Privacy Policy

Effective: July 9, 2026 · Last updated: July 9, 2026

The short version

Impeto Labs runs this website at impeto.biz. When you visit the site, submit a form, or take our Diagnostic Scorecard, we collect a small amount of information — enough to respond to you and to run the business. We don't sell your data. We don't share it with advertisers. We use a short list of specialized tools to handle contact management, analytics, and scheduling, and we're transparent about which ones and why.

This page explains what we collect, how we use it, who processes it on our behalf, and how to reach us if you want your data changed or removed.

What we collect

When you submit a form. Our website has three forms:

  • The Forensic Audit intake form collects your name, email, company name, company stage, the operational challenge you're working on, and how you heard about us.
  • The Contact form collects your name, email, company name (and optional company website), company stage, reason for contact, an optional detail about your situation, and how you heard about us.
  • The Diagnostic Scorecard collects your responses to a set of diagnostic questions, and — before delivering your results — your name and email so we can send them to you.

When you submit any of these forms, we receive whatever you entered plus the submission timestamp. We don't collect information you didn't enter.

When you browse the site. Our analytics provider (Rybbit — see "Who processes your data" below) collects standard web analytics: which pages loaded, referring URL, browser type, general geographic region derived from IP address, and interaction events. Rybbit is a privacy-focused analytics tool that uses minimal cookies. We don't run advertising cookies, retargeting pixels, or cross-site tracking.

When you book a call. If you schedule a call through our booking link, our scheduling tool (TidyCal) collects your name, email, and selected time slot.

How we use it

We use the information you submit to do the specific thing you asked us to do — respond to your inquiry, schedule a call, deliver your Scorecard results, or begin an engagement — and to keep our records straight so nothing falls through the cracks.

Specifically:

  • Contact and intake form submissions go into our customer records so we can respond to you, prepare for the conversation, and track the engagement if you become a client.
  • Diagnostic Scorecard responses generate your diagnostic results, which are emailed to you and stored in our records for follow-up.
  • Analytics data helps us understand which pages people find useful, where visitors come from, and where the site could be clearer.

We don't use your data for advertising, and we don't share, sell, rent, or trade it to third parties for their marketing purposes.

Who processes your data

We use a short list of specialized tools to handle contact management, analytics, and scheduling. Each of these tools receives specific data for a specific purpose. We chose them because they're focused, well-run, and privacy-respecting.

  • Attio — customer relationship management. Stores your contact information, form submissions, and engagement records. When you submit a form on our site, the data goes directly to Attio.
  • Rybbit — website analytics. Records standard web analytics (page loads, referring URLs, aggregated traffic patterns). Rybbit is privacy-focused and does not track you across other sites.
  • Google Search Console — search performance analytics, provided by Google. Reports on how visitors find the site through Google search. Search Console does not receive form data or Scorecard responses.
  • TidyCal — scheduling. Stores calendar bookings and the contact information you provide when booking a call.
  • Cloudflare Pages — website hosting. Delivers the site files to your browser. Cloudflare receives standard web request data (IP address, browser type, requested URL) as part of routing traffic.
  • Google Fonts — typography. Loads the site's typeface. Google receives standard web request data when the fonts load.

Each provider has its own privacy practices. Links to each are at the bottom of this page.

Cookies and tracking

Our site uses a small number of cookies, and all of them fall into two categories:

  • Essential — cookies required for the site to function.
  • Analytics — Rybbit uses minimal cookies to distinguish unique visitors from repeat visitors. Rybbit does not track you across other sites and does not build advertising profiles.

We don't use advertising cookies, retargeting pixels, or cross-site tracking of any kind. We don't run Facebook Pixel, Google Ads tracking, LinkedIn Insight Tag, or similar tools.

Your browser gives you control over cookies. Most browsers allow you to review, block, or delete cookies through their settings.

How long we keep it

We keep your information for as long as needed for the purposes described in this policy — to respond to your inquiry, deliver a service, or maintain records of a business relationship — or until you ask us to delete it.

Analytics data collected by Rybbit is retained according to Rybbit's retention policy (linked at the bottom of this page). Search Console data is retained by Google under Google's terms.

If you'd like your data deleted, contact us using the email address at the bottom of this page.

Your rights

You have the right to:

  • Know what personal information we've collected about you.
  • Access a copy of the personal information we have.
  • Correct inaccurate information.
  • Delete personal information we hold.
  • Opt out of any further communications from us.

We don't sell personal information, so there's no need to opt out of a sale.

If you're a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Those rights are consistent with what's above: the right to know, access, correct, delete, and opt out of sale (again — we don't sell). You also have the right to non-discrimination. We won't deny you service or charge different prices because you exercised a privacy right.

To exercise any of these rights, email us at info@impeto.biz. We'll respond within a reasonable timeframe.

Security

We take reasonable measures to protect the information we collect. Our website runs over HTTPS. Our data processors — Attio, Rybbit, TidyCal, Cloudflare — each maintain their own security programs.

No system is perfectly secure, and we can't guarantee absolute security. If we became aware of a data breach affecting your information, we'd notify you consistent with our legal obligations.

Children's privacy

This site is intended for business audiences and is not directed at children under 16. We don't knowingly collect information from children under 16. If you're a parent or guardian and believe your child has provided information to us, contact us at info@impeto.biz and we'll delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page reflects the most recent change. If we make a material change, we'll flag it at the top of the page for a reasonable period after the change goes into effect.

Governing law

Impeto Labs is based in California. This Privacy Policy is governed by the laws of the State of California.

How to reach us

For questions about this policy, or to exercise any of your rights above, email us at:

info@impeto.biz

Impeto Labs · California, United States

Processor privacy policies

event_upcoming Book a Forensic Audit