This site has one form. That is the whole of it, and this page is short for the same reason.
If you want the version in one line: we use what you send to answer you, we don't sell it, we don't put you on a list, and you can tell us to delete it.
Effective date: 11 September 2026
What the form collects
Seven fields, and only two are required: a work email and a line saying what you're retiring. Your name, organization, phone, city and state and the message box are all optional, because you shouldn't have to hand any of that over to get an answer. Fill them in if they'll help us answer properly, leave them if they won't.
The helper text under that box asks you to keep it general and not to paste asset registers, system names, credentials, or patient or student data. That request is not decoration. We would rather not hold that information at all, and a scoping conversation doesn't need it.
The form also carries one hidden field that a person never sees. It exists to catch automated spam. If anything fills it, the submission is discarded and nothing is sent to us.
If you send it anyway, we'll tell you, and we'll ask whether you want us to delete it and start again.
What we do with it
Answer you. Work out whether we can do what you need and what it would involve. Keep a record of what was discussed so that the answer we gave in March is the same answer in June.
That's the list.
What we don't do
- We don't sell it, rent it, or trade it.
- We don't add you to a marketing list. The consent line on the form says so and this page says the same thing, which is deliberate: a published promise is enforceable, and we would rather write one we can keep than a broad one we can't.
- We don't use it to build a profile of you, and we don't hand it to an advertising network.
Who else sees it
A form submission travels through whatever service hosts the form and whatever service carries the email. Those companies see it in transit in the ordinary course of running those services.
Hostinger. The site is hosted there, the contact form is processed by a script on that same hosting account, and the email it generates is carried by Hostinger's mail service.
Google. We use Google Analytics to understand which pages people read and how they arrive, and Google Tag Manager to load it. Google receives the information described in the tracking section below. Google does not receive your enquiry: the contact form does not pass through them.
Microsoft. We use Microsoft Clarity to see how pages are actually used — where people scroll, what they click, where a layout fails them. Clarity records a playback of the interaction. What you type into the contact form is not captured. Microsoft's own documentation is explicit that content in input boxes and dropdowns is masked in every mode and that this cannot be switched off, and we additionally run Clarity in its Strict mode, which masks page text as well.
There is no third-party form service, no CRM, and no marketing platform in the path. If any of those are added later, they go in this list the day they are added rather than at the next review.
Beyond that: nobody, unless we're required to hand something over by law, in which case we'll tell you unless we're forbidden to.
Tracking, and the honest answer about Do Not Track
This section changed on 11 September 2026, the day the measurement described below actually started running. Before that date this site ran no analytics of any kind. We are saying so rather than quietly rewriting history, because the previous version of this page promised that it would change before the analytics did.
What runs now. Three third-party scripts, all loaded through Google Tag Manager:
| What | Who | What it is for |
|---|---|---|
| Google Tag Manager | Loads the other two. Collects nothing on its own | |
| Google Analytics 4 | Which pages are read, how people arrive, roughly where from, and Google's "enhanced measurement" events: scrolls, clicks on links leaving the site, file downloads, site search, and whether a form was started or submitted — not what was typed into it | |
| Microsoft Clarity | Microsoft | Scroll depth, clicks, and a masked playback of the page interaction |
Cookies. Google Analytics sets two first-party cookies, _ga and _ga_ followed by a stream
identifier. Google's own documentation gives both a two-year expiry and describes them as distinguishing
unique users and persisting session state. That is a real change from the position this page held before,
and it is the reason the old sentence about cookies is gone rather than softened.
What we do not do. No advertising pixels. No remarketing or ad-targeting tags. No sale or sharing of anything collected here. No cross-site advertising profile built from this site. Nothing collected here is attached to an enquiry you send us, and nothing you type into the contact form reaches either company.
Do Not Track. We do not respond to the Do Not Track header. Almost nobody does, there is no agreed standard for what responding would mean, and we would rather say that plainly than imply a protection we have not built. If you want to prevent this collection, a content blocker or your browser's tracking protection will stop all three scripts, and the site is built to work normally without them — nothing on it depends on a script to render or to submit the form.
