Back to Home

Privacy Policy

Last updated: August 30, 2026

1. Introduction

Encephalon ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

2. Information We Collect

Information You Provide

  • Name, email address, and company information when you schedule a call or contact us
  • Payment and billing information for consulting engagements
  • Communications you send to us (emails, messages, feedback)

Information Collected Automatically

  • Device and browser information (type, operating system, browser version)
  • IP address and approximate location
  • Pages visited, time spent, and navigation patterns
  • Referring website or source
  • The network your request came from — the hosting company or internet service provider behind your IP address, identified by its autonomous system number (ASN)
  • Technical fingerprints of the secure (TLS) connection your browser opens with our site (recorded as JA3 and JA4 digests). Our hosting platform records these automatically as part of the connection log. We do not use them to identify you or to classify traffic, and they are deleted on the schedule in Section 7.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our Services
  • Process transactions and send related information
  • Respond to your inquiries and provide customer support
  • Send you technical notices, updates, and administrative messages
  • Analyze usage trends to improve user experience
  • Tell automated traffic — crawlers, bots, and automated scanners — apart from real human visits, so that our own website analytics are accurate
  • Protect against fraudulent, unauthorized, or illegal activity

4. Information Sharing

We do not sell your personal information for money. If you opt in to advertising cookies, information may be shared with Meta and LinkedIn for cross-context behavioral advertising, which some U.S. state privacy laws classify as a "sale" or "sharing." You can decline or withdraw at any time using the cookie banner and the opt-out links below.

We may share your information in the following circumstances:

  • Service providers: Third-party vendors who assist in operating our Services (hosting, analytics, payment processing)
  • Legal requirements: When required by law, regulation, or legal process
  • Business transfers: In connection with a merger, acquisition, or sale of assets
  • With your consent: When you have given us explicit permission

5. Third-Party Services

Our website uses the following third-party services:

  • Microsoft Bookings: For scheduling meetings. Subject to the Microsoft Privacy Statement
  • Meta Pixel (Facebook): For website analytics, conversion measurement, and advertising on Facebook and Instagram. The Meta Pixel collects information about your visit (pages viewed, IP address, browser and device data) and shares it with Meta Platforms, Inc. Subject to the Meta Privacy Policy. You can manage your ad preferences in your Facebook Ad Settings.
  • Google Analytics 4: For website analytics and audience insights. Collects pages viewed, IP address, browser and device data, referrer, and interaction events, and shares them with Google LLC. Subject to Google's Privacy Policy. You can opt out using the Google Analytics Opt-Out Browser Add-On.
  • LinkedIn Insight Tag: For website analytics, conversion measurement, and advertising on LinkedIn. Collects pages viewed, IP address, browser and device data, and may associate this with your LinkedIn member profile if you are signed in to LinkedIn. Shared with LinkedIn Corporation. Subject to the LinkedIn Privacy Policy. You can manage your ad preferences in your LinkedIn Ad Settings.
  • Vercel Analytics: For privacy-friendly website analytics provided by our hosting platform. Collects page views, referrer, country, and basic device and browser information without setting cookies and without using cross-site tracking identifiers. Subject to the Vercel Privacy Policy.
  • ipapi.co: Used server-side during ingestion of our edge proxy logs to resolve a visitor IP address to approximate location (country, region, city). The IP is sent to ipapi.co; only the resolved geolocation fields, and your IP address in shortened (masked) form, are persisted in our analytics store, subject to the retention schedule in Section 7. Subject to the ipapi.co Privacy Policy.

Geolocation

We resolve approximate location (country, region, city) through two separate paths, depending on which system is handling the request:

  • Browser-side (first-party): When your browser calls our /api/geo endpoint on our Vercel deployment, Vercel injects approximate geolocation into the request headers (for example, x-vercel-ip-city, x-vercel-ip-country-region, x-vercel-ip-country). The endpoint reads these headers server-side inside Vercel's edge runtime and returns the values. Your IP address is not sent to a third-party geolocation service on this path. Vercel's processing of request metadata is subject to the Vercel Privacy Policy.
  • Server-side (proxy-log enrichment): Separately, our brochure's edge proxy logs are forwarded to a Supabase Edge Function for ingestion. The Vercel log payload does not carry the same edge-injected geo headers, so during ingestion the visitor IP is sent to ipapi.co (a third-party processor) to look up country, region, and city. The resolved geolocation fields are written to the ingested log row. Before a request record is written to our log, we shorten your IP address by removing its final segment, so that what we store identifies your network but not your individual connection. The full IP address is used only in transit — to route your request, and for the one-time location lookup described above — and is not retained.

Our Website Request Log

The edge proxy logs described above are more than a geolocation lookup. Each request to our website produces a log record, and those records are stored in our own Supabase analytics database. A record holds the time of the request, the page requested, the referring page, your browser and device details, your approximate location, the network provider behind your IP address, and the technical fingerprints of your TLS connection.

We use this log for one purpose: understanding how our website is used, and separating real visits from automated traffic. We do not use it to build profiles of individual visitors, we do not combine it with advertising data, and we do not share it with advertisers. It is deleted on the schedule in Section 7.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

Our website request log, described in Section 5, is subject to a fixed limit: we keep it for 90 days, after which the records are deleted. This 90-day limit covers the raw log and any analytics view we derive from it, including the IP address, approximate location, network provider, browser and device details, and the TLS connection fingerprints.

The third-party services listed in Section 5 — Google Analytics 4, the Meta Pixel, the LinkedIn Insight Tag, and Vercel Analytics — hold data on their own retention schedules, which we do not set or control. Their retention is governed by the privacy policies linked in that section.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Object to or restrict processing of your information
  • Request portability of your data
  • Withdraw consent where processing is based on consent

To exercise any of these rights, contact us through the methods listed below.

9. California Privacy Rights / Do Not Sell or Share

California and several other U.S. states give residents the right to opt out of the "sale" or "sharing" of personal information, a category that under some state laws includes cross-context behavioral advertising through tools like the Meta Pixel and LinkedIn Insight Tag. We do not sell personal information for money. If you opt in to advertising cookies, you can withdraw that consent, and opt out of the associated sharing, at any time using:

To exercise other California or state-law privacy rights (access, deletion, correction, or opt-out requests not covered above), contact us using the details in Section 12.

10. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

Encephalon Inc, a Florida corporation. 4200 5th Ave N, St. Petersburg, FL 33713.

For questions about this Privacy Policy or to exercise your data rights, contact us through the scheduling link on our website or via our GitHub organization at github.com/Encephalon.

Book a discovery call