What we collect, and what we will not do with it

This site collects almost nothing. There is no advertising, no data broker, and no account. We use one measurement tool, Google Analytics, which is described below. If you send us a message, we use it to reply to you and for nothing else. We do not sell it or share it with anyone beyond the service providers named below.

What you type into the contact form: your name, work email, company, phone number if you provide one, a target solicitation or agency if you provide one, and your message.

What you type into the capabilities brief form: your work email and your company name. We use the email to send you the brief and to answer you, and the company name so we know who we are sending it to. You are not added to a mailing list, so there is nothing to unsubscribe from. The brief itself can be downloaded without giving us anything at all.

Attribution data sent by your browser: the address of the page that referred you, and any campaign parameters in the link you followed (for example utm_source). This tells us which of our own links are working. It is not used to identify you.

Standard server logs kept by our host, which include your IP address and browser type. These exist for security and abuse prevention.

We do not set cookies of our own. Google Analytics sets cookies in your browser, and Calendly sets its own when you open the calendar. Both are described below. There are no advertising cookies on this site.

Do not send controlled unclassified information (CUI), export-controlled technical data, classified information, or anything marked with a handling caveat through this form. The contact form is not an approved channel for it, and this website is not a CUI-handling system.

If a conversation will involve CUI or export-controlled data, tell us first. We will set up an appropriate channel before anything sensitive changes hands, either a client-controlled environment or a written data flow we have reviewed. Until then, send only what you would be comfortable putting in an ordinary email.

Resend delivers the contact form email to us, and delivers the capabilities brief to anyone who asks for it by email. Your submission passes through their service, which also keeps a log of the send.

Vercel hosts this website and keeps the server logs described above.

Calendly provides the scheduling calendar on our schedule page, inside a frame from Calendly that sets its own cookies when you use it. Calendly also records sessions, which by its own description includes clicks, cursor movement, and a replay of what happened on screen. We do not control any of it; Calendly's own privacy policy governs it, and Calendly asks for your consent inside the frame. If you would rather not use Calendly, email us instead, because the calendar is not the only way to reach us.

The only third-party services on this site are Calendly on the scheduling page and Google Analytics, both described here.

We use Google Analytics to see which pages bring people to us and which ones they actually read. It sets cookies in your browser and reports numbers in aggregate: page views, the country you are in, how you arrived, and what kind of device you used. It does not report your name, and we cannot look up an individual visitor.

We use it for one reason: without it we cannot tell whether anyone reads the capabilities brief or whether a page is doing any work at all. We do not sell the data, we do not run advertising, and we do not join it to anything you send us through a form.

If you would rather not be counted, private or incognito mode, or any standard tracking blocker, will stop the cookie being set. The site works exactly the same either way.

Contact form submissions live in our email inbox and in Resend's send log. We keep them long enough to respond and to maintain a record of who we have spoken with, then delete them when they are no longer useful. If you want a message you sent deleted, ask us and we will remove it.

Write to inquiries@leatherneckconsulting.com to ask what we hold about you, to correct it, or to ask us to delete it. We will respond within a reasonable time and we will not make you justify the request.

We protect what you send in the ordinary ways: encrypted transport, access limited to the people who need it, and no client information stored in systems it does not belong in. We also hold ourselves to the rule that appears throughout our framework: no client CUI is stored in our systems by default.

We are a small firm and we will not claim a certification we do not hold. What we will say is that if we cannot handle something safely, we will tell you before you send it.

If this policy changes materially, we will update the effective date at the top of this page. We do not track you across other websites, so there is no notification to send.