Privacy Policy

This policy describes how CRC Cloud® ("CRC Cloud," "we," "us") handles information collected through this website, crccloud.com. It covers the website only. When we deliver managed IT, security, or cloud services to a client, the handling of client data is governed by the signed service agreement for that engagement — not by this page.

The short version

• We collect what you send us — a contact form, a booking, a phone call, an email — and we use it to respond to you.
• We don't sell or share personal information. No ad pixels, no cross-site trackers, no marketing lists you didn't ask for.
• Two analytics tools (Google Analytics 4 and Microsoft Clarity) tell us, in aggregate, how the site is used — and neither loads unless you accept the analytics notice shown on your first visit. Decline it and the site works exactly the same.
• Videos wait for you: YouTube embeds use YouTube's privacy-enhanced player and load nothing until you press play. The only thing the site itself stores in your browser is your light/dark theme choice.

Information you give us

• The contact form asks for your name, email address, phone number (optional), and message. The form delivers your message to company email, and it is protected by Google reCAPTCHA v3, which evaluates whether a submission is automated (Google's privacy policy and terms apply to that check). A copy is kept in a protected store on our server (not publicly accessible) so we can follow up reliably and keep a record of inquiries; we retain it only as long as it's useful for that purpose, and you can ask us to delete it at any time. The form also includes two invisible anti-spam checks (a decoy field and a timing check); neither collects anything about you.
• The newsletter form collects your email address only. We keep a subscriber list with your email, signup date, and the page you signed up from — nothing else — and use it solely to send the newsletter. Every issue includes a one-click unsubscribe link; unsubscribing stops future sends immediately, and you can also ask us to delete your address entirely.
• Booking an assessment. The scheduling calendar on our contact and assessment pages is Microsoft Bookings, served by Microsoft. What you enter there — name, email, phone, notes, the time you pick — goes to Microsoft to create the booking and to us to hold the meeting. Microsoft's own privacy statement applies to its processing.
• Phone calls and email. If you call, text, or email us, we receive what you choose to share — typically your name, contact details, and what you need — and we use it to respond.

Information collected automatically

• Analytics — loaded only with your consent. On the production website we use two tools, and neither runs until you choose Accept on the analytics notice. The first is Google Analytics 4 (GA4) for aggregate usage — pages viewed, approximate (city-level) location, device and browser type, how visitors arrive, and interaction events such as a phone link clicked or the contact form submitted (events record that an action happened, never what you typed). The second is Microsoft Clarity for aggregate interaction analytics such as heatmaps and anonymized session playback of scrolls and clicks, with text inputs masked. Tag delivery for our marketing measurement may be coordinated by Google Tag Manager, which loads only with that same consent and does not itself collect or store visitor information. Decline, and none of these tools load; our staging copies run no analytics at all.
• Server logs. Like nearly every website, our hosting infrastructure keeps standard access logs — IP address, page requested, browser type, timestamp — used for security monitoring and troubleshooting.

Cookies, identifiers & how to say no

If you accept analytics: GA4 sets first-party cookies (names beginning with _ga) containing a random identifier so it can tell returning browsers from new ones (persisting up to two years), and Microsoft Clarity sets first-party cookies (names beginning with _clck and _clsk) that link activity within and across visits. Your IP address is used in transit to derive an approximate location and, per Google's documentation, GA4 does not log or store it. We have not enabled advertising features, remarketing, or cross-site tracking of any kind. If you never accept, none of these cookies are set.

There are several ways to opt out, and all leave the site fully working. Choose Decline on the analytics notice (or change your mind later via the Privacy Choices link in the footer); turn on a Global Privacy Control signal in your browser, which we honor automatically. Block or delete cookies for this site in your browser settings. Or install Google's own Analytics opt-out browser add-on. Your choice is stored in your browser's localStorage under crc-consent.

Separate from analytics: the site stores your light/dark theme choice in your browser's localStorage under the name crc-theme. It's a display preference — it never leaves your device and it is not used to track you. Clear your browser data and the site simply falls back to your operating system's preference.

Embedded content & outbound links

• YouTube video. Videos are embedded through YouTube's privacy-enhanced player (youtube-nocookie.com), and nothing loads from YouTube until you press play. Once you do, YouTube (Google) processes your viewing under its own privacy policy.
• Microsoft Bookings. The embedded scheduling calendar is served by Microsoft, and Microsoft's privacy statement applies to what happens inside it.
• Fonts. The site's typefaces are hosted on our own servers — your browser never requests font files from Google or any other third party.
• Links elsewhere — our social profiles, podcast platforms, and sources cited in articles — take you to sites with their own privacy practices. This policy stops at our front door.

