Privacy policy

This policy covers www.getsafeashouses.com, the public website you are reading now. It is short because the site does very little: it publishes information, and it has two forms you can use to get in touch.

If you become a client of the full advisory service, the work itself happens in our client portal at app.kearcontinuity.com, which is a separate application with its own privacy policy. The portal necessarily holds much more than this site does, because building a continuity plan means recording what accounts and devices exist, who is authorized to act, and where recovery materials are kept. That is a different relationship with a different policy, and you should read it before an engagement begins rather than assume this one describes it.

Read the client portal privacy policy.

You book a call or a session on Cal.com, the booking service we use, and for a session, Stripe, the payment service, processes the payment. Both are separate services with their own privacy policies. What you enter when you book, such as your name, your email address and the time you choose, reaches us so we can hold your call or session. We never see your card number.

Only what you submit through a form. The contact and consultation forms ask for:

• Your name and email address. Required, so we can reply.
• A phone number. Optional.
• What you are interested in. On the consultation form only, chosen from a short list.
• Your message. Whatever you choose to tell us.

Alongside that submission we also record which form you used (so a note from an attorney is not read as a prospective client enquiry) and your IP address, which is used to limit automated abuse of the forms.

This website collects nothing else. There are no accounts on it, nothing to sign in to, and no profile built about you. Simply reading the site leaves nothing with us beyond the anonymous measurements described in section 6.

If you book a session, our client portal keeps a record of it, so we can prepare and so your session page works. You never need an account for it. The record holds:

• Your name and email address, and the time you booked. They come from your booking.
• Your answers to the questions before your session, if you choose to send them.
• Your Exposure Snapshot: the list of known data breaches that include your email address.
• Our notes from the session, and which steps were done.

It never holds a password, a code, a PIN or a recovery phrase, or where one is kept. No AI service sees any of it. Your session page, your snapshot and your recap (the summary we send after your session) are written from sentences we wrote and checked in advance.

We do not want, ask for, or have any way to receive passwords, recovery codes, backup codes, seed phrases, private keys, or authenticator secrets. Not through this form, and not at any later point in the work. Those materials stay with you, always.

Please do not put anything sensitive into the message box. A form on a public website is the wrong place for it, and you do not need to provide any of it for us to be useful in a first conversation.

A submission is forwarded to our client portal, which records it and notifies the advisor. We use it to read what you sent and to reply to you.

If we prepare an Exposure Snapshot for you, a short report of where your email address appears in known data breaches, we look your email address up with Have I Been Pwned, a breach-lookup service. For a session, Have I Been Pwned is the only other service that sees your email address for the snapshot: the report is written from sentences we wrote and checked in advance, and no AI service sees it. In the full advisory service, the list of breaches it finds, with any notes your advisor adds, also goes to Anthropic, the AI service that helps us draft the report, and your advisor reviews the report before you see it. Section 5 says what Anthropic receives and what it may keep.

We do not sell it, share it with advertisers or data brokers, use it for advertising or behavioural profiling, use it to train machine learning models, or add you to a marketing list. You will not receive unsolicited mail from us because you filled in a form.

Nothing is stored on this website. It has no database. Your submission is passed straight through to the client portal, which stores it in an encrypted database and sends the advisor an email. The portal’s privacy policy, linked in section 1, describes that storage in full.

The services involved are:

• Vercel. Hosts this website and delivers it to your browser.
• Cloudflare. Provides the anti-spam widget on the two form pages, which is how we tell people apart from automated submissions.
• Supabase and Resend. Used by the client portal to store the submission and to send the advisor a notification and, if you book a session, to keep its record and send you its emails.

Each of these is contractually bound to use the data only to provide that function to us, and not for any purpose of their own.

Two more are involved only in particular cases. Have I Been Pwned looks up your email address if we prepare an Exposure Snapshot for you, as section 4 describes. Anthropic, the AI service, is used only in the full advisory service: it helps us draft that report and written analysis for your plan. Nothing from a session goes to it. What we send can include your questionnaire answers, our notes and the written record of your interview, and the list of known data breaches that include your email address. We do not add your name or email address, but answers and notes go as written, so they can still identify you. Anthropic’s terms for business customers do not allow it to train its AI models on this information, and it may keep a copy for a period set by its own rules.

This website sets no cookies of its own, and nothing here tracks you across other websites.

We measure how the site is used with Vercel Analytics and Vercel Speed Insights. Both are privacy-preserving by design: they use no cookies, do not fingerprint your device, and do not follow you anywhere else. They tell us which pages are read and how quickly they load. They do not tell us who you are.

On the two form pages only, Cloudflare’s anti-spam widget may set a cookie of its own as part of distinguishing a person from an automated script. That is the one exception, it applies only to those pages, and it exists to keep the forms usable.

An enquiry is kept for as long as it is useful to the conversation it started, and for a reasonable period afterwards. If a conversation does not lead anywhere, you can ask us to delete it and we will. If it becomes an engagement, the retention terms in the portal’s policy take over.

You can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete it.
• Send it to you in a portable format.
• Stop any processing you think is not justified.

Write to privacy@kearcontinuity.com and we will respond within 30 days. You do not need to give a reason.

If we change this policy in a way that matters, we will update the effective date at the top. We will not make retroactive changes that reduce your rights.

Questions about this policy, or about how your information is handled: