame on our page. When you use it, you are giving your information to Calendly as well as to us.

Calendly receives the name, email address, and any answers you type into the booking form, plus your time zone and the technical data any web service receives. Calendly then sends us the booking. Calendly handles that data under its own privacy policy and as a processor for us in respect of the booking itself.

When it loads. This distinction matters, so here it is precisely.

On our home page, the scheduler does not load when the page loads. It shows a still placeholder, and it loads when you scroll the booking section into view, or sooner if you click the placeholder to open it. That section is at the foot of a long page, so a reader who does not scroll that far never loads it, nothing described below reaches their browser, and no third party learns they were there.

On our contact page, the same thing happens, but the booking section is near the top of a short page, so the first time you scroll it loads. Everything below loads at that point, without you clicking anything. If you open that page and neither scroll nor touch it, nothing loads at all.

On every other page, including our work, team, finance, operations, and sales and marketing pages, the scheduler does not load at all and no third party is contacted.

Who else loads inside it. Calendly's scheduler loads its own third party services. We do not choose these and we do not receive data from them, but they run in your browser as a result of a choice we made to embed Calendly, so we name them.

Observed loading inside the Calendly frame:

1. 6.3.1Calendly (calendly.com, assets.calendly.com, dfp.calendly.com), the scheduler itself
2. 6.3.2Google (www.googletagmanager.com, www.google-analytics.com, www.gstatic.com, fonts.gstatic.com, accounts.google.com, www.recaptcha.net), analytics, fonts, sign in, and bot protection
3. 6.3.3Stripe (js.stripe.com, m.stripe.com, m.stripe.network), payment and fraud detection, present because Calendly supports paid bookings
4. 6.3.4OneTrust (cdn.cookielaw.org, geolocation.onetrust.com), Calendly's own cookie consent tool
5. 6.3.5Meta (connect.facebook.net), Facebook's advertising and analytics library
6. 6.3.6Twilio Segment (cdn.segment.io), event data routing
7. 6.3.7Sprig (cdn.sprig.com, api.sprig.com), in product surveys
8. 6.3.8Braze (js.appboycdn.com), customer messaging
9. 6.3.9Airbrake (notifier-configs.airbrake.io), error reporting
10. 6.3.10Two hosts we have not been able to attribute (featureassets.org, prodregistryv2.org), contacted from inside Calendly's frame using a Calendly key. We do not know which company runs them, and we are not willing to guess in a privacy policy, so we name what loads and tell you plainly that we could not identify who receives it.

What this means for you. Because the scheduler runs inside a frame, these services see your interaction with Calendly rather than with our site, and the cookies they set belong to their own domains rather than ours. Our Cookie Policy names each cookie and its lifetime.

If you would rather none of this loaded, do not open our contact page and do not click the booking button. Email us instead at tony@runsimpler.com and we will arrange a call by hand. That option is real, and we would rather tell you about it than bury it.

If you email us or book a call, we hold what you send, which is usually your name, email address, company, and whatever you tell us about your situation. We use it to reply and to work out whether we can help. Legal basis: legitimate interest in responding to a business enquiry, or steps at your request before entering a contract.

If you become a client, we hold what running the engagement requires. Contact details for you and your team, billing and payment details, the contents of our correspondence, access credentials and account permissions for systems we operate on your behalf, and the materials you give us to work with. Legal basis: performance of our contract with you, and compliance with our legal obligations for tax and accounting records.

If you attend a workshop or download something we publish, we hold the details you gave us to attend or download, and we may follow up about related work. You can tell us to stop at any time and we will.

We do not buy personal data from data brokers, and we do not sell yours.

The AI Readiness Assessment. Our AI Readiness Assessment, at runsimpler.com/tools/ai-readiness-assessment, asks twenty multiple choice questions about your business. You pick from the answers we offer, and there is no box to type into. It scores your answers and shows you the result on screen. You do not have to give us your name or email address to see it.

We store your answers and the score we work out from them in a database. The database is run for us by Neon, in the United States.

If you give us your email address. After the result, we ask for an email address so we can send you a fuller report, and asking for it puts you on our marketing list in the same step. If you give an address, we do four things. If you do not, we do none of them, and your result stays on the screen in front of you.

1. 7.3.1We link your answers and your score to that address in our database.
2. 7.3.2We email you the report from mail.runsimpler.com, using Resend.
3. 7.3.3We give you a link to your report that carries a long random code.
4. 7.3.4We add the address to our marketing list, because the box beside the field is ticked and the report email will not send without it.

The report link. The link goes to your report at an address that includes a long random code, and it does not ask you to log in. Anyone who has the link can open the report, including anyone you forward the email to, so share it only with people you would show the report to. The link keeps working until we delete the report, which happens at the end of the period in section 10, or sooner if you ask.

