Privacy Policy

Effective 2026-08-02

Who we are

Tuuma, LLC is a Delaware limited liability company. We build and operate B2B growth systems for clients: websites, demand programs, and the infrastructure behind them. This policy covers tuuma.com and its subdomains, except where a page states its own terms (the “Site”), and personal information we handle when you correspond or do business with us. It does not cover client websites we build, which are governed by their owners’ policies.

Analytics and cookies, consent first

Today, tuuma.com sets no cookies and loads no analytics or marketing scripts. We do not run third-party advertising trackers, we do not share personal information for cross-context behavioral advertising, and we do not permit other parties to collect information about your activity over time and across other websites through the Site. Our hosting provider (Vercel) keeps standard server logs, such as IP address, request URL, and browser type, which we use to operate and secure the Site. Our rule for the future: no analytics or marketing script will load before you make a choice. If the Site ever shows a consent banner and you accept, one cookie will remember your choice and the accepted tools will load; if you decline, or your browser sends a Global Privacy Control signal, they stay off. If the Site’s practices change, this policy changes with them.

Forms and subscriptions

If you write to us, or use a form, booking link, or newsletter signup where the Site offers one, we keep what you send: typically your name, work email, company, and message. It goes into our systems so we can respond, and, for prospective clients, so we can run the sales conversation you started. Marketing emails provide a way to unsubscribe, and unsubscribe requests are honored promptly. When we research prospective clients, business contact information sometimes comes from public and professional sources, such as LinkedIn.

Working with us

For clients and prospective clients we keep the business information the relationship needs: contacts, roles, correspondence, agreements, billing details, and the records of our work together. We use it to deliver services, invoice, and communicate. We do not sell personal information, and we do not share it as the California Consumer Privacy Act defines sharing.

Client engagement data

Work we perform inside a client’s own systems is governed by our agreement with that client, including, where agreed, our Data Processing Addendum, not by this policy. Person-level data belonging to one client is not shared with or used for another client; our client agreements commit us to that separation.

AI

We use AI systems throughout our work. When your information passes through AI tools, we use commercial tiers that do not train on customer content by default, we do not opt in to training, and we do not submit your information through feedback channels that would permit it. We review the data-handling terms of vendors in our data path.

Service providers

A small set of providers runs the business for us: hosting (Vercel), business email and documents (Google Workspace), code and work-product storage (GitHub), AI tools (Anthropic, OpenAI), and, where we adopt them, a CRM, a scheduler, a newsletter sender, a billing provider, and consent-gated analytics. They process data for us under their own security commitments; like most infrastructure providers, they may also process limited data for their own security, abuse prevention, billing, and legal compliance. The current list is available on request.

Your choices and rights

The Site sets no tracking cookies today and we do not sell or share personal information, so a Global Privacy Control signal has nothing to opt out of; when consent controls launch, you will be able to change your choice at any time from the preferences link, and Global Privacy Control will be treated as declining. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information we hold about you. Write to legal@tuuma.com; we respond within the time the law requires and never treat you differently for exercising a right. Security concerns go to security@tuuma.com.

Retention and security

We keep personal information only as long as the purposes above need or the law requires, then delete or de-identify it; copies may persist temporarily in routine backups, which age out in the ordinary course. We protect it with access controls, least-privilege credentials, and encryption in transit, with encryption at rest where the storage system supports it.

Scope and changes

We are based in the United States; our providers may process data in other locations under their own safeguards and our agreements with them. The Site is not directed to children under 16 and we do not knowingly collect their information. When this policy changes, the effective date above changes with it; prior versions remain available at their dated addresses.

Dated copy, effective 2026-08-02. The current version lives at tuuma.com/legal/privacy.