Privacy Policy — what this website does with your data

This policy covers onealgorithm.com, including the blog at /blog. It is written by ONE ALGORITHM LLC (OneAlgorithm), a company registered in Pennsylvania, United States. It describes what this website actually does — not what a privacy policy usually says.

The short version

What happens when you use the contact form

The contact form is the only place on this site where you type anything about yourself. It asks for six things:

• First name
• Last name
• Email address
• Company name
• What you need — a service picked from a list
• A free-text message

Before it sends, the form runs two anti-spam checks. The first is a hidden field that people never see and automated scripts fill in — if it has a value, the submission is discarded in your browser and nothing is sent anywhere. The second is Cloudflare Turnstile. Your browser loads a small script from Cloudflare (only on the contact page, nowhere else on the site) and sends Cloudflare a token along with technical signals about the browser itself. Cloudflare checks it and tells us pass or fail. We receive only that answer, never the underlying signals. Cloudflare states that Turnstile does not use this data to track individuals or to target advertising.

When you press send, your browser posts the six fields and that token to /api/lead on this domain — our own code, running on Cloudflare's network. It confirms the token with Cloudflare, which involves sending Cloudflare your IP address so the token can be tied to the browser that solved it. If the check passes, our code forwards your details to Salesforce Web-to-Lead.

That forwarding happens server to server, so Salesforce receives what you typed but not your IP address and not the page you were reading. The result is a Lead record in our Salesforce CRM. We use it to reply to you, to work out whether we can help, and to keep track of the conversation if one follows. If you are in the EU or UK, the legal basis is taking steps at your request before entering a contract, together with our legitimate interest in answering enquiries about our own services and in keeping the form free of spam.

You can also just email or call us. Those arrive in our normal company email and phone systems (Microsoft 365) and are kept like any other business correspondence.

What we collect when you are just reading

This site is hosted on Cloudflare Pages, and every request to it passes through Cloudflare's network. As with any web host, that produces a server-side record containing your IP address, the page you asked for, the time, your browser and operating system, and the page that referred you. Cloudflare also uses this to tell automated traffic from real visitors and to absorb attacks, and it may set a cookie of its own for that purpose. We rely on our legitimate interest in keeping the site up and secure.

We do not have a login, a shopping basket, or any feature that builds a profile of you across visits.

Cookies and analytics

We use Google Analytics 4 (measurement ID G-RC48CMQ05T). It loads from Google's servers and sets cookies in your browser. It records which pages you look at, how long for, where you arrived from, your device and browser, and an approximate location that Google derives from your IP address.

None of it runs until you agree. Nothing from Google loads on your first visit — you are asked first, and if you decline, the script is never fetched and no cookie is set. Withdrawing is as easy as giving it:

Change my cookie choice

We also send Google three specific events:

• You submitted the contact form.
• You tapped the phone number.
• You tapped the email address.

Each carries which of the three it was and the address of the page you were on. None of them carries your name, your email address, or anything you typed into the form. Analytics only runs on onealgorithm.com and www.onealgorithm.com — preview and staging copies of this site are silent.

There is currently no cookie banner on this site, so these cookies are set when the page loads. If you would rather they were not, you can install the Google Analytics Opt-out Browser Add-on, block cookies for this site in your browser settings, or turn on your browser's tracking protection. Nothing on this site stops working if you do.

The map and the blog

The map. Our contact page embeds a Google Maps frame showing our Malvern office. It only loads if you scroll down far enough to reach it. When it does, your browser connects to Google, which means Google receives your IP address and the fact that you were on our contact page, and may set its own cookies. If you never scroll to the map, none of that happens.

The blog. Our blog at /blog is a separate application built on Ghost, served under this domain through Cloudflare. It keeps its own server logs and sets its own cookies, and if you sign up there to get posts by email, it stores the address you give it. Unsubscribe links are in every email it sends.