The marketing list. Asking us to email you the report puts your address on our marketing list. The box that does it sits beside the email field, it is ticked when the page loads, and if you untick it the report email does not go out and your address does not join the list. The label beside the box says all of this before you send anything. Your address then goes onto an audience we keep at Resend, and we use the list to send you marketing emails about our services. Every marketing email carries an unsubscribe link, one click, and when you use it we stop. You can also email tony@runsimpler.com and we will take you off, and leaving the list does not delete your report or stop the link working. Your result is on screen before any of this, free, and reading it does not depend on the list.

If you book a call from your report. The booking button in your report opens our Calendly page with your email address and the name of your finding already filled in, so whoever takes the call knows who you are and what the report said. Both travel to Calendly in the address of the booking page, and Calendly handles them under its own terms, as section 8 describes for the rest of what you give it. We pass nothing else from your report, and not the report link.

Legal basis. We store your answers, link them to your email address and send you the report because you asked us for the report and we need them to produce it and to keep it available to you. For marketing emails, you agree by sending the form with the marketing box ticked, which is how the box arrives. Asking for the report by email and joining the list are one action here, not two. You can stop the marketing emails at any time with the unsubscribe link in each one, and stopping them does not affect anything we sent before or the report you already have. How long we keep the assessment record is in section 10.

Who handles it. Vercel hosts the assessment pages. Neon holds the database. Resend sends the emails and holds the marketing list. Each acts as our processor and handles the data under its own terms. Section 8 lists them with the rest of our providers.

We share personal data with service providers who help us run the business, and only as far as they need it to do their job for us. They are: Vercel for hosting and infrastructure; Microsoft 365 for email and calendar, with Proofpoint filtering the mail before it reaches us; Calendly for scheduling and Zoom for the calls it books; Google Analytics for measurement; Neon for the database behind our AI Readiness Assessment; Resend for the emails it sends and for our marketing list; QuickBooks for accounting and for payments; and Adobe for document signing.

We also share where the law requires it, where we need to establish or defend a legal claim, and, if the business is ever sold or reorganized, with the party acquiring it. If that last one happens, this policy travels with the data.

We do not sell personal data and we do not share it for cross context behavioral advertising, as those terms are used in California law. We have never done this and have no plans to.

We are based in the United States and our service providers are mostly based there. Some of our clients are outside the United States.

If you are in the European Economic Area, the United Kingdom, or Switzerland and you give us personal data, it will be transferred to and stored in the United States. Transfers are made under the EU-US Data Privacy Framework certification where the vendor holds it, and under the European Commission's Standard Contractual Clauses with the UK Addendum where it does not, together with the supplementary measures our service providers apply.

When a period ends we delete the data or anonymize it so it can no longer identify you.

The marketing list is kept apart from the assessment record. When an assessment record reaches the end of its period, and its report link stops working, an address that joined the marketing list through the assessment stays on it until you leave or ask us to remove it.

We are a US business and this site is written for US companies. We do not market in the United Kingdom or the European Economic Area.

Wherever you are, you can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, and we will do it. You can leave our marketing list at any time, with the unsubscribe link in every marketing email or by writing to us, and leaving does not affect what we did before. The next section sets out the additional rights California residents have by law.

If you think we have handled something badly, write to us first and we will look at it. If the rules where you live give you a route to a regulator, that route is yours and nothing here is meant to take it away.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we have collected about you, the sources, the purpose, and the categories of third party we disclosed it to; the right to delete it; the right to correct it; the right to opt out of sale or sharing for cross context behavioral advertising; the right to limit use of sensitive personal information; and the right not to be discriminated against for exercising any of these.

Two of those need a direct answer rather than a recital. We do not sell your personal information and we do not share it for cross context behavioral advertising. We do not collect sensitive personal information for the purpose of inferring characteristics about you, so the right to limit does not currently have anything to bite on.

We honor these rights as a voluntary commitment rather than as a statutory obligation, and we extend them to every US resident rather than only to residents of the states whose legislatures have passed a law. The rights are the same wherever you live.

Email tony@runsimpler.com and tell us what you want us to do.

We will need to be reasonably confident you are who you say you are before we hand over or delete anything, so we may ask you to confirm something only you would know. We will not ask you for more information than the request needs.

We respond within 45 days for CCPA requests and within 30 days for any other request, and we will tell you if we need an extension the law allows. There is no charge unless a request is manifestly unfounded or excessive, and we will tell you before charging anything.

An authorized agent may make a request for you. We will ask for proof that you authorized them.

We use access controls, encryption in transit, multi factor authentication on business systems, and least privilege access to client systems.

No system is perfectly secure and anyone who tells you otherwise is selling something. If a breach affects your personal data and the law requires us to tell you, we will tell you, and we will tell you what happened rather than issue a statement that says nothing.

This site and our services are for businesses. We do not direct them at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email tony@runsimpler.com and we will delete it.

When we change this policy we update the date at the top. If a change materially affects how we handle your personal data, we will do more than change a date. We will say what changed.

Because this policy describes specific third parties observed loading on this site, any change to what the site loads requires a change here as well. That is a maintenance obligation we are taking on deliberately, and a vague policy would have avoided it. We think the specificity is worth the upkeep.