What we collect, why, and how to ask us to delete it.
Pharos Lumen Consulting is a single-operator consulting practice. This policy describes the small amount of information the site collects and what happens to it. Plain language, no copy-pasted boilerplate.
If you fill out the contact form, we get the message. Otherwise we only count visits, anonymously.
Tracking and cookies. We do not run advertising pixels, retargeting, or any third-party tracking on this site, and we do not set cookies on the public pages.
The one cookie. If we give your company a private client page, entering its access code sets one cookie so the page stays open on that device for 30 days. That is the only cookie we set.
Visit totals. We do count visits, with Cloudflare Web Analytics, which sets no cookies, keeps only totals, and does not follow you to other sites. The details are further down, under "Analytics".
Marketing use. We do not sell, rent, or share your information with anyone for marketing purposes.
Form data. If you send the contact form, the only data we have about you is what you typed into it, a small amount of technical information your browser sends with any web request, how you arrived on that visit, and the city and country Cloudflare associates with your connection. All of it is listed below.
Notes in your browser. The public pages leave two short notes in your browser, and neither identifies you: one says the opening animation has already played, so it does not replay as you move between pages, and the other records how you arrived on this visit (the site that sent you and the page you landed on), which travels with a contact form message only if you send one.
How long they last. Both disappear when you close the tab.
Where to read more. A private client page can leave a little more, which is described separately. The complete list is further down, under "What we leave on your device".
If you want your data removed at any time, email [email protected] and ask. There is no form to fill out and no waiting period.
Pharos Lumen Consulting LLC is a single-operator practice.
Who we are. Pharos Lumen Consulting is a single-operator consulting practice based in Charlotte, North Carolina. Gabriel is the only person who reads anything submitted through this site, and he reads every reply before it is sent.
AI tools. AI tools help him draft and organize; the section "Who sees it" lists which ones and what they see.
Contact point. If you have any question about this policy, what we know about you, or how to change or delete it, the contact point is [email protected]. That is the only address on this page and the only one you need.
Business identity. The practice trades as Pharos Lumen Consulting and the legal entity behind it is Pharos Lumen Consulting LLC, a North Carolina limited liability company. We do not publish a street address on the site. If you need one for a contract, a vendor form, or a diligence file, email and we will send it to you directly.
The contact form, a few technical details that come with it, and anonymous visit counts.
When you submit the contact form on pharoslumen.com, we receive and store the fields you filled in:
- Name - so we know how to address you in a reply.
- Email address - so we can reply.
- Company - so we can understand the context of the problem.
- Company size - the range you selected from the form's dropdown.
- Area of interest - which service line you selected.
- Your message - the free-text description of the problem you want to talk about.
- How you heard about us - optional. The option you picked from the list, and the few words you typed if you chose "Other". It tells us which channels actually bring people to us.
Alongside the form data, our server records a few technical details. The first comes from the form itself, the next three with every web request, and the last two from the note on your device and from Cloudflare's lookup of your connection:
- The page you submitted from (e.g. the home page contact section, or the floating "Contact Us" pill).
- Your browser's user-agent string (the standard identifier that every browser sends, e.g. "Chrome on Windows 11").
- The hostname of the request (always pharoslumen.com or a related subdomain).
- A timestamp.
- How you arrived on this visit - the name of the site that linked you here (only the site's name, such as google.com, never the full address of the page you came from), the page on our site where you landed, and any campaign tags in the link you followed (the "utm" labels some links carry). When it is sent. This is read from the note described under "What we leave on your device", and it is sent only when you submit the form.
- Your approximate location - the city and country Cloudflare associates with your connection. We store the city and country only, never the IP address they were worked out from.
Our hosting provider, Cloudflare, may also log your IP address in their infrastructure-level access logs for security and abuse prevention. We do not store your IP address in our own database, and we do not look at the Cloudflare logs unless we are diagnosing a suspected security issue.
The bot-protection count. The contact form counts how many times the same visitor has opened it, sent it, or asked for a first look on the Operations Audit page in the past hour, so that a bot cannot flood it. Opening the form adds to that count even if you never send anything.
Scrambled address. It does that without keeping your address: your IP is put through a one-way scramble that cannot be reversed back into an address, and only the scrambled value, a count and the hour it covers are stored.
How long it lasts. They stop counting for anything after an hour, and they are deleted automatically after two hours, usually within a day.
