Gavilan Consulting Call (559) 507-2076

Privacy Policy

This page explains, in plain language, exactly what this website collects, why it collects it, who else sees it, and how to ask us to delete it.

Last updated: 9 August 2026

The Short Version

This website does not set cookies, does not run analytics, and does not track you from page to page. There is no account to create, nothing to log in to, and no advertising code anywhere on the site.

The only information you give us here is what you type into the contact form and send. That message is emailed to us. Alongside it, the site keeps a small, deliberately unreadable spam-prevention record so that one automated script cannot flood the form — that record is described in detail below, because a privacy policy that skips the awkward part is not worth reading.

Everything else on this page is the detail behind those two paragraphs.

Who This Policy Is From

This site is operated by Gavilan Consulting, Inc., trading as Gavilan Consulting. We provide computer, network and IT services on-site across California's Central Valley and remotely throughout the entire United States.

This policy covers this website: gavilanconsulting.com. It does not attempt to describe what happens to data inside a client's own systems when we are working on them under a service agreement — that is governed by the written agreement for that work, not by a web page.

Cookies, Analytics And Tracking

This site sets no cookies of its own. It does not use Google Analytics or any other analytics or measurement product. It does not store anything in your browser's local storage, does not use tracking pixels, does not embed social media widgets, and does not have advertising or remarketing tags on any page.

That is a design decision rather than an accident. The contact form's anti-spam timing check, for example, works from a signed hidden field rather than a session, which means the form can tell a real page visit from a scripted one without ever needing to put a cookie on your machine. It is also why you will not see a cookie consent banner here: there is nothing to consent to.

The one exception is on the contact page, where Google reCAPTCHA runs. Google's own script may store data in your browser as part of that check. It is Google's, not ours, and it is covered in its own section below.

What The Contact Form Collects

The form asks for your name, your email address and your message. Those three are required — without them we cannot answer you. It also has optional fields for your phone number, your company name and your city, and a menu where you pick the kind of inquiry it is. The choices in that menu are General Inquiry; Managed IT Services; Computer Repair & Tech Support; Networks, Servers & Cloud; Data Recovery, Backup & Forensics; Urgent / Something Is Down; Request a Quote; or Other.

Every one of those fields is there for a practical reason:

  • Name and email — so we know who we are talking to and can reply.
  • Phone — because most technical problems are quicker to sort out in a two-minute call than in six emails.
  • Company — so we know whether we are looking at a business network or a home machine before we call you back.
  • City — so we know whether the job is inside our on-site area. A machine in Fresno or Visalia can be visited; a customer in another state gets remote support instead, and it saves everyone a conversation if we know that up front.
  • Type of inquiry — so an urgent "something is down" message is not read in the same order as a general question.

When you submit the form, those fields are assembled into an email and sent to us. This website has no customer database, and it does not keep its own copy of your message on the web server — once the email is sent, your message lives in our email account, exactly as it would if you had emailed us directly. Our reply address on that email is set to the address you gave, so hitting Reply reaches you.

Our Email Provider

The email is sent through SendGrid, a third-party mail provider that handles outbound mail for gavilanconsulting.com. Everything you typed into the form passes through SendGrid's systems in the course of being delivered to us, and SendGrid keeps its own delivery records the way any mail provider does. We use it because mail sent straight from a shared web server tends to land in a junk folder, and a contact form whose messages are never read is worse than no contact form at all.

If you would rather not have your message go through a third-party mail provider, phone us instead on (559) 507-2076 during Monday – Friday, 9:00 AM – 5:00 PM Pacific.

Spam-Prevention Records

A public contact form with no defenses is a form that gets filled in thousands of times by scripts. To stop that, the site limits how many messages can be submitted from one internet connection in a given period: more than 5 submissions from the same address within 60 minutes and the rest are turned away.

Counting that requires telling one visitor apart from another, so here is precisely how it is done, because this is the one place on the site where something identifiable is involved.

What Is Actually Stored

Your IP address — the number your internet connection presents to every website you visit — is passed through a keyed cryptographic hash. A keyed hash is a one-way scramble that depends on a secret held on our server: the same address always produces the same scrambled value, but the value cannot be worked backwards into the address without that secret.

That scrambled value becomes the name of a small counter file, and the file itself contains only two numbers: when the current counting period started, and how many submissions have been made in it. Your address itself is never written down. The counter files live outside the public part of the website, so they cannot be fetched over the web.

Two honest caveats. First, this is not anonymity in the strongest sense: anyone who held both our server secret and a specific IP address they wanted to test could confirm a match. It is protection against the file being readable as a list of visitors, which is the realistic risk. Second, a keyed hash is still, in law, a record connected to your connection — so we describe it here rather than claiming the site collects nothing.

