Privacy Policy

About This Policy

This policy explains what information we collect when you visit legalaigovernance.com (the "Site"), how we use it, who we share it with, and what rights you have over it. It covers the public website, the newsletter sign-up form, and any email correspondence you initiate with us. It does not cover services offered to firms under a separate agreement; those engagements are governed by their own terms.

The Site is operated by Desired Path Consulting LLC, a North Carolina limited liability company owned by Brian Alenduff. For privacy purposes, Desired Path Consulting LLC is the data controller for the information described here. You can reach us at brian@desired-path.com.

Information We Collect

Newsletter sign-up form. The form embedded on the home page and at /newsletter/ is hosted by Tally. When you submit it, we collect:

• Your first name
• Your email address
• Your firm or company name
• Your firm or company size
• The US state where you primarily practice
• Whether you have opted in to receive email updates

All fields except the opt-in checkbox are required to submit the form. Tally hosts the form and stores submissions on our behalf; the information then flows to us so we can respond and, if you opted in, add you to the newsletter list.

Aggregate site analytics. We use two cookieless web analytics services: Cloudflare Web Analytics and Ahrefs Web Analytics. Neither sets cookies and neither stores personal information about individual visitors. They produce aggregate counts such as page views, country, browser, and referrer.

Ahrefs derives a daily visitor identifier from a rotating salt combined with the request's IP address and user-agent, then discards the raw IP and user-agent. The salt is regenerated every 24 hours so the identifier cannot be linked across days.

Per page view, Ahrefs receives the requested URL, HTTP referrer, page title, the browser's language list, screen width and height, device-pixel-ratio, and the daily-rotating hashed visitor identifier described above. Ahrefs also records clicks on links anywhere on the Site, capturing the destination URL of the link (for example, the URL of a primary-source bar opinion, court order, or external resource a visitor opens from a tracker page); the surrounding page context is not captured beyond what the per-page-view fields already include. The newsletter sign-up form is hosted by Tally and is loaded inside an iframe served from a separate origin, so Ahrefs does not observe newsletter form submissions.

Server and security logs. Like any site behind a CDN, ours sees standard request metadata (IP address, user agent, requested URL, time stamp) for the purpose of delivering content, defending against abuse, and rate-limiting bots. Cloudflare processes this metadata for us under its standard logging defaults and retention schedules.

Email correspondence. If you email brian@desired-path.com we will see the contents of your message and your email address, and we will keep the message as long as needed to respond and document the interaction.

We do not collect Social Security numbers, payment card information, precise geolocation, biometric data, or any other category that some privacy laws label "sensitive personal information."

How We Use Information

We use the information described above to:

• Send you the newsletter and product updates if you opted in
• Respond to your messages and questions
• Understand how the Site is used in aggregate so we can improve it
• Defend against bot traffic, scraping, and other abuse
• Comply with applicable legal obligations

We do not use your information for advertising, retargeting, behavioral profiling, or to make automated decisions about you. We do not enrich your record with data purchased from data brokers.

We do not use your information to train, fine-tune, or evaluate any artificial intelligence or machine-learning model, whether our own or a third party's. This applies to newsletter sign-up data, the contents of email you send to us, and every other category of personal information described in this policy.

Service Providers

We use a small number of vendors that process information on our behalf under their own privacy commitments. Each is a "service provider" (CCPA/CPRA) or "processor" (GDPR/UK GDPR) acting on our instructions and not selling your information.

• Cloudflare (hosting, content delivery, security, analytics, DNS). Cloudflare's privacy commitments and the categories of data it processes are described in the Cloudflare Privacy Policy.
• Tally (newsletter sign-up form host). Tally's privacy practices are described in the Tally Privacy Policy.
• Ahrefs Web Analytics (cookieless web analytics). Ahrefs Web Analytics is operated by Ahrefs Pte. Ltd., a Singapore company. Ahrefs's general privacy policy describes personal data as being transferred to and stored in the United States; Ahrefs's published sub-processor list also includes facilities in the European Union, Singapore, and Canada. Cross-border transfers are covered by the Standard Contractual Clauses (Modules 2 and 3) under Ahrefs's Data Processing Addendum. Ahrefs's processing is described in the Ahrefs Privacy Policy, the Ahrefs Data Processing Addendum, the Ahrefs sub-processor list, and the Ahrefs Web Analytics help article.

When we adopt a dedicated newsletter platform we will update this policy and identify it by name before transferring any information to it.

Cookies and Similar Technologies

The Site sets a small number of cookies that are strictly necessary for security and bot detection. We do not set advertising, marketing, or analytics cookies, and we do not use tracking pixels.