When you type a website into the Operations Audit request, we read only the public homepage of that site to prepare your first look; we do not keep the result unless you send the form.
Client page notes. On a private client page you can add notes to correct or add to what we have written. We store the note, the part of the page it belongs to, the time, and your name only if you choose to type it.
How Gabriel is told. Each note is sent to Gabriel by email so he sees it promptly. If that email cannot be sent, the same message goes to the private Discord channel described below.
Autosave. A note is saved as you type: after a short pause, and when you leave the box, the words are saved on our server, and the page says so under the box ("Saving...", then "Saved. I will see this."), so nothing is lost if you forget to press Save.
Who sees a draft. While you are still writing, only you and Gabriel can read the saved words.
Follow-up emails. Gabriel is emailed once you stop typing for a minute, leave the page or press Send, and he gets a follow-up if the words change after that. Before you press Send, those follow-up emails are spaced out and limited to two, so a long note does not fill his inbox; pressing Send always delivers the final words.
Deleting a draft. If you clear the box or choose Discard, the saved draft is deleted, but an email Gabriel has already received about it stays in his inbox.
Removed notes. If Gabriel removes a note, its words, the name you typed and your reply address are deleted. We keep only a short scrambled code for each run of three words, made with a secret key that is not stored with the notes, never the words themselves, so the same note cannot be sent again by mistake. The codes are deleted with the rest of your company's notes.
Colleagues see sent notes. Once you press Send on a note under a section of a page, such as a correction to a briefing, the other people at your company who have that page's access code can read it too.
Private messages. A message sent with "Ask me directly" is different: it goes only to Gabriel, by email and into his private records, and it is never shown on the page to anyone else.
Reply address. If you use "Ask me directly", you also give an email address. We store it with your message, put it in the email to Gabriel so he can answer you, and use it for nothing else.
If your browser blocks something on one of our pages because our own security rules told it to, the browser sends us a short technical report naming the page, the blocked file, and the rule. Those reports let us find a broken page quickly. They contain nothing about you.
Direct email. Separately from the form, if you email us directly, we have whatever you put in that email. Mail to a pharoslumen.com address is routed by Cloudflare into a Google mailbox that only Gabriel reads.
Mail from people. Email from anyone who writes to a pharoslumen.com address is also kept in our inbox record: your name, your email address, the subject, the message and the time it arrived.
Threads and automatic mail. Correspondence about an inquiry is kept with that inquiry’s record so the thread stays in one place. Automatic mail such as newsletters, receipts and out-of-office replies is left out.
That is the complete list. We do not collect financial information, government identifiers, health information, or anything else not listed above. Apart from the anonymous visit counts described under "Analytics" and the notes you add on a private client page, the contact form is the only way information about you reaches us through the site.
Two short notes on the public pages, and on a private client page one cookie and any note you have not sent.
Plenty of policies say "we do not use cookies" and then quietly store things in your browser under another name. Here is the complete list of what this site writes to your device:
- A note that the opening animation has played. It is a single yes-or-no flag. It holds no name, no address, no identifier, and nothing that could be linked back to you. Your browser deletes it when you close the tab.
- A note of how you arrived on this visit (stored under the name
pl-first-touch). It holds the name of the site that linked you here, the page where you landed, and any campaign tags in that link. It is written once, on the first page you open, and never overwritten. No name or address. It holds no name, no address and no identifier. It leaves your device only if you send the contact form, and your browser deletes it when you close the tab.
Those two notes are the whole list on the public pages. On a private client page, and only there, there is also one cookie and four more notes:
- The access cookie. It proves the access code was entered for your company's page, and it works only for that page. It holds no name and nothing else about you, and it expires after 30 days.
- A note you are writing. The words stay on the device while you write and until you send the note or clear them. Server copy. They are also saved on our server as you type, as described above, where only you and Gabriel can read them until you press Send. Clearing the box or choosing Discard deletes the saved copy. Waiting for Send. If the page tells you the note was already sent from another tab, a yes-or-no flag is kept with your words so they wait for you to press Send. Offline. If the connection is down, they stay on the device and the page asks whether to send them when you try to leave.
- A reference for that note. A long random code, with no name or address in it, that only your device knows. It makes later saves update the same note instead of making a new one, and it means nobody else can read or change your draft.
