Privacy Policy

Who we are

Nuthatch Partners is the advisory firm operating this website at nuthatchpartners.com. Nuthatch Partners is the trading name of Nuthatch LLC, a Massachusetts limited liability company operating from New York City. In this Policy, “Nuthatch Partners,” “we,” “our,” and “us” refer to that entity. We are the data controller for the personal information described in this Policy.

What personal information do we collect?

When you submit the consultation form on this site, Nuthatch Partners collects the information you provide: your name, your email address, your company name, your phone number, and the content of your message. All form fields are voluntary; if you do not submit the form, we do not collect this data.

When you visit nuthatchpartners.com, our hosting provider Vercel and our form provider Formspree may automatically log technical information including your IP address, browser type and version, the pages you accessed, referring URL, and timestamps. We use these logs only for security, debugging, and abuse prevention.

We do not use marketing cookies, advertising trackers, or profiling analytics on this site at this time.

Why do we collect this information?

We collect form submissions to respond to your inquiry, provide consultation services, and follow up on potential engagements. We process technical logs to operate the website securely and to prevent abuse.

Under the EU General Data Protection Regulation (GDPR) and the UK GDPR, our legal bases for processing are:

• Pre-contractual measures and contract (Article 6(1)(b)) — responding to your inquiry and performing any advisory engagement that follows.
• Legitimate interests (Article 6(1)(f)) — operating the website securely, preventing abuse, and keeping a record of business correspondence. We balance this interest against your privacy rights.
• Legal obligation (Article 6(1)(c)) — where we must retain records to meet tax, accounting, or other regulatory obligations.

Who has access to your data?

Inside Nuthatch Partners, only the small team operating the firm has access to inquiry data. We do not sell personal information, and we do not share it for advertising or marketing purposes.

We rely on the following third-party processors to operate the site and our business. Each processes your data on our behalf under its own security and data-processing terms:

• Formspree, Inc. (United States) — receives contact-form submissions and forwards them to our inbox.
• Google LLC / Google Workspace (United States) — operates our email infrastructure (hello@nuthatch.ai).
• Vercel Inc. (United States) — hosts the website and processes technical server logs.

We may also disclose information if required by law, by a lawful regulatory request, or as necessary to defend our legal rights.

Where is your data transferred?

Our service providers are located in the United States. When you submit information through this website, your data is transferred to and processed in the United States.

Where personal data of EU, UK, or Swiss data subjects is transferred to the United States, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where applicable to the recipient, the EU-US and Swiss-US Data Privacy Framework.

How long do we keep your data?

• Form submissions and correspondence — up to 36 months after our last meaningful contact, then deleted, unless we enter an active advisory engagement, in which case data is retained per the engagement letter and any related legal or tax obligations.
• Server logs— typically 30 days, in line with our hosting provider's standard retention.
• Records required by law — for as long as required (for example, tax records retained per IRS or Massachusetts requirements).

You can request earlier deletion at any time (see “Your rights” below).

What are your rights under GDPR?

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights with respect to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure(“right to be forgotten”) — request deletion of your data.
• Right to restrict processing — limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing relies on consent.
• Right to lodge a complaint with your national data protection supervisory authority.

To exercise any of these rights, email hello@nuthatch.ai. We respond within one month, in line with GDPR requirements.

California, Colorado, and other US state residents

If you are a California resident under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), or a resident of another US state with a comprehensive privacy law (Colorado, Connecticut, Virginia, Utah, and others), you have the right to know what personal information we collect about you, to request correction or deletion, to opt out of any sale or sharing of personal information, and to limit the use of sensitive personal information.

Nuthatch Partners does not sell personal information and does not share personal information for cross-context behavioral advertising. To exercise any state-level privacy right, email hello@nuthatch.ai.

Do we use cookies?

Nuthatch Partners does not currently set analytics, advertising, or tracking cookies on this website. The site uses only the technical cookies, if any, strictly necessary for it to function, which do not require consent under EU ePrivacy rules.

If we add analytics or other tracking technologies in the future, we will update this Policy and, where required by law, provide a consent mechanism before any non-essential cookies are set.

Is the site secure?

The site is served over HTTPS with HTTP Strict Transport Security (HSTS) enabled. Data in transit between your browser and our infrastructure is encrypted. Our service providers maintain their own technical and organizational security measures, and we take reasonable steps to protect personal data under our control. No internet transmission or electronic storage is ever 100% secure; we cannot guarantee absolute security.

Children's privacy

Nuthatch Partners' services are directed at companies and the adults who run them. We do not knowingly collect personal data from children under 16. If you believe a child has submitted personal information through our site, please contact us and we will delete it.

Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, in the services we use, or in applicable law. The “Last updated” date at the top of this Policy indicates when it was most recently revised. Material changes will be highlighted at the top of this page for a reasonable period.

How to contact us

For any question, request, or complaint regarding this Policy or your personal data, contact:

Nuthatch Partners
Email: hello@nuthatch.ai
Nuthatch Partners is the trading name of Nuthatch LLC, a Massachusetts limited liability company operating from New York City.

If you are located in the EU, UK, or Switzerland and we cannot resolve your concern, you also have the right to lodge a complaint with your local data protection supervisory authority.