How Concho handles your data.

concho.ai and its subdomains are operated by Industrial Cognitive Machines, LLC, doing business as Concho AI (“Concho”, “we”, “us”), a limited liability company organised in the United States with its principal office at 8600 Freeport Parkway, Suite 200, Irving, Texas 75063, USA. For the purposes of the GDPR and UK GDPR, Industrial Cognitive Machines, LLC is the controller of the personal data described in this policy.

We do not have an establishment in the European Union or the United Kingdom. We process data about visitors from those regions only occasionally and in the course of ordinary website operation, so we have not appointed a representative under Article 27 of the GDPR or UK GDPR. If you believe our processing has grown beyond that, tell us and we will review it.

Questions, requests and complaints about privacy go to privacy@concho.ai. Put “Privacy request” in the subject line so it reaches the right person quickly.

The site links to other websites, such as LinkedIn profiles, partner pages and the Google and regulator pages referenced below. Those sites have their own privacy policies, which we do not control, and this policy does not apply to them.

We collect only what is listed below. Each item names the data, the purpose, the legal basis we rely on under the GDPR, and how long we keep it. You are never required by law or contract to give us personal data; if you choose not to, the only consequence is that we cannot respond to you or show you the material in question.

Messages you send us

When you use the contact form we receive your name, email address, company (optional) and the message you write. We use it to answer you and to follow up on the conversation you started. The form is delivered to our mailbox by an email delivery provider and is not stored in any other database.

• Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in responding to enquiries (Art. 6(1)(f)).
• Retention: for as long as the conversation is active and for up to 24 months after our last exchange, unless we enter into a business relationship, in which case the records are kept under that contract.

Web analytics (Google Analytics 4)

We use Google Analytics 4 to understand which pages are read, how visitors arrive, and whether the site works on their devices. Google Analytics sets cookies that assign your browser a random identifier and records the pages you view, the referring site, the approximate region derived from your IP address, your device type, browser and operating system, and the time of each visit. Google Analytics 4 does not log or store IP addresses.

Our configuration is deliberately narrow: Google signals is turned off, advertising features and remarketing are turned off, data is not shared with other Google products, and event-level data is retained for 14 months. On pages we build for specific audiences we may also record which page variant, place, section and step you viewed together with a code identifying the invitation link you received. That code is not your name or email address; it lets us know the material reached its intended audience.

• Legal basis: your consent (GDPR Art. 6(1)(a)) where consent is required for analytics cookies, including the EEA, the United Kingdom and Switzerland. Elsewhere, our legitimate interest in understanding how the site is used (Art. 6(1)(f)).
• Retention: cookies last up to 2 years; event data in Google Analytics is retained 14 months; aggregated reports do not identify you.
• Your choices: decline in the cookie notice, or change your mind later with “Cookie settings” in the footer of every page, which clears the analytics cookies. You can also install the Google Analytics opt-out browser add-on, or clear cookies in your browser. Read Google's privacy policy and how Google uses information from sites that use its services.

Web analytics (Vercel)

Our hosting provider, Vercel, also counts page views. It uses no cookies and no cross-site identifiers. Visits are grouped using a hash that is discarded daily and cannot be reversed into an individual.

• Legal basis: our legitimate interest in measuring site traffic (GDPR Art. 6(1)(f)).
• Retention: aggregated counts only; no per-visitor record is kept.

Server and security logs

Like every website, our servers record each request: the IP address, the page requested, the time, the response status and the browser's user-agent string. We use these logs to keep the site running, to detect abuse, and to diagnose errors.

• Legal basis: our legitimate interest in the security and reliability of the site (GDPR Art. 6(1)(f)).
• Retention: request logs are kept by our hosting provider for a short rolling window and are then deleted.

Private document links

We sometimes send prospective clients a private link to review material prepared for them. When a page behind such a link is opened we record the time, the page, the IP address and the browser's user-agent string, and we look up the approximate location (city, region, country) and the network owner of that IP address using a third-party IP intelligence service. This tells us whether the material reached the person it was meant for and alerts us if a link is being used by someone else.

• Legal basis: our legitimate interest in the confidentiality of client material and in knowing it was delivered (GDPR Art. 6(1)(f)).
• Retention: links are valid for at most 14 days. The access record is deleted 30 days after the link expires. The location lookup for an IP address is cached for 30 days.
• Who sees it: Concho staff only. It is never shared with anyone outside Concho.

Storage in your browser

The site stores two small values in your browser's local and session storage: which headline variant you last saw, so the next one is different, and whether you dismissed the announcement banner. Neither contains an identifier and neither is sent to us.

The table lists every cookie and storage key the site sets. For visitors in the EEA, the United Kingdom and Switzerland the Google Analytics tag is not loaded at all until you accept it in the cookie notice; elsewhere it runs without a prompt, as the law there allows. Your region is read from the country your connection comes from and is not stored. No cookies are used for advertising.