- A marker for a removed note. If Gabriel removes a note you were still writing, your device keeps a short scrambled code made from those words, never the words themselves, so the page does not send the same words again. It cannot be turned back into your words, and it stays until you clear your browser's site data.
- Your name and your email address, if you typed them. They are remembered on the device so you do not have to type them again, and they are sent only with a note or message you write.
That is the entire list. Apart from the access cookie on a private client page, no cookies, no advertising identifiers, no tracking pixels, no fingerprinting.
Short-lived. On the public pages nothing outlives the tab.
Cookie and unsent notes. On a private client page, the cookie lasts up to 30 days, and an unsent note, its reference, your name or your email address stays until you send it, clear it or clear your browser's site data.
A past practice, removed. Until September 2026 the contact form also kept a copy of an unsent message on the device when a submission failed. That was removed, along with the copies it had made.
Analytics. We measure traffic with Cloudflare Web Analytics. When a page loads, a small script from Cloudflare reports the page address, the site that sent you, your browser type, your country, and how quickly the page loaded.
What it never does. It sets no cookies, stores nothing on your device, does not use your IP address or browser details to recognize you from one visit to the next, and does not follow you to other sites.
Totals only. What we see is totals, such as how many visits a page had and which sites sent them, never a record of one person. We use it to learn which pages people find and read. See Cloudflare’s privacy policy.
Form openings. We also keep a tally of how many times the contact form is opened and which button opened it, as one number per button per day. It holds nothing about you or your device.
Future tools. If we ever change or add a measurement tool, we will name it in this paragraph and change the date at the top of this page.
To reply, to qualify the conversation, and to keep a working record of the inquiry.
Everything we collect serves one of three purposes:
- Respond to your inquiry - we need a name and email to write back.
- Qualify the engagement - the company, size, and interest fields help us know in advance whether the problem you are bringing matches what we actually do well. If it does not, we say so on the first call and point you toward someone better suited.
- Learn how people find us - the optional "how did you hear about us" answer, how you arrived on the visit, and your approximate city and country tell us which channels bring real inquiries, so we spend our time on the ones that work. The anonymous visit counts do the same for the site as a whole.
- Maintain a pipeline record - we keep an internal record of who has reached out so a later conversation can pick up where the previous one left off. This is normal consulting CRM hygiene; we do not use the record for marketing.
The legal basis for processing this information is our legitimate business interest in responding to a business inquiry that you initiated. We do not process your data for any purpose you did not implicitly consent to by submitting the form.
Everything has a deadline, and a daily job deletes what is past it.
Each kind of record has a fixed window. Once a record is past its window it is deleted automatically, whether or not anyone asks. You do not have to chase us.
- Your contact form submission, including how you heard about us, how you arrived and your approximate location - deleted 24 months after the last activity on the inquiry. Restarting the clock. A reply you send us counts as activity and restarts the clock, so a conversation that is still going is never deleted out from under it. Same schedule. The notification copy of your note in Discord is deleted on the same schedule, at the same time as the database record. Emailed copy. For now, the emailed copy in our Google mailbox is not part of that automatic deletion; we remove it when you ask.
- Email you send us, whether or not it is about an inquiry - deleted 24 months after it arrives. The Discord notification that carries the sender's name or email address and the subject line is not part of that automatic deletion; we remove it on request, where Discord allows.
- Our record of the emails we sent you - deleted after 36 months. This is our side of the correspondence, which a business is normally expected to be able to produce for longer than the inquiry itself.
- Anything moved to the trash in our inbox - deleted permanently 90 days later.
- The anti-flood counter on the contact form, which counts opening the form as well as sending it - deleted after 2 hours, usually within a day. It never held your address, only a scrambled value and a count.
- Automatic browser security reports - deleted after 90 days. These record page content a browser blocked and carry nothing personal.
- Notes added on a private client page - deleted 24 months after the last activity with your company, or sooner on request. Stored notes. That covers the notes stored on the site, including the email address given with "Ask me directly". Emailed copies. The copies Gabriel receives by email, or in his private Discord channel, are not removed automatically and are deleted when you ask.
- On request, sooner - we delete your record from the database within a reasonable period of receiving an email asking us to, we delete the Discord notification and the email correspondence where that is possible, and we write back to tell you it is done.