How we use information

To respond to inquiries; to schedule and hold assessment calls; to operate, secure, troubleshoot, and improve the website; and to meet legal obligations. We don't use website data for automated decision-making or profiling, and we don't add you to a marketing list because you asked us a question.

How information is shared

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only to:

• Service providers that run parts of the website and our business — web hosting and email infrastructure, analytics (Google, Microsoft), form spam protection (Google reCAPTCHA), the AI chat assistant (Anthropic), and scheduling (Microsoft) — each limited to the processing described on this page;
• Authorities, when the law requires it — a lawful subpoena, court order, or similar process, or where disclosure is necessary to protect people or defend legal rights;
• A successor, if the company or its assets were ever sold or reorganized — in which case this policy continues to apply to the transferred information.

The discretion we practice for clients applies to prospects too: we don't publish who you are, that you inquired, or what you asked.

How long we keep it

Inquiry emails and call notes are kept as ordinary business correspondence — long enough to pick the conversation back up, or as the law requires. Analytics data is retained by Google for the limited window configured in GA4 before it survives only in aggregate reports. Hosting logs rotate on the hosting provider's standard schedule. The AI-assistant question log (question text only, no identity) is pruned after 90 days. If you'd like your inquiry deleted and we have no legal reason to keep it, ask — we will.

Security

The site is served over HTTPS, the contact form validates and strips dangerous input before anything is sent, and submissions are delivered to company email, with a copy kept in a protected, non-public store on our server (described above). No transmission method is perfectly secure — a security company will be the first to tell you that — but protecting information is our trade, and we treat yours accordingly.

Your California privacy rights

California's privacy laws (the CCPA, as amended by the CPRA) impose formal duties above certain business-size thresholds. Rather than argue thresholds, we extend the substance of these rights to anyone who asks.

Notice at collection. In the preceding 12 months, this website has collected these categories of personal information:

• Identifiers — name, email address, phone number (when you provide them); IP address (automatically, via analytics and server logs);
• Professional or commercial information — whatever you choose to include in a message, such as your company or current IT setup;
• Internet activity — pages visited, referring site, device and browser type, and the interaction events described above;
• Coarse geolocation — the approximate, city-level location analytics derives from IP addresses.

We collect them from you and your browser, for the purposes described on this page, and keep them as described above. We have not sold or shared personal information in the preceding 12 months, and we don't plan to start. We do not knowingly collect sensitive personal information as California defines it — please don't put any in the contact form.

Your rights. California residents may:

• Know and access — ask what personal information we hold about you and receive a copy;
• Correct — ask us to fix inaccurate personal information;
• Delete — ask us to delete personal information, subject to legal exceptions;
• Non-discrimination — exercise any of these rights without different treatment from us.

How to exercise them. Call (949) 916-6444, send a request through the contact form (submissions reach company email directly), or write to the address below. Tell us what you're asking for. We verify requests against the contact details we already hold — for example, by replying to the email address on file — respond within 45 days, and will tell you plainly if the law permits us a 45-day extension. An authorized agent may submit a request for you with your written permission; we'll still confirm with you directly.

Do Not Track and opt-out signals. We honor the Global Privacy Control (GPC) signal: if your browser sends it, analytics stay off automatically — exactly as if you had declined the notice — and the banner confirms that for you. We don't sell or share personal information regardless. Legacy DNT signals aren't standardized, but the same effect is one click away via Decline or the Privacy Choices link.

AI chat assistant. Our website offers an optional AI chat assistant. Messages you type into it are sent to our AI provider (Anthropic) to generate a reply; per Anthropic's API terms they are not used to train its models. To improve the assistant's answers, we keep a log of the questions asked (the question text, the page it was asked on, and a timestamp) — this log deliberately contains no IP address, no account, and no identity, and we prune it after 90 days. Your conversation history lives only in your browser tab (sessionStorage) and disappears when the tab closes. Please don't enter passwords or sensitive personal information into the chat. If you choose to leave your email address in the chat so we can follow up, it is handled exactly like a contact-form submission (see above).

Accessibility widget. We use accessiBe to offer assistive display and navigation options. It is a functional tool, not a tracker; it may set cookies solely to remember your accessibility preferences.

Children

This is a business-to-business website, not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has sent us information, contact us and we will delete it.

Changes to this policy

If our practices change, this page changes first, with a new effective date at the top. Material changes get called out plainly, not buried.

Contact

CRC Cloud®
4695 MacArthur Ct, 11th Floor, Newport Beach, CA 92660
(949) 916-6444 · Contact page

This policy was last reviewed on July 25, 2026, and is reviewed whenever the site's data practices change.