Who else sees your information

We do not sell or rent your information. These are the companies that handle it on our behalf, and what each one gets:

• Salesforce — everything you type into the contact form, but not your IP address and not the page you submitted from. It is our CRM.
• Google — analytics about your visit, and, if you scroll to the map on the contact page, the request that loads it.
• Cloudflare — every request to this site, as our host and network provider; the Turnstile bot check, including your IP address; and the form endpoint that passes your enquiry to Salesforce.
• Ghost — anything you do on the blog, including a subscription email address if you give one.
• Microsoft — email and calls you send us directly, because our company email runs on Microsoft 365; and, if you agreed to analytics, how you used the page, through Microsoft Clarity. Clarity passes what it collects to Microsoft's advertising network as well as to us.

Beyond those, we will disclose information if the law requires it, if we need to defend our legal rights, or if the business is sold or merged — in which case the buyer inherits this policy until they publish their own. Anything else needs your say-so.

What this site does not do

• We do not sell or rent personal information, and we never have.
• There are no advertising or social pixels on this site — no Meta, no LinkedIn, no TikTok, no retargeting tags.
• There is no chat widget watching what you type, and no tool that records anything you enter into a form. We do use Microsoft Clarity, which replays how a page was used — where a visit scrolled to, what got clicked — but only if you agreed to analytics, and it masks the text of form fields. Decline, or send Global Privacy Control, and it never loads.
• Our fonts are served from this domain, not from Google Fonts, so reading the site does not send your IP address to a font provider.
• This site is not aimed at children, and we do not knowingly collect information from anyone under 13. If you believe a child has sent us something, email us and we will delete it.

How long we keep it

We have not set a fixed retention schedule. Enquiries stay in our Salesforce CRM until we delete them, because a business enquiry can turn into a live conversation years later. Analytics data is kept for as long as the retention setting on our Google Analytics property allows, which Google enforces. Cloudflare and Ghost keep their logs on their own schedules.

We would rather tell you that a period is undefined than print a number we do not actually enforce. If you want your record removed, ask and we will remove it.

Your rights, and how to use them

Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Email service@onealgorithm.com with "Privacy request" in the subject line and tell us what you want. We may need to ask a question or two to confirm you are the person the record is about. We do not charge for this, and asking will not change how we treat you.

If you are in California

Under the CCPA as amended by the CPRA, the categories of personal information this site collects are identifiers (name, email address, employer, IP address), internet activity (pages viewed, referrer), approximate geolocation derived from your IP address, and whatever you choose to write in the message box. It comes from you directly, or from your browser as you use the site. We collect it to respond to enquiries, provide our services, keep the site working, and meet legal obligations.

You have the right to know what we have collected, to have it deleted, to have it corrected, and not to be discriminated against for asking. You may use an authorised agent. We do not sell personal information, and we do not share it for cross-context behavioural advertising — this site runs no advertising tags. We do not use or disclose sensitive personal information beyond what is needed to provide what you asked for.

If you are in the EU or the UK

We are a US company and we do not have an establishment in the EU or UK, but if the GDPR or UK GDPR applies to you: our legal bases are your request and our legitimate interests, as set out in each section above. You have the right to access, correct, erase, restrict, port, or object to our processing of your data, and to complain to your national data protection authority or, in the UK, the Information Commissioner's Office.

Be aware that this website is hosted in the United States and every processor named above is a US company, so your data is transferred to and stored in the United States.

We are not going to claim a certification or a compliance framework we do not hold. This policy describes what we do; it is not a statement that we have been audited against any standard.

If you are in Canada, the UAE, or India

We work in those countries, but this website and everything it collects sit in the United States. Local law may give you rights beyond the ones above; if it does, ask us using the same email address and we will deal with your request on the same terms.

Security

The site is served only over HTTPS, with HSTS, a strict referrer policy, and headers that stop it being framed by another site. The contact form travels over encrypted connections the whole way, and the bot check that guards it is verified by our own server rather than in your browser, where anyone could skip it. Access to the CRM is limited to people at this company who need it.

No website can promise perfect security, and we are not going to. The contact form is a normal business enquiry channel: please do not send us passwords, payment details, classified or controlled unclassified information, or anything else you would not put in an ordinary email.

Changes to this policy

If we change what this site does with data, we change this page and move the "Last updated" date at the top. There is no mailing list for policy changes, so the date is the thing to check. Material changes take effect when they are published here.

This version was published on August 12, 2026.

How to reach us

Privacy questions, or a request to see or delete your data, go to the same place as everything else:

Our Terms & Conditions cover the rest of your use of this site.