How long we keep it
Two different cases, two different answers.
An inquiry that doesn't become a project: 12 months, then we delete it. Long enough that if you come back next budget cycle we still know what we discussed, short enough that we aren't sitting on a list of organizations and their retirement plans indefinitely.
A project that runs: for the life of the engagement, and then as long as the records themselves require. Some of what a disposal project produces is the evidence you asked us to create, and deleting that on a schedule would defeat the point of it. We'll tell you which records those are.
Seeing it, correcting it, or having it deleted
Email info@r2revive.com and ask. We'll tell you what we hold, correct it if it's wrong, and delete it if you want it gone.
We're not going to make you prove a statutory right first. You sent it to us; asking is enough.
One limit, stated honestly: if we've already done work for you, some of it sits in records we keep for accounting and for the documentation trail the work itself produces. We'll tell you which parts those are.
Email from us
If you ask for a quote, we'll email you back, and that reply carries our postal address and a way to tell us to stop.
We do that whether or not CAN-SPAM classifies a quote reply as a commercial message rather than a transactional one. That classification is genuinely arguable and we're not going to pretend otherwise on a page about not overstating things. It's cheaper to meet the higher standard than to be right about which one applies. Tell us to stop and we will, for good.
The law, and where we actually stand
Most of what gets published as a privacy policy is written for a company that the law in question doesn't reach. We'd rather tell you where we sit.
Colorado. The Colorado Privacy Act defines a consumer as a Colorado resident "acting only in an individual or household context" and expressly excludes anyone "acting in a commercial or employment context" (CRS 6-1-1303(6)(a) and (b)). If you fill in this form as an IT director or a procurement officer, the Act doesn't treat you as a consumer at all. That's the reason it doesn't reach this form, and it doesn't depend on how big we are.
There are also volume thresholds at CRS 6-1-1304, and we're far below them. We're deliberately not resting the answer on those, because there is now a branch of that section with no threshold at all. Since 1 July 2025 the Act also applies to a controller that "controls or processes any amount of biometric identifiers or biometric data regardless of the amount" it handles annually. A fingerprint counts. So does a facial map.
That doesn't reach a contact form. It would reach a fingerprint reader on the door of a processing facility, which is a normal thing for a secure site to have. We don't have a processing site yet. When we do, that question gets answered before the hardware is installed rather than after, and this page changes if the answer changes.
California. The CCPA's revenue threshold is far above us. Its consumer-volume threshold is the same number as Colorado's, 100,000, and counts households as well, so "higher" is only true of the money. We don't meet either. Worth knowing, though, because it cuts the other way: California's B2B carve-out expired on 1 January 2023, so if we ever do meet those thresholds, a California resident's work contact details are covered in full. California's older website law, CalOPPA, has no out-of-state exemption, which is why this page is written to its checklist.
Federally. No general federal law requires a website to publish a privacy policy. What federal law does do is make the one you publish enforceable. That is the reason this page is short and specific instead of long and comfortable.
Delaware, which is the one that actually requires this page. Delaware's Online Privacy and Protection Act makes an operator of a commercial website that collects personal information from Delaware residents post a privacy policy, and it has no size threshold and no out-of-state exemption. What makes it bite where California's older law might not is the definition: Delaware's "user" is simply "an individual that uses an internet website," with no personal, family or household limitation attached. A procurement officer is a user. So this page is written to Delaware's required list: what we collect, who we share it with, how you review or change it, how we tell you about material changes, the effective date, how we handle Do Not Track signals, and whether anyone else is tracking you across sites from here.
We'd have written it regardless, because you're about to tell a stranger what equipment your organization is retiring and when, and you're entitled to know what happens to that. But we'd rather say which law is doing the work than imply we did it purely out of goodwill.
If this changes
We'll change the effective date at the top, and if the change is material we'll say what changed rather than quietly reissuing the page. If you have an open inquiry with us when it changes, we'll tell you.
Questions: info@r2revive.com or the contact page.