PRIVACY POLICY

1. Who is responsible for your information

Eldest Daughter Strategies
Emily Ambrose, Owner
Portland, Maine, United States
hello@eldestdaughterstrategies.com
(207) 323-6085

For the purposes of the EU and UK General Data Protection Regulation, Eldest Daughter Strategies is the "data controller" of the information described in this policy.

2. Information I collect

Information you give me directly

• Contact and inquiry information. When you email me, submit a form, or book a consultation, I collect your name, email address, phone number if you provide it, your business or organization name, and whatever you choose to tell me about what you're working on.

• Scheduling information. When you book a 15-minute consultation, my scheduling provider collects your name, email address, time zone, and any details you enter when booking.

• Mailing list information. If you subscribe to updates, I collect your email address and, optionally, your name.

• Client engagement information. If we work together, I collect the information necessary to do the work — which may include business and financial details, operational documentation, team and personnel information, and strategic materials you share with me.

• Payment information. If you become a client, invoices are processed through Squarespace. I receive confirmation that payment was made and the associated billing details. I do not receive or store your full card or bank account numbers.

Information collected automatically

When you visit the site, limited technical information is collected automatically by my website host and analytics tools: your IP address, browser type and version, device type, operating system, referring website, the pages you visit, and the dates and times of your visits. This is standard web server and analytics data. I use it in aggregate to understand which pages are useful, not to identify you personally.

Information about people who are not you

Client work sometimes involves personal information about third parties — employees, board members, contractors, or customers of my clients. Where that happens, I process that information solely on my client's instructions and only as needed to perform the engagement. If you believe I hold information about you because of work I did for an organization you're connected to, contact that organization first; they control that data. You're also welcome to contact me and I'll help route your request.

Sensitive information

I do not intentionally collect sensitive personal information — including racial or ethnic origin, political opinions, religious beliefs, health information, biometric data, precise geolocation, or sexual orientation — through this website, and I ask that you not send it to me unsolicited. People operations work occasionally requires handling sensitive employment-related information; when it does, that handling is governed by the written agreement between me and my client, and it is limited to what the engagement requires.

3. How I use your information

I use personal information to:

• Respond to your inquiry and communicate with you

• Schedule and hold consultations

• Provide, manage, and deliver consulting services

• Send invoices, process payments, and keep accurate financial records

• Send you emails you asked to receive, and let you unsubscribe from them

• Maintain and secure the website, and understand in aggregate how it's used

• Provide access to the password-protected Eldest Daughter Directory to active clients

• Meet legal, tax, accounting, and recordkeeping obligations

I do not use your information for automated decision-making or profiling, and I do not use it to build advertising audiences.

4. Legal bases for processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, I rely on the following legal bases:

• Purpose: Legal basis

• Responding to your inquiry; delivering consulting services; invoicing

• Performance of a contract, or steps taken at your request before entering one
  Marketing emails

• Your consent, which you may withdraw at any time

• Analytics and non-essential cookies

• Your consent

• Site security, fraud prevention, and basic operation

• Legitimate interests

• Tax, accounting, and legal recordkeeping

• Compliance with a legal obligation

5. Cookies and analytics

The site uses cookies and similar technologies. Cookies are small text files stored on your device that let a website remember things about your visit.

• Essential cookies are set by my website platform, Squarespace, and are required for the site to function — including page delivery, security, and access to password-protected pages. These cannot be disabled without breaking the site.

• Analytics cookies help me understand aggregate site usage: which pages people read, how they arrived, and where they leave. I use [Squarespace Analytics / Google Analytics 4 — list only what you actually use].

Google Analytics disclosure. [Include this section only if you use Google Analytics.] This site uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies and similar identifiers to collect information about your use of the site, including your IP address (which is truncated before storage), and reports aggregate statistics to me. Google may process this information on servers in the United States. You can learn how Google uses data from sites that use its services at google.com/policies/privacy/partners, and you can opt out of Google Analytics entirely using the Google Analytics Opt-out Browser Add-on.

Advertising. I do not run advertising on this site, and I do not use Google advertising products, remarketing, or third-party ad cookies. [Delete or revise this paragraph if that changes — Google requires specific additional disclosures for advertising products.]

Your choices. You can refuse or delete cookies through your browser settings; the site will still work, though some conveniences may not. Where required by law, I ask for your consent before setting non-essential cookies, using the cookie banner on the site.

Do Not Track and Global Privacy Control. Browsers vary in how they send Do Not Track signals and there's no common standard for responding to them, so I do not respond to DNT. I do honor the Global Privacy Control (GPC) signal where my tools support it. Regardless, I do not sell personal information or share it for cross-context behavioral advertising.

6. Who I share information with

I share personal information only with service providers who help me operate the business, and only as needed to do so. Each is bound by its own privacy commitments and, where applicable, a data processing agreement.

