Privacy Policy

Who I am

The Strongbow Group LLC (“I,” “me,” or “the Strongbow Group”) operates ryanphelan.com and is responsible for the personal data described in this policy. If you have any questions, email me at ryanp@ryanphelan.com.

Information I collect

Information you give me directly. When you book a conversation through the scheduling tool on the Contact page, I receive your name, email address, the time you select, and anything you type into the booking form. If you email me, I receive your email address and whatever you choose to include.

Information collected automatically, only after you accept. If you accept the cookie banner, Google Analytics 4 and Google Tag Manager set cookies and collect usage data: the pages you view, an approximate location derived from your IP address, your device and browser type, and how you move through the site. Your consent choice itself is stored in your browser so the site remembers it. None of this loads if you decline.

Business visitor identification, only after you accept, US visitors only. If you accept the cookie banner and you are visiting from the United States, a third-party service called RB2B may identify the business and professional profile associated with your visit, which can include a name, job title, employer, company domain, and a business email address, drawn from LinkedIn and other professional data sources. RB2B performs this person-level identification only for visitors it verifies as US-based. According to RB2B, it is designed to exclude the personal data of EU and UK residents and does not identify EU or UK individuals at the person level; for non-US visitors, at most the company, not the individual, may be identified. Because I gate this service behind the cookie banner, it does not run at all unless you accept.

How I use information

I use the information above to respond to your inquiry and prepare for a conversation you request, to understand how the site is used so I can improve it, to reach out to business visitors identified through RB2B about relevant consulting services, and to keep the site secure and working. I do not use this information to make automated decisions that produce legal effects about you, and I do not build advertising profiles about you for third parties.

Legal bases, for EU and UK visitors

Where the GDPR or UK GDPR applies, I rely on your consent for analytics cookies and for RB2B visitor identification, which you can withdraw at any time; on steps taken at your request before any engagement, when you book or ask about working together; and on my legitimate interests in responding to your inquiries, running and securing the site, and modest business-to-business development, balanced against your rights.

Cookies and your choices

The site uses Google Consent Mode. Before you choose, all analytics and marketing storage is denied by default and nothing that tracks you loads. The banner lets you Accept or Decline: Accept turns on analytics and RB2B, Decline keeps them off. You can change your mind at any time using the “Cookie settings” link in the footer. The main cookies are Google Analytics cookies (named _ga and _ga_<id>), set only after you accept. Your consent choice is stored in your browser’s local storage and is not shared with anyone. You can also control cookies through your browser settings.

Who I share information with

I do not sell your personal information. I share it only with the service providers that make the site work, each acting on my behalf or under its own terms: Google for analytics, OnceHub for scheduling, and RB2B for US business-visitor identification. I may also disclose information if the law requires it, or to protect my rights or the safety of others.

Where your information is processed

I operate from the United States, and the providers above process data in the US and potentially in other countries. If you are in the EU, the UK, or another region with data-transfer rules, your information may be transferred to and processed in the US. Where required, those transfers rely on appropriate safeguards, such as the providers’ standard contractual clauses.

How long I keep it

I keep personal data only as long as I need it: scheduling and contact information for as long as I need to correspond with you and for a reasonable period afterward, analytics data according to Google Analytics’ retention settings, and visitor-identification data for as long as it is useful for business development or until you ask me to delete it.

The Clarity Gap Diagnostic

The diagnostic at clarity.ryanphelan.com collects more than the rest of this site, so it gets its own section. It runs on a subdomain of this site and is covered by this policy rather than a separate one.

What you give me. Your company’s website address, so I know what to look at. Your name, work email address, job title, functional area, your relationship to the company, and how involved you are in its strategy. I ask for the last two because they change how much weight your answers carry, not because they change the analysis.

Your answers to the interview questions. These describe your company’s positioning, your customers, your competitors, and in some cases what is not working. Treat them as you would treat anything you would say in a first meeting with a consultant.

What I collect automatically. A device identifier and your IP address, used to limit how many diagnostics can be started from one place. Page views through Vercel Web Analytics, which uses no cookies and does not follow you to other sites. Web addresses are stripped of anything identifying before they are recorded.