How Long It Is Kept

A counter file is deleted automatically once it has gone two full counting periods — 2 hours at the current setting — without being touched. The clear-out runs every time the contact page is loaded or a message is sent, so in practice a record can only sit around longer than that if nobody uses the contact page at all in the meantime. Nothing is archived, exported, or looked at for any purpose other than counting submissions.

Google reCAPTCHA On The Contact Page

The contact page uses Google reCAPTCHA v3 to tell people apart from bots. Unlike the old picture puzzles, it does not ask you to do anything — it watches how the page is used and returns a score. To do that, Google's script loads on that page and Google receives information about the visit, which can include your IP address, your browser and device details, and how you interacted with the page.

That information goes to Google and is handled under Google's terms, not ours. See Google's Privacy Policy and Google's Terms of Service. We receive only the resulting score for that one submission, and we use it for nothing except deciding whether to accept the message.

reCAPTCHA loads on the contact page only. Every other page on this site, including this one, loads nothing from Google.

Server Logs

Like effectively every website, this one runs on a web host that keeps standard server logs: the IP address a request came from, the date and time, which page was asked for, and the browser's own description of itself. These are created by the hosting platform, not by anything we wrote, and they exist so that outages, errors and attacks can be investigated.

The site also writes a technical error log when something fails — for example, if the mail provider rejects a message. Those entries record what went wrong so it can be fixed.

We do not use any of these logs to build a profile of you, we do not combine them with anything else, and we do not sell or share them. We do not set their retention period, because they belong to the hosting platform.

How We Use What You Send

We use it to answer you, to quote the work, to carry out work you ask us to do, and to keep ordinary business records of who asked us for what. That is the whole list.

We do not sell your information. We do not rent, trade or otherwise pass it to anyone for their own marketing. We do not add you to a mailing list because you asked us a question — this site has no newsletter to add you to. If we ever need to share your details with someone outside the company to do the job you asked for, we will tell you who and why first.

The exceptions are the ordinary ones: the service providers described above who handle the message on our behalf, and any disclosure we are legally required to make.

How It Is Protected

The site is served over HTTPS, so what you type into the form is encrypted between your browser and the server. The keys and secrets the site relies on are stored outside the public web directory, so a web server misconfiguration cannot serve them as text. The spam-prevention counter files are outside the public directory too.

No system is perfect, and we will not pretend otherwise — that is, incidentally, the same honesty we bring to data recovery, backup and forensics work, where the useful answer is always what can actually be guaranteed rather than what sounds reassuring.

Asking What We Hold, Or Asking Us To Delete It

You can ask us what information we hold about you, ask for a copy of it, ask us to correct it, or ask us to delete it. There is no form and no portal for this — just ask a person:

So that we do not hand your information to somebody pretending to be you, we may need to check that a request really is from you before we act on it — usually by replying to the address the original message came from.

One practical note: if you are asking us to delete a message you sent through the form, tell us roughly when you sent it and what address you used. It makes finding it much faster.

California Residents

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights. Here is where this site stands.

What is collected. Through this website: identifiers and contact details you type into the contact form yourself — name, email address, and optionally phone number, company and city — along with the content of your message and the type of inquiry you picked. Plus the internet activity information described above: your host's server logs, the keyed spam-prevention record, and whatever Google's reCAPTCHA collects on the contact page.

Where it comes from and why. Directly from you, when you choose to send it, for the purpose of responding to your inquiry and providing the services you ask for. The technical records exist to keep the site working and to stop automated abuse.

Selling and sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past. There is no advertising or tracking code on this site to do it with.

Your rights. You can request to know what personal information we have collected about you, request that we delete it, request that we correct it if it is wrong, and not be treated differently for asking. To make any of those requests, email damien@gavilanconsulting.com or phone (559) 507-2076. You are welcome to have an authorized agent make a request for you; we will ask for reasonable proof that you authorized them.

Children

This is a business website for IT services and it is not directed at children. We do not knowingly collect information from children. If you believe a child has sent us something through this site, contact us and we will delete it.

Changes To This Policy

If the site changes in a way that changes what it collects, this page is updated in the same breath, and the date at the top changes with it. We do not keep a public archive of previous versions; if you need to know what this page said on a particular date, ask and we will tell you.

Contacting Us

Questions about this policy, about anything we hold, or about the IT services we provide all go to the same two places: damien@gavilanconsulting.com or (559) 507-2076. There is no ticket system, no portal and no chatbot on this site — a message reaches a person.

The rules that apply to using the website itself are set out separately in our Terms of Use.