1. Who we are
The controller responsible for your personal data is Aisleweb LLC, 8602 W 166th St, Overland Park, KS 66085 (“Aisleweb”, “we”, “us”).
To contact us about privacy — including exercising any of your rights — use our contact form and choose Privacy / data protection request.
2. Data we collect
When you contact us
Name, email address, company (optional), the service you're interested in, budget range (optional), your message, confirmation that you read this policy, and the IP address your request came from (used to prevent abuse).
When you browse
Our servers record standard technical information needed to deliver the site securely: IP address, date and time, page requested, browser type and referrer. The web server in front of the site also keeps an access log of every request for security, abuse investigation and traffic analysis: the time, the IP address, the page requested, the response status and size, browser type and referrer. Cookies and sign-in credentials are never recorded, and secret tokens in links are replaced. These access logs are stored with a cloud storage provider in the United States. We do not use advertising or cross-site tracking, and we do not build profiles of you.
Analytics (only with your consent)
If you allow Analytics, we use a web analytics service to understand how visitors use the site: pages viewed, time on page, how you arrived (referrer and campaign links), approximate location (country and city, derived from your IP address), device type, browser, operating system, screen size and language. The analytics service stores a random identifier in the _ga cookies so repeat visits can be counted. The service does not log or store IP addresses for users in the EU; it uses them only briefly to derive the approximate location and then discards them. We have turned off cross-device signals and all advertising features, and we do not send names, email addresses or other directly identifying data to it. Without your consent, analytics is not loaded at all.
Security check
The contact form uses a self-hosted image challenge. It involves no third party and stores no personal data.
3. Purposes & legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Responding to your enquiry and preparing a proposal | Contact form data | Art. 6(1)(b) — steps prior to a contract, at your request; otherwise Art. 6(1)(f) — our legitimate interest in answering enquiries |
| Preventing spam, fraud and abuse | IP address, security check result | Art. 6(1)(f) — legitimate interest in keeping the site secure |
| Delivering and securing the website | Technical server data, strictly necessary cookies | Art. 6(1)(f); strictly necessary storage is exempt from consent under ePrivacy rules |
| Showing publisher images in our news feed | Your IP address, shared with the publisher's server | Art. 6(1)(a) — your consent, which you can withdraw at any time |
| Measuring how the website is used, to improve its content and performance (web analytics) | Usage data, device and browser details, approximate location, _ga cookie identifier, IP address (briefly, by the analytics provider) | Art. 6(1)(a) — your consent, which you can withdraw at any time; storing and reading cookies on your device also requires your consent under ePrivacy rules |
| Demonstrating your cookie choice | A random consent ID, your choice and the policy version (no IP address) | Art. 6(1)(c) — legal obligation to prove consent (Art. 7(1)) |
4. Who receives data
We never sell personal data or share it for marketing. We use carefully selected processors bound by data-processing agreements under Art. 28 GDPR:
- Cloud hosting provider. It runs the server that delivers this website, stores enquiries in our database and keeps the technical server logs described above. The server is located in Lenexa, Kansas, United States.
- Email delivery provider, in the US East (N. Virginia) cloud region, United States. It delivers each contact-form enquiry to our team by email. The email contains the details you entered in the form (name, email address, company, service, budget and message), but not your IP address.
- Email mailbox provider: hosts the inbox where our team reads and answers enquiries.
- Content delivery network — a public content delivery provider delivers the open-source fonts, styles and scripts this site uses. Your browser requests them directly, so it receives your IP address and browser details, which it uses only to deliver the files and to produce aggregated usage statistics. It sets no cookies. Our legal basis is our legitimate interest in a fast, reliable website (Art. 6(1)(f) GDPR).
- Web analytics provider, acting as our processor under a data processing agreement. Only if you consent to Analytics. Its own privacy policy applies to the data it processes.
If you allow external media, the publishers whose images appear in our news feed (for example cloud and software companies and technology news outlets) receive your IP address when your browser loads those images. Their own privacy policies apply. Links to news articles open the publisher's site, which is governed by its own policy.