We keep an internal log of these automatic deletions, recording how many records were removed and under which rule. That log holds counts, not the deleted records, and it is what lets us answer the question of when something went.
Why there are backups. Two copies sit behind the live database so that a mistake or an outage cannot erase the practice's records, and a deletion works its way out of both.
The two copies. A nightly export of the database is kept on Gabriel's own machine and is deleted automatically after 14 days. Cloudflare keeps a 30-day point-in-time history of the database itself.
When a deletion is complete. So a record you ask us to delete is gone from the live database straight away, and gone from every copy within 30 days.
Cloudflare's own infrastructure logs follow Cloudflare's retention schedule, which is independent of our database. If you need those purged, the request must go to Cloudflare directly.
HTTPS in transit, private storage at rest, single-operator access.
Every form submission travels over HTTPS. The database is stored inside Cloudflare D1 with access restricted to credentials held only by Gabriel. The nightly export lives on Gabriel's own machine, not in a shared cloud folder. There is no shared dashboard and no employee access. The providers named under "Who sees it" are the only outside services that hold submission data.
No system is perfectly secure, and we will not pretend otherwise. What we can promise is that the number of places your information sits is deliberately small, and that the list on this page is the whole list.
You hear it from us, quickly, and in plain language.
North Carolina law requires a business holding residents' personal information to tell the people affected without unreasonable delay when that information is exposed, and to notify the Attorney General's Consumer Protection Division. We commit to that, and we commit to doing it for everyone affected, not only North Carolina residents.
How we tell you. In practice that means an email to the address we have on file telling you what happened, what information was involved, when we found out, and what we have done about it.
Facts as we confirm them. We will not sit on the news while we assemble a perfect account of it. You get the part we are sure of as soon as we are sure of it, and the rest as it becomes clear.
Ask, and we will do it.
You can email [email protected] and ask us to do any of the following:
- Tell you what we have on file about you.
- Correct anything inaccurate.
- Delete your record.
- Stop reaching out to you (we will not send any further messages, and your contact information will be marked do-not-contact in the pipeline).
US state laws. If you live in a US state with its own privacy law (California, Virginia, Colorado, Connecticut, Utah, Texas, and others), and that law grants you specific rights, we will honor those rights in good faith whether or not the law's revenue thresholds technically require us to.
Making a request. The simplest path is to email and ask. We are small enough that a real person reads every request.
We do not require you to create an account or verify your identity through any third-party system to exercise these rights. We will use the email address on file to confirm the request came from you.
This site is not directed at anyone under 16.
Pharos Lumen Consulting is a B2B consulting practice. The contact form is intended for business decision-makers. We do not knowingly collect information from anyone under 16, and we have no use for it if we receive it. If you believe a minor has submitted information through this site, email us and we will delete it.
We operate in the United States. We do not target visitors outside it.
Where we operate. Pharos Lumen Consulting serves US-based businesses. We do not market to the European Union, the United Kingdom, or other regions with their own data protection regimes, and we do not run targeted advertising or behavioral tracking that would extend those regimes to us.
Where it is stored. If you are visiting from outside the United States and choose to submit the contact form, your information will be stored with Cloudflare and Google, both United States companies, and it will be handled under this policy.
UK and EU readers. If you are in the United Kingdom or the European Union and want the formal version: the party responsible for your information is the practice named at the top of this page; the lawful basis is our legitimate interest in answering a business inquiry you started; the categories of information, the recipients, and the retention periods are the ones listed above; there is no automated decision-making and no profiling; and you may ask for access, correction, deletion, restriction, portability, or object to the processing, by emailing [email protected].
Your regulator. You also have the right to complain to your national data protection authority.
If you would prefer that we not store your submission and instead reply to you and immediately delete the record, say so in your message and we will do that.
When the site changes in a way that affects data, this page changes with it.
Updates. If we start using a new infrastructure provider, add a feature that collects new information, or change how long we keep records, we will update this policy and update the effective date at the top of the page. We do not version-bury changes inside the policy.
Home page notice. If a change is material (new collection, new sharing, new retention), we will put a dated notice on the home page, linking here, for a reasonable window.
If you want to be told personally about material changes, email us and ask to be on a one-line "policy changes" notification list. We will only use that list for that purpose.
What changed on October 11, 2026. Seven short changes:
- Replies. The first draft of a reply to a contact-form message, and to any later email from you, is now written and checked on Gabriel's own computer.
