Privacy Policy

This policy describes how CRC Cloud® ("CRC Cloud," "we," "us") handles information collected through this website, crccloud.com. It covers the website only. When we deliver managed IT, security, or cloud services to a client, the handling of client data is governed by the signed service agreement for that engagement — not by this page.

The short version

Privacy question or request? Email privacy@crccloud.com. That is the whole process — no form, no account, no cost.
We collect what you send us — a contact form, a booking, a phone call, an email — and we use it to respond to you.
We don't sell or share personal information. No ad pixels, no cross-site trackers, no marketing lists you didn't ask for.
Two analytics tools (Google Analytics 4 and Microsoft Clarity) tell us, in aggregate, how the site is used — and neither loads unless you accept the analytics notice shown on your first visit. Decline it and the site works exactly the same.
Videos wait for you: YouTube embeds use YouTube's privacy-enhanced player and load nothing until you press play. What the site itself stores in your browser is small and functional: your light/dark theme choice, your answer to the analytics notice, and — if you use the chat assistant — that conversation until you close the tab.

Information you give us

The contact form asks for your name, email address, phone number (optional), and message. The form delivers your message to company email, and it is protected by Google reCAPTCHA v3, which evaluates whether a submission is automated (Google's privacy policy and terms apply to that check). A copy is kept in a protected store on our server (not publicly accessible) so we can follow up reliably and keep a record of inquiries; we retain it only as long as it's useful for that purpose, and you can ask us to delete it at any time. The form also includes two invisible anti-spam checks (a decoy field and a timing check); neither collects anything about you.
The newsletter form collects your email address only. We keep a subscriber list with your email, signup date, and the page you signed up from — nothing else — and use it solely to send the newsletter. Everything we send includes a one-click unsubscribe link; unsubscribing stops future sends immediately, and you can also ask us to delete your address entirely.
Booking an assessment. The scheduling calendar on our contact and assessment pages is Microsoft Bookings, served by Microsoft. What you enter there — name, email, phone, notes, the time you pick — goes to Microsoft to create the booking and to us to hold the meeting. Microsoft's own privacy statement applies to its processing.
Phone calls and email. If you call, text, or email us, we receive what you choose to share — typically your name, contact details, and what you need — and we use it to respond.
The free domain & email check. The domain check tool takes one thing: a domain name. It reads that domain's public DNS records and the certificate the site presents to any visitor — the same lookups every mail server on the internet performs. We do not store the domain you check, and we do not associate it with you. To stop the tool being used as someone else's scanner we count requests against a one-way hash of your IP address, which is used only to enforce the limit and is not linked to any query, result, or identity. No account, email address, or sign-up is required or requested.

Information collected automatically

Analytics — loaded only with your consent. On the production website we use two tools, and neither runs until you choose Accept on the analytics notice. The first is Google Analytics 4 (GA4) for aggregate usage — pages viewed, approximate (city-level) location, device and browser type, how visitors arrive, and interaction events such as a phone link clicked or the contact form submitted (events record that an action happened, never what you typed). The second is Microsoft Clarity for aggregate interaction analytics such as heatmaps and anonymized session playback of scrolls and clicks, with text inputs masked. Tag delivery for our marketing measurement may be coordinated by Google Tag Manager, which loads only with that same consent and does not itself collect or store visitor information. Decline, and none of these tools load; our staging copies run no analytics at all.
Server logs. Like nearly every website, our hosting infrastructure keeps standard access logs — IP address, page requested, browser type, timestamp — used for security monitoring and troubleshooting.

Cookies, identifiers & how to say no

If you accept analytics: GA4 sets first-party cookies (names beginning with _ga) containing a random identifier so it can tell returning browsers from new ones (persisting up to two years), and Microsoft Clarity sets first-party cookies (names beginning with _clck and _clsk) that link activity within and across visits. Your IP address is used in transit to derive an approximate location and, per Google's documentation, GA4 does not log or store it. We have not enabled advertising features, remarketing, or cross-site tracking of any kind. If you never accept, none of these cookies are set.

There are several ways to opt out, and all leave the site fully working. Choose Decline on the analytics notice (or change your mind later via the Privacy Choices link in the footer); turn on a Global Privacy Control signal in your browser, which we honor automatically. Block or delete cookies for this site in your browser settings. Or install Google's own Analytics opt-out browser add-on. Your choice is stored in your browser's localStorage under crc-consent.

Separate from analytics: the site stores your light/dark theme choice in your browser's localStorage under the name crc-theme. It's a display preference — it never leaves your device and it is not used to track you. Clear your browser data and the site simply falls back to your operating system's preference.

Embedded content & outbound links

YouTube video. Videos are embedded through YouTube's privacy-enhanced player (youtube-nocookie.com), and nothing loads from YouTube until you press play. Once you do, YouTube (Google) processes your viewing under its own privacy policy.
Microsoft Bookings. The embedded scheduling calendar is served by Microsoft, and Microsoft's privacy statement applies to what happens inside it.
Fonts. The site's typefaces are hosted on our own servers — your browser never requests font files from Google or any other third party.
Links elsewhere — our social profiles, podcast platforms, and sources cited in articles — take you to sites with their own privacy practices. This policy stops at our front door.

How we use information

To respond to inquiries; to schedule and hold assessment calls; to operate, secure, troubleshoot, and improve the website; and to meet legal obligations. We don't use website data for automated decision-making or profiling, and we don't add you to a marketing list because you asked us a question.