5. International transfers
If a processor handles data outside the EU/EEA or UK, we ensure an adequate level of protection: an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses with supplementary measures where needed.
Some of your personal data is processed outside the EU/EEA and the UK:
- Hosting (Lenexa, Kansas, United States): server logs and the enquiries you send are stored on our server there. The transfer relies on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), plus the UK International Data Transfer Addendum, in our data processing agreement with the hosting provider.
- Email delivery (US East (N. Virginia)): the transfer relies on the EU–US Data Privacy Framework (Art. 45 GDPR), under which our email delivery provider is certified, together with the UK Extension and the Swiss–US framework. As a fallback, the Standard Contractual Clauses (Art. 46(2)(c) GDPR) and the UK International Data Transfer Addendum are built into its data processing agreement.
- Web analytics (only with your consent): our analytics provider may process analytics data on servers in the USA and other countries. The transfer relies on the EU–US Data Privacy Framework (Art. 45 GDPR), under which the provider is certified, together with the UK Extension and the Swiss–US framework. As a fallback, the Standard Contractual Clauses (Art. 46(2)(c) GDPR) are included in its data processing terms.
Data is encrypted in transit (TLS) between your browser, our server and our email provider. You can check certifications on the Data Privacy Framework list. To get a copy of the safeguards, ask us through the contact form.
The content delivery provider serves files from a global network, so your browser may fetch them from servers outside the EU/EEA, including in the United States. Those requests include your IP address but no form data.
6. How long we keep it
- Enquiries: up to 24 months after your last contact, unless they lead to a contract (then kept as required by tax and commercial law).
- IP address of enquiries: automatically erased after 30 days.
- Your cookie choice: stored in your browser for 6 months, after which we ask again.
- Consent records: kept for 3 years to demonstrate compliance, then deleted.
- Web analytics: event-level data is deleted after 2 months; only aggregated reports, which don't identify you, are kept longer. The
_gacookies expire after 13 months, or straight away when you withdraw consent. - Server logs: no longer than 30 days, unless needed to investigate a security incident.
- Web server access logs: deleted automatically after 180 days.
Retention periods are enforced automatically every day.
7. Cookies
Cookies are small files stored by your browser. We use as few as possible and none for advertising. Analytics cookies are only set if you allow them.
| Name | Purpose | Category | Duration |
|---|---|---|---|
aw_consent | Remembers your cookie choice | Strictly necessary | 6 months |
aw_csrf | Protects the contact form against cross-site request forgery | Strictly necessary | 1 year |
aw_session | Keeps the confirmation message after you submit the contact form | Strictly necessary | Up to 8 hours |
| Set by publishers | Publisher servers may set their own cookies when their images load | External media (optional) | Set by the publisher |
_ga | Analytics: a random ID that distinguishes visitors, so repeat visits are counted | Analytics (optional) | 13 months |
_ga_C1N384G29H | Analytics: keeps track of your current session | Analytics (optional) | 13 months |
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data — “right to be forgotten” (Art. 17)
- Restrict how we process it (Art. 18)
- Receive your data in a portable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, without affecting earlier processing (Art. 7(3)), using the cookie settings on this page or the Cookie settings link in the footer
- Complain to a data protection supervisory authority, in particular in the EU country where you live or work, or to the UK Information Commissioner's Office (Art. 77)
To exercise a right, use the contact form and choose Privacy / data protection request. We respond within one month and may ask you to verify your identity. We make no automated decisions or profiling that affect you.
9. Security
All traffic is encrypted with HTTPS (TLS). Access to enquiries is limited to authorised staff, and the site is protected against common attacks. Files loaded from our content delivery network are pinned to exact versions and checked with Subresource Integrity, so your browser rejects anything that has been altered.
10. Changes to this policy
We will update this page if our practices change. If a change affects your cookie choices, we will ask for your consent again.