Privacy Policy
1.Introduction
Alamas Labs, Inc., a Delaware corporation trading as bonofici ("bonofici", "we", "us"), operates this website. This policy explains what personal data we collect through it, why, and what rights you have.
Where we process data for a client under a signed services agreement, we act as a processor and that agreement governs. This policy covers the data we control ourselves, principally website visitors and people who contact us.
2.Information We Collect
2.1 Information you provide
If you contact us through the enquiry form or by email, we receive your name, business email address, company name, the type of request, and anything you include in your message. This site has no account, login or payment form.
2.2 Information collected automatically
With optional analytics or advertising consent, we collect:
- pages visited, referring URL, and time of visit;
- with your permission, campaign parameters and advertising click identifiers included in the page URL;
- approximate country, derived from IP address;
- browser type and version, operating system, and device type;
- interactions with calls to action, such as opening the contact page or email.
- a random lead identifier used to connect a submitted enquiry with its original campaign and later sales stage.
- sampled interaction data used to create heatmaps, including pointer movement, clicks, and scroll behaviour.
Optional analytics uses an anonymous session identifier and does not store your IP address. The heatmap script samples some visits. It masks form fields and does not record keystrokes or form contents. Optional advertising measurement may store campaign and click identifiers in your browser for up to 90 days. Your first and most recent campaign touches can then be attached to an enquiry.
2.3 Client data
Data belonging to client organisations, including records inside the work we perform, is processed only under the relevant services agreement, is segregated per client, and is never used to train systems for another client or for our own purposes.
3.How We Use Information
We use personal data to:
- respond to enquiries and carry on a commercial conversation;
- manage enquiries and sales follow-up in our customer relationship system;
- understand how the site is used and improve it;
- with your permission, measure which advertising campaigns lead to enquiries and later sales stages, and help advertising platforms optimise campaigns;
- maintain the security and integrity of the site;
- comply with legal obligations.
We do not sell personal data or send enquiry text or CRM notes to advertising providers.
4.How We Share Information
We share personal data with the providers in clause 5 for the stated purposes, with professional advisers under a duty of confidence, where law or valid legal process requires it, and with an acquirer in connection with a merger or sale of the business.
5.Third-Party Services
Analytics and heatmaps. We use a self-hosted Umami installation for optional analytics and sampled heatmaps. Umami receives the site activity described in clause 2.2 but not your form contents, name, email address, or company.
Hosting. This site is served by Cloudflare, which processes request metadata including IP address in order to deliver and protect the site.
Email. Correspondence you send us is held in our business mailbox.
Customer relationship management. Enquiries are stored in our Twenty CRM at crm.fort.dev. The CRM receives the information you submit, your consent record, and permitted campaign data described in clause 2.2.
Advertising measurement. If you allow advertising measurement, we may send conversion events and campaign identifiers to Google Ads and YouTube, Meta for Facebook and Instagram, LinkedIn, X, Microsoft Advertising, and TikTok. Events describe an enquiry, its later sales stage, or a confirmed payment and use a random event ID for deduplication. Where a platform supports enhanced matching, we may send a normalized, SHA-256 hashed business email address. A hash is a matching identifier, not anonymous data. Advertising tags also receive page URLs, event times, cookie identifiers, IP addresses and browser information directly from your browser. We do not send your raw email address, phone number, company notes, or enquiry text to these providers.
Google, Meta, LinkedIn, X, Microsoft and TikTok tags are enabled only after advertising consent. Providers may link events to their signed-in users. See the privacy notices for Google, Meta, LinkedIn, X, Microsoft and TikTok for their handling of this data.
6.Data Retention
Campaign attribution in your browser expires after 90 days; we retain your consent choice for up to one year. Advertising providers' cookies and records have their own retention periods. Analytics and heatmap data are retained only while useful for site reporting and improvement. If an enquiry does not become a client engagement, we retain its CRM record for up to 24 months after the last contact, including permitted click identifiers and their timestamps saved with the enquiry. Advertising providers apply their own retention periods to events sent to them. Client correspondence is retained for the engagement and as needed to meet legal and accounting obligations afterward.
7.Data Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, access control on a least-privilege basis, and segregation of client data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8.Your Rights and Choices
Subject to your jurisdiction, you may have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have data deleted;
- restrict or object to processing, including our use of analytics;
- withdraw consent where processing relies on it.
Write to hello@bonofici.com to exercise any of these. We will respond within the period required by applicable law. Use the "Privacy preferences" control on any page to withdraw or change optional consent. We default optional processing to off when your browser sends Do Not Track, unless you choose otherwise in that control. Global Privacy Control disables advertising measurement even if you previously allowed it. Browser choices apply to that browser. To withdraw matching for an existing enquiry and later CRM stages, email us so we can update its consent record and notify relevant providers.
9.International Data Transfers
We operate from the United States and use providers that may process data in other countries. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses.
10.European Privacy Rights (GDPR)
10.1 Legal bases
We rely on consent for optional analytics, heatmaps, campaign storage, advertising tags, and conversion matching; legitimate interests to operate and secure the site and to respond to business enquiries; contract where processing is necessary to perform an engagement; and legal obligation where the law requires it.
10.2 Additional rights
You have the right to data portability and the right to lodge a complaint with your local supervisory authority. We would ask you to raise it with us first.
11.California Privacy Rights (CCPA/CPRA)
In the preceding twelve months we have collected identifiers and internet activity information. We do not sell personal information. Optional advertising measurement may constitute "sharing" under California law when used for cross-context behavioural advertising. Reject advertising measurement or withdraw it through "Privacy preferences" to opt out. We do not process sensitive personal information to infer characteristics. California residents may request access, deletion, or correction and will not be discriminated against for exercising those rights.
12.Children's Privacy
This site is directed at businesses and not at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, write to hello@bonofici.com and we will delete it.
13.Changes to This Policy
We may update this policy. The date at the top of this page records the last revision. Material changes will be communicated to anyone with a live engagement.
14.Contact
Alamas Labs, Inc., trading as bonofici. Privacy questions and rights requests go to hello@bonofici.com. We have not appointed a Data Protection Officer, as we are not required to.