How information is shared

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only to:

Service providers that run parts of the website and our business — web hosting and email infrastructure, analytics (Google, Microsoft), form spam protection (Google reCAPTCHA), the AI chat assistant (Anthropic), and scheduling (Microsoft) — each limited to the processing described on this page;
Authorities, when the law requires it — a lawful subpoena, court order, or similar process, or where disclosure is necessary to protect people or defend legal rights;
A successor, if the company or its assets were ever sold or reorganized — in which case this policy continues to apply to the transferred information.

The discretion we practice for clients applies to prospects too: we don't publish who you are, that you inquired, or what you asked.

How long we keep it

Inquiry emails and call notes are kept as ordinary business correspondence — long enough to pick the conversation back up, or as the law requires. Analytics data is retained by Google for the limited window configured in GA4 before it survives only in aggregate reports. Hosting logs rotate on the hosting provider's standard schedule. The AI-assistant question log (question text only, no identity) is pruned after 90 days. If you'd like your inquiry deleted and we have no legal reason to keep it, ask — we will.

Security

The site is served over HTTPS, the contact form validates and strips dangerous input before anything is sent, and submissions are delivered to company email, with a copy kept in a protected, non-public store on our server (described above). No transmission method is perfectly secure — a security company will be the first to tell you that — but protecting information is our trade, and we treat yours accordingly.

If something does go wrong. California law requires any business holding a resident's personal information to notify them promptly if unencrypted personal information is exposed in a security breach, and that duty applies to us no matter how small we are. We would tell you what happened, what was affected, and what we did about it — without waiting to be asked, and without the euphemisms. Holding other companies to that standard is literally what we do for a living.

Your California privacy rights

California's privacy laws (the CCPA, as amended by the CPRA) impose formal duties above certain business-size thresholds. Rather than argue thresholds, we extend the substance of these rights to anyone who asks.

Notice at collection. In the preceding 12 months, this website has collected these categories of personal information:

Identifiers — name, email address, phone number (when you provide them); IP address (automatically, via analytics and server logs);
Professional or commercial information — whatever you choose to include in a message, such as your company or current IT setup;
Internet activity — pages visited, referring site, device and browser type, and the interaction events described above;
Coarse geolocation — the approximate, city-level location analytics derives from IP addresses.

We collect them from you and your browser, for the purposes described on this page, and keep them as described above. We have not sold or shared personal information in the preceding 12 months, and we don't plan to start. We do not knowingly collect sensitive personal information as California defines it — please don't put any in the contact form.

Your rights. California residents may:

Know and access — ask what personal information we hold about you and receive a copy;
Correct — ask us to fix inaccurate personal information;
Delete — ask us to delete personal information, subject to legal exceptions;
Non-discrimination — exercise any of these rights without different treatment from us.

How to exercise them. Email privacy@crccloud.com — that mailbox exists for exactly this and is the fastest route. You can also call (949) 916-6444, send a request through the contact form, or write to the address below. Tell us what you're asking for. We verify requests against the contact details we already hold — for example, by replying to the email address on file — respond within 45 days, and will tell you plainly if the law permits us a 45-day extension. An authorized agent may submit a request for you with your written permission; we'll still confirm with you directly. There is no charge for any of this, and asking costs you nothing in how we treat you.

If we get it wrong. Tell us first — a phone call usually settles it faster than anything else. If you're not satisfied with how we handled a privacy request, you can complain to the California Privacy Protection Agency or the California Attorney General. We would rather you never need either, but you should know they exist.

If you're not in California. We work with clients across the country, and the other state privacy laws now on the books apply to companies far larger than ours. We're not going to sort visitors by ZIP code: whatever your state, ask us the same questions and we'll answer them the same way described above.

Do Not Track and opt-out signals. We honor the Global Privacy Control (GPC) signal: if your browser sends it and you haven't already answered the notice on this site, analytics stay off automatically — exactly as if you had declined — and the banner confirms that for you. If you accepted analytics here on an earlier visit and turned GPC on afterward, that earlier Accept is still what we have on file: open Privacy Choices in the footer and confirm, and analytics stay off from then on. We don't sell or share personal information regardless. Legacy DNT signals aren't standardized, but the same effect is one click away via Decline or the Privacy Choices link.

AI chat assistant. Our website offers an optional AI chat assistant. Messages you type into it are sent to our AI provider (Anthropic) to generate a reply; under Anthropic's commercial API terms those messages are not used to train Anthropic's models by default, and we have not opted in to anything that would change that. To improve the assistant's answers, we keep a log of the questions asked (the question text, the page it was asked on, and a timestamp) — this log deliberately contains no IP address, no account, and no identity, and we prune it after 90 days. Your conversation history lives only in your browser tab (sessionStorage) and disappears when the tab closes. Please don't enter passwords or sensitive personal information into the chat. If you choose to leave your email address in the chat so we can follow up, it is handled exactly like a contact-form submission (see above).

Accessibility widget. We use accessiBe to offer assistive display and navigation options. It is a functional tool, not a tracker; it may set cookies solely to remember your accessibility preferences.

Children

This is a business-to-business website, not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has sent us information, contact us and we will delete it.

Changes to this policy

If our practices change, this page changes first, with a new effective date at the top. Material changes get called out plainly, not buried.

Contact

Privacy questions and requests: privacy@crccloud.com — that mailbox goes straight to a person, with no form and no queue in front of it.

CRC Cloud®
4695 MacArthur Ct, 11th Floor, Newport Beach, CA 92660
(949) 916-6444 · Contact page

This policy was last reviewed on August 27, 2026, and is reviewed whenever the site's data practices change.