Cloudflare classifies all of the above as strictly necessary cookies. Because they are exempt from consent under the EU ePrivacy Directive and similar laws, we do not display a cookie consent banner. Cloudflare Web Analytics and Ahrefs Web Analytics are both cookieless and do not require consent under any of the privacy laws covered in this policy.

The newsletter sign-up form on the home page and the /newsletter/ page is loaded inside an iframe served by tally.so. Any cookies that load inside that iframe are first-party to tally.so, governed by Tally's privacy policy linked above, and frequently blocked by default by privacy-protective browsers.

Most browsers also send a Do Not Track header or a Global Privacy Control signal. We do not engage in tracking that those signals are designed to opt out of, so the signals do not change our behavior in practice. We honor them anyway.

Storage and Retention

The Site is hosted on Cloudflare's infrastructure. All traffic is served over TLS. We retain information only as long as needed to provide the service, comply with legal obligations, or defend our rights.

• Newsletter sign-ups are kept until you ask us to remove you, you unsubscribe, or you ask us to delete your record.
• Email correspondence is kept as long as needed to respond and to document the interaction.
• Server and security logs are kept for short periods per Cloudflare's defaults and our operational needs.
• Aggregate analytics are not tied to individuals and are retained as long as they are useful.

International Data Transfers

We are based in the United States and most of the personal information we collect is processed in the United States by our hosting and newsletter-form providers. If you are visiting from the European Economic Area, the United Kingdom, or another jurisdiction outside the United States, you are transferring information to the United States by using the Site and the newsletter form. Our service providers (Cloudflare and Tally) maintain their own safeguards for international transfers, including Standard Contractual Clauses where applicable, as described in their respective privacy policies.

Aggregate web analytics through Ahrefs are processed by Ahrefs Pte. Ltd. (Singapore). Ahrefs's general privacy policy describes personal data as being transferred to and stored in the United States, and its published sub-processor list includes facilities in the United States, the European Union, Singapore, and Canada. For visitors outside any of these regions, transfers to Ahrefs's environments are covered by the Standard Contractual Clauses under Ahrefs's Data Processing Addendum. The fields Ahrefs receives are enumerated in the Aggregate Site Analytics section above (page URL, HTTP referrer, page title, browser language list, screen dimensions and device-pixel-ratio, and a daily-rotating hashed visitor identifier), together with destination URLs from auto-tracked link click events.

Your Rights

Depending on where you live, you may have specific rights over the personal information we hold about you. Whatever your jurisdiction, you can exercise any of these rights by emailing brian@desired-path.com. We will respond within the time frames required by the law that applies to you. We will not discriminate against you, deny you service, or charge you a different price for exercising any privacy right.

European Economic Area, United Kingdom, and Switzerland

If you are in the EEA, the UK, or Switzerland, the GDPR or UK GDPR gives you the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted
• Restrict or object to processing
• Have your data exported in a portable format
• Withdraw consent at any time, where we rely on consent (for example, the newsletter opt-in)
• Lodge a complaint with your local data protection authority

Our legal bases for processing are: your consent (newsletter sign-up and updates), our legitimate interest in operating and securing the Site (analytics, logs, bot defense), and compliance with legal obligations where applicable.

California

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of personal information we hold about you
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising
• Limit our use of sensitive personal information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined in the CCPA/CPRA. We do not collect or use sensitive personal information beyond what is necessary to provide the Site, the newsletter, and our services. As a result, the "Do Not Sell or Share" and "Limit Use of Sensitive Personal Information" rights have no separate workflow on our Site; the choice is already made.

Other US states

State privacy laws in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, and other jurisdictions provide rights similar to those listed above, including the right to access, correct, and delete personal information and to opt out of targeted advertising and the sale of personal information. We do not engage in targeted advertising or the sale of personal information, and we will honor verifiable requests to access, correct, or delete personal information from residents of any US state on the same terms as a California request.

Children

The Site is intended for licensed attorneys and the staff of US law firms. It is not directed to children under 16, we do not knowingly collect personal information from children, and we do not sell or share information from children. If we become aware that we have collected information from a child under 16, we will delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page. For material changes, we will provide reasonable notice through the newsletter and, where required, ask for renewed consent. Continued use of the Site after a change constitutes acceptance of the updated policy.

Contact

For privacy questions, requests to exercise your rights, or any other privacy-related correspondence, contact:

Desired Path Consulting LLC
Attention: Brian Alenduff
brian@desired-path.com
North Carolina, United States