What I collect about your company. The diagnostic reads your company’s public website, public information about your competitors, and public third-party material about your company: reviews, coverage, directory listings, conference programs. All of it is material already published to the open internet.

Some of that material names other people, such as a reviewer or an executive quoted in an article. Those people did not ask to be part of your diagnostic. I use what they published only to establish how the market describes your company, I do not build profiles of them, and I do not include material about them in anything I deliver to you.

Who processes it. Running the diagnostic means passing information through services I do not own. Each one sees only what it needs. The analysis runs through two AI models rather than one, from Anthropic and from OpenAI, so two independent readings can be compared instead of trusting a single one.

Service	What it does	What it sees
Anthropic	Runs part of the analysis	Your interview answers and the research material
OpenAI	Runs part of the analysis	Your interview answers and the research material
Supabase	Stores everything	All of it
Vercel	Hosts the app and counts page views	Requests, and page views without identifying detail
Resend	Sends the verification and delivery emails	Your email address
Cloudflare	Turnstile, which checks you are not a bot	A challenge token, no personal detail
Brave	Web search for market research	Search queries about your company, not about you
Trigger.dev	Runs the longer research jobs	Job state, and the material those jobs carry
OnceHub	Scheduling, if you book a call	Whatever you enter when booking

How long I keep it. I keep your interview answers, the diagnosis, and the research material gathered about your company for 24 months, because the analysis is only useful if I can refer back to it when we speak. Your report is generated from that material when you open it rather than stored as a file, and its link can be switched off at any time. I record when your report is first opened and how many times it has been opened, so I know it reached you. I do not record what you read, how long you spent, or where you were. That record is deleted with the rest of your diagnostic material.

At 24 months. After 24 months the diagnostic is gone. Not archived, not de-identified, gone. One record remains, a contact record: your name, company, email, how far you got, the date you finished, and the fact that you came through the diagnostic. Nothing else survives, not the interview answers, not the research material, not the measurements. I keep the contact record for a reason I will say plainly: the report expires but the working relationship does not, and I want to know that someone who comes back came through the diagnostic and be able to stay in touch.

Verification emails carry a single-use link. I never store the link itself, only a one-way fingerprint of it, so it cannot be recovered from my records even by me.

A human reads it. At present I read every report before it is delivered. That is deliberate and it is how the method is being calibrated. It also means a real person sees your answers. If that is not something you want, do not start a diagnostic.

There is also material I hold that you never see. The analysis produces more than the report shows: two AI readers score your company and write out their reasoning, an internal reviewer challenges what they concluded, and the system keeps a record of how you moved through the diagnostic. None of it is shown to you and none of it is published. It exists so I can check the instrument’s own work, and it goes when the diagnostic goes, at 24 months or sooner if you ask me to delete it.

Your choices. Email ryanp@ryanphelan.com to see, correct, delete, or get a copy of anything the diagnostic holds about you. If you ask me to delete everything, I do, with one exception: a suppression record, so I can honor the request. It holds four things and nothing else: your email address, the date you were acquired, the date you asked to be deleted, and a do-not-contact flag. Everything else goes, the interview answers, the diagnosis, the research material, the measurements, your name and your company. I keep the email address because I cannot honor “never contact me again” without keeping enough to recognize you if your address turns up on a list later, which is standard suppression-list practice. That is the only reason it survives. Deletion is scheduled rather than instant, because analysis may need to re-run on stored material, so I do not promise same-day removal. And if you have downloaded or forwarded a copy of your report, that copy is yours and is outside anything I can reach.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. EU and UK visitors also have the right to lodge a complaint with your local data protection authority. To exercise any of these, email me at ryanp@ryanphelan.com and I will respond. To opt out of RB2B specifically, decline the cookie banner, or accept and then change your choice under “Cookie settings.”

Security

I take reasonable measures to protect personal data, but no website or method of transmission is perfectly secure, and I cannot guarantee absolute security.

Children

This site is intended for a business audience and is not directed to children under 16. I do not knowingly collect personal data from children.

Changes to this policy

I will update this policy as the site changes and revise the “last updated” date above. Meaningful changes will be reflected here.

Contact

The Strongbow Group LLC. Questions about this policy or your data: ryanp@ryanphelan.com.