I may also disclose information where I'm legally required to — in response to a valid subpoena, court order, or lawful government request — or where necessary to protect my legal rights or someone's safety. If my business is ever sold or transferred, personal information may transfer with it; if that happens, I'll update this policy and notify affected clients.

I do not sell your personal information. I have not sold personal information in the preceding 12 months, and I do not share it for cross-context behavioral advertising or targeted advertising, as those terms are defined under U.S. state privacy laws.

7. Client confidentiality

Beyond this policy, information you share with me as a client is confidential. My standard services agreement includes a mutual confidentiality obligation covering non-public business, financial, and strategic information, and that obligation survives the end of our engagement. I don't discuss client work publicly, and I don't use a client's name in marketing, case studies, or testimonials without asking permission first.

8. The Eldest Daughter Directory

The Directory is a password-protected page available to active clients. Access requires a password I provide, and access ends when our engagement ends. Please don't share the password. The Directory lists business contact information for vendors, service providers, and community members — professional information only, shared with their knowledge. If you're listed and want to be removed, email me and I'll take you out promptly.

9. How long I keep information

• Inquiries that don't become engagements: up to 2 years, so I can pick up a conversation if you come back

• Mailing list: until you unsubscribe, plus a suppression record so I don't accidentally email you again

• Client records and work product: for the duration of the engagement and 7 years afterward, consistent with tax and business recordkeeping norms

• Financial and tax records: 7 years, as required

• Website analytics: per my analytics provider's retention settings, currently [14 months for Google Analytics 4 — confirm your setting]

When information is no longer needed for these purposes, I delete it or anonymize it.

10. How I protect information

I use reasonable and appropriate safeguards: reputable vendors with their own security programs, encryption in transit (HTTPS across the site), strong unique passwords with multi-factor authentication where available, access limited to me and any contractor who genuinely needs it, and password protection on gated pages. No method of transmission or storage is completely secure, so I can't guarantee absolute security. Please don't send highly sensitive information — Social Security numbers, full financial account numbers, health records — by unencrypted email; ask me and I'll set up a secure alternative.

11. Your rights and choices

I extend the following rights to everyone, regardless of where you live. You don't need to be a resident of a particular state or country to exercise them.

• Know and access. Ask what personal information I hold about you and get a copy.

• Correct. Ask me to fix information that's inaccurate or incomplete.

• Delete. Ask me to delete your personal information, subject to information I'm legally required to keep (tax records, for example) or that I need to complete an active engagement.

• Portability. Get your information in a portable, machine-readable format.

• Opt out of marketing. Unsubscribe from any email using the link in it, or just tell me.

• Opt out of sale or targeted advertising. Already covered — I don't do either.

• Withdraw consent. Where I rely on consent, withdraw it at any time.

• Non-discrimination. I will never treat you worse for exercising any of these rights.

How to make a request: email hello@eldestdaughterstrategies.com with the subject line "Privacy Request" and tell me what you'd like. I'll respond within 30 days, or within 45 days where a state law allows and I need the extra time — I'll tell you if that happens. To protect you, I may ask you to verify your identity, usually by confirming details I already hold. Authorized agents may submit requests on your behalf with written permission.

If you're in the EEA, UK, or Switzerland, you also have the right to object to processing based on legitimate interests, the right to restrict processing, and the right to lodge a complaint with your local supervisory authority. I'd appreciate the chance to address it directly first.

If you're in California, you may also request disclosure of the categories of personal information I've collected, the sources, my business purposes, and the categories of third parties I've disclosed it to. Those categories are described throughout sections 2 and 6 above.

12. International visitors and data transfers

I operate from the United States, and information I collect is stored and processed here and in other countries where my service providers operate. U.S. privacy law may differ from the law where you live. Where personal information is transferred out of the EEA, UK, or Switzerland, my providers rely on lawful transfer mechanisms such as the European Commission's Standard Contractual Clauses. By using the site or contacting me, you understand your information will be processed in the United States.

13. Children's privacy

This site and my services are for adults and are not directed at children. I do not knowingly collect personal information from anyone under 16. If you believe a child has provided me with personal information, email me and I'll delete it. [Note: keep this at 16 rather than 13. Several state laws set 16 as the threshold for teen data protections, and 16 covers both.]

14. Third-party links

The site links to other websites, including social media and vendors listed in the Directory. I'm not responsible for their privacy practices, and this policy doesn't cover them. Read their policies before sharing information with them.

15. Changes to this policy

I'll update this policy as my business and tools change. When I do, I'll revise the "Last updated" date at the top. If a change materially affects how I handle your information, I'll notify you by email if I have your address, or with a prominent notice on the site. Continuing to use the site after a change means you accept the updated policy.

16. Contact

Questions, requests, or concerns about privacy:

Eldest Daughter Strategies
Emily Ambrose
hello@eldestdaughterstrategies.com
(207) 323-6085
Biddeford, Maine, United States