- Daily summary. The daily summary of what needs his attention is also written on his own computer.
- Who reads. Two earlier lines were too broad and are replaced: that he is the sole person who processes submissions, and that no outside tool can read them.
- AI tools. "Who sees it" now lists the AI tools, including the cloud AI service (Anthropic's Claude) that can draft replies to emails he sent first and the assistant he works with.
- Assistant. The line about the AI assistant he works with now says it can see your name, company and the subject of your email.
- First look. The Operations Audit request page can now read the public homepage of the website you type, to prepare a first look while you fill in the form.
- First look storage. We keep nothing from that unless you send the form, and the lookup limit uses the same scrambled count as the contact form.
Unchanged. Nothing else about what we store changed.
What changed on October 10, 2026. Each inquiry from the contact form is now also emailed to our Google mailbox, so it reaches Gabriel by email as well as in the database and the private Discord channel. The email carries the same details the form collects, and replying to it answers you. That emailed copy is kept in the mailbox and, for now, is deleted when you ask, not by the automatic schedule. Nothing else about what we store changed.
What changed on October 9, 2026. We now keep a tally of how many times the contact form is opened and which button opened it, as one number per button per day. It holds no name, address or device detail.
Form opens counted. The bot-protection count now also counts opening the form, and it still holds only a scrambled value, a count and the hour it covers, deleted after two hours.
Unchanged. Nothing else about what we store changed.
What changed on October 8, 2026. A private client page can now have an end date. It stays open through that day, and after it the access code and the page's cookie stop working. Nothing else about what we store changed.
What changed on October 7, 2026. Notes on a private client page are now saved as you type, with the status shown under the box, so a note is not lost if you forget to press Save. The reference code that keeps those saves together is new.
Who can read what. While you are writing, only you and Gabriel can read the saved words; follow-up emails to Gabriel are spaced out and limited before you press Send; discarding a note deletes the saved draft, though an email already sent to Gabriel stays in his inbox; notes you send under a section can be read by colleagues who have the page's access code; and a message sent with "Ask me directly" goes only to Gabriel.
Reply address. "Ask me directly" now asks for an email address so Gabriel can reply; it is stored with your message and deleted with it.
Read-only visitors. Nothing changed for visitors who only read the public pages.
What changed on October 6, 2026. Private client pages can now take notes.
Details added. This policy now says what that stores (the note, where it belongs, the time and an optional name), that each note is emailed to Gabriel, the one cookie and the unsent note and name kept on your device, and that notes are deleted 24 months after the last activity with your company.
Read-only visitors. Nothing changed for visitors who only read the public pages.
What changed on October 6, 2026. Our inbox now keeps email from anyone who writes to a pharoslumen.com address, not only replies about an inquiry, so that a real message from a person is never lost. It is kept for 24 months.
The Discord notification. A short notification with the sender's name or email address and the subject line goes to Gabriel's private Discord channel when such an email arrives.
Not kept. Newsletters and other automatic mail are not kept.
Details above. Each of these is listed above, under "What we collect", "Who sees it" and "How long we keep it".
What changed on September 29, 2026. We started counting visits with Cloudflare Web Analytics, which sets no cookies and shows us totals only; the "Analytics" paragraph names it.
Form additions. The contact form gained an optional "How did you hear about us?" question. When you send the form it now also carries how you arrived on that visit and the city and country Cloudflare associates with your connection.
Browser note. The site leaves one new note in your browser, which ends with the tab.
Details above. Each of these is listed above, with why we collect it and how long we keep it.
What changed on September 23, 2026. Retention became a schedule instead of a judgement call. Every kind of record now has a fixed window, listed in "How long we keep it", and a daily job deletes what is past it automatically. Nothing about what we collect, why, or who sees it changed.
What changed on September 22, 2026. This version replaces the one dated May 18, 2026.
Removed and corrected. A third-party service that used to receive a copy of each inquiry was retired, and it has been removed from this policy. The description of the phone notification was corrected to say exactly what it carries.
Added sections. Two sections are new: what the site leaves on your device, and what happens if there is a breach.
How long copies last. The retention section now names the two backup copies that sit behind the live database and says how long each one lasts.
Email handling. The provider that carries our email is now named, along with the fact that an email thread about an inquiry is kept with that inquiry.