You can delete or block cookies in your browser settings at any time. Blocking the analytics cookies does not affect how the site works.

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the past twelve months. We share data only with the service providers that run the site on our behalf, under contracts that limit them to processing it for us:

• Vercel Inc. (United States): hosting, content delivery, server logs and cookieless page-view counts.
• Google LLC (United States) and Google Ireland Limited for visitors in the EEA: Google Analytics.
• Resend, Inc. (United States): delivers contact-form messages to our mailbox.
• Upstash, Inc. (United States): the database that stores private link records and their access logs.
• IPinfo (United States): looks up the approximate location and network owner of IP addresses that open private links.

We may also disclose personal data when the law requires it, to establish or defend legal claims, or, if Concho is involved in a merger, acquisition or sale of assets, to the parties to that transaction under confidentiality obligations. We do not disclose personal information to third parties for their own direct marketing.

Concho and its service providers are located in the United States, so data about visitors from the EEA, the United Kingdom and Switzerland is transferred there. For each transfer we rely on the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the provider holds one, and otherwise on the European Commission's Standard Contractual Clauses together with the UK Addendum. You can ask us for a copy of the relevant safeguards by writing to privacy@concho.ai.

• Contact-form messages: up to 24 months after our last exchange, or for the life of a resulting business relationship.
• Google Analytics event data: 14 months. Cookies: up to 2 years.
• Server logs: a short rolling window at our hosting provider.
• Private link access records: until 30 days after the link expires, which is at most 44 days after it was created. IP location lookups: 30 days.
• Browser storage values: until you clear them, or until you close the browser for session values.

When a retention period ends the data is deleted or anonymised so it can no longer be linked to you.

If the GDPR, UK GDPR or Swiss data protection law applies to you, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Have inaccurate data corrected and incomplete data completed.
• Have your data erased where there is no longer a lawful reason for us to keep it.
• Restrict how we process your data while a question about it is resolved.
• Receive the data you gave us in a portable, machine-readable format.
• Object to processing based on our legitimate interests. We will stop unless we can show compelling grounds that override your interests.
• Withdraw consent at any time where processing is based on consent, without affecting what was done before you withdrew it.
• Lodge a complaint with a supervisory authority, in particular in the country where you live or work. See the list of EU data protection authorities or the UK Information Commissioner's Office.

We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not profile you.

Residents of California and of other states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas and Oregon, have rights over their personal information. Concho is a small business and may fall below the thresholds at which some of these laws apply, but we extend the following rights to every U.S. visitor:

• Know what personal information we have collected about you, the sources, our purposes, and the categories of third parties we have disclosed it to.
• Access and receive a copy of that information in a portable format.
• Correct inaccurate personal information.
• Delete personal information we collected from you, subject to legal exceptions.
• Opt out of the sale or sharing of personal information and of targeted advertising. We do none of these, so there is nothing to opt out of.
• Not be discriminated against for exercising any of these rights.

In the past twelve months we have collected the following categories of personal information, as the California law defines them: identifiers (name, email address, IP address, cookie identifiers); professional information (company name); internet or network activity (pages viewed, referring site, browser and device); and approximate geolocation derived from IP address. We collect it directly from you and from your browser, for the purposes described above. We do not collect sensitive personal information and we do not knowingly collect information from anyone under 16.

Because we do not sell or share personal information, browser opt-out signals such as Global Privacy Control do not change how we treat your data; there is no sale or sharing to switch off. Under California's “Shine the Light” law you may ask once a year whether we have disclosed personal information to third parties for their direct marketing. The answer is that we have not.

Email privacy@concho.ai with “Privacy request” in the subject line and tell us what you would like us to do. You may also authorise someone to make a request on your behalf; we will ask for evidence of that authority.

To protect your data we verify requests by replying to the email address we hold for you, or by asking for enough detail to match you to our records. We respond within one month under the GDPR and within 45 days under U.S. state laws, and we will tell you if we need the additional time those laws allow. Requests are free unless they are clearly unfounded or excessive. If we refuse a request we will explain why and how to appeal.

concho.ai is a business site and is not directed at children. We do not knowingly collect personal information from anyone under 16, or under 13 as defined by the U.S. Children's Online Privacy Protection Act. If you believe a child has given us personal information, write to privacy@concho.ai and we will delete it.

All traffic to concho.ai is encrypted in transit. Private document links are random, expire automatically, and are served with headers that prevent caching, indexing and referrer leakage. Access to the systems that hold contact messages and link records is limited to the Concho staff who need it and is protected by authentication. No method of transmission or storage is perfectly secure, so we cannot promise absolute security, but we keep the data we hold to a minimum and for a short time.

When we change this policy we update the date at the top of the page. If a change materially affects how we use your personal data we will say so prominently on the site before it takes effect. The current version is always at concho.ai/privacy.