Privacy Policy

Effective: July 9, 2026 · Last updated: September 25, 2026

The short version

Impeto Labs runs this website at impeto.biz. When you visit the site, submit a form, or book a call, we collect a small amount of information — enough to respond to you and to run the business. We previously published a Diagnostic Scorecard self-assessment; it has been retired, and what it collected while it was available is described below. We don't sell your data. We don't share it with advertisers. We use a short list of specialized tools to handle contact management, analytics, and scheduling, and we're transparent about which ones and why.

This page explains what we collect, how we use it, who processes it on our behalf, and how to reach us if you want your data changed or removed.

What we collect

When you submit a form. Our website has two forms:

  • The Infrastructure Assessment intake form collects your first name, last name, email, company name, company stage (pre-seed, seed, pre-Series A, post-Series A, or other), and the biggest operational challenge you're facing. Two fields are optional: your company website, and how you heard about Impeto.
  • The Contact form collects your first name, last name, email, company name, company stage (the same five choices), and what brings you to Impeto (fixing a specific system, preparing for a raise, a full operational overhaul, a referral from a VC or advisor, or something else). Three fields are optional: your company website, more detail about your situation, and how you heard about us.

When you submit either of these forms, we receive whatever you entered, plus the submission timestamp and a label recording which form it came from. We don't collect any other information about you.

We previously published a third form, the Diagnostic Scorecard. While it was available, it collected your first name, last name, and email, plus your company name and company stage if you chose to give them. Your answers to the self-assessment questions were scored in your browser and were not sent to us — what we received was the resulting scores and Red/Yellow/Green grades for each of the four pillars. Your result was displayed on the page; it was never emailed. That form has been retired, and the scores we received while it was published remain in our records.

When you browse the site. Our analytics provider (Rybbit — see "Who processes your data" below) collects standard web analytics: which pages loaded, referring URL, browser type, general geographic region derived from IP address, and interaction events. Rybbit is a privacy-focused analytics tool that uses minimal cookies. We don't run advertising cookies, retargeting pixels, or cross-site tracking.

When you book a call. Calls — including the Operations Review — are booked through TidyCal rather than through a form on this site. TidyCal collects your name, email, and selected time slot, along with the answers to its own booking questions: your company, funding stage, the area you want to focus on, and anything you add in the open text field. We receive those answers from TidyCal.

How we use it

We use the information you submit to do the specific thing you asked us to do — respond to your inquiry, schedule a call, send you the written summary from an Operations Review, or begin an engagement — and to keep our records straight so nothing falls through the cracks.

Specifically:

  • Contact and intake form submissions go into our customer records so we can respond to you, prepare for the conversation, and track the engagement if you become a client.
  • Diagnostic Scorecard responses generated a result that was displayed on the page immediately. Results were never emailed. The scores we received while the Scorecard was published remain in our records.
  • Analytics data helps us understand which pages people find useful, where visitors come from, and where the site could be clearer.

We don't use your data for advertising, and we don't share, sell, rent, or trade it to third parties for their marketing purposes.

Who processes your data

We use a short list of specialized tools to handle contact management, analytics, scheduling, hosting, and the delivery of your form submission to us. Each of these tools receives specific data for a specific purpose. We chose them because they're focused, well-run, and privacy-respecting.

How a form submission reaches us. When you submit a form on this site, it goes first to a small piece of software we run on Cloudflare's network, which passes it on to Attio. If the handoff to Attio fails — whether Attio can't be reached after several attempts or it rejects the submission — the submission is saved to Cloudflare's key-value storage so your enquiry isn't lost, and a copy is emailed to us through Resend so we can enter it by hand. That fallback only runs when something has gone wrong.

  • Attio — customer relationship management. Stores your contact information, form submissions, and engagement records. Form submissions reach Attio through the relay described above, not directly from your browser.
  • Rybbit — website analytics. Records standard web analytics (page loads, referring URLs, aggregated traffic patterns). Rybbit is privacy-focused and does not track you across other sites.
  • Google Search Console — search performance analytics, provided by Google. Reports on how visitors find the site through Google search. Search Console does not receive form data, and never received Scorecard responses.
  • TidyCal — scheduling, and the booking path for the Operations Review, which is now the first step for most people who get in touch. Stores the booking itself and the answers you give TidyCal's own booking questions: your name, email, company, funding stage, the area you want to focus on, and anything you add in the open text field. Impeto's site does not collect those answers — they are entered on TidyCal and we receive them from TidyCal.
  • Cloudflare Pages — website hosting. Delivers the site files to your browser. Cloudflare receives standard web request data (IP address, browser type, requested URL) as part of routing traffic.
  • Cloudflare Pages Functions — form relay. Receives your form submission from your browser and passes it to Attio. It handles everything you entered, plus the submission timestamp and a label recording which form it came from, and keeps no copy when the handoff succeeds.
  • Cloudflare KV — fallback storage. If a submission can't be delivered to Attio, the full submission is written to a private key-value store so your enquiry isn't lost. Those records stay until we remove them.
  • Resend — email delivery. If a submission can't be delivered to Attio, Resend sends us an alert containing the full submission so we can enter it by hand. We don't use Resend for marketing email.
  • Google Workspace — email. If a form submission can't be delivered to Attio, the alert containing your submission arrives in our mailbox, which runs on Google Workspace.
  • Google Fonts — typography. Loads the site's typeface. Google receives standard web request data when the fonts load.

Each provider has its own privacy practices. Links to each are at the bottom of this page.

Cookies and tracking

Our site uses a small number of cookies, and all of them fall into two categories:

  • Essential — cookies required for the site to function.
  • Analytics — Rybbit uses minimal cookies to distinguish unique visitors from repeat visitors. Rybbit does not track you across other sites and does not build advertising profiles.

We don't use advertising cookies, retargeting pixels, or cross-site tracking of any kind. We don't run Facebook Pixel, Google Ads tracking, LinkedIn Insight Tag, or similar tools.

Your browser gives you control over cookies. Most browsers allow you to review, block, or delete cookies through their settings.

How long we keep it

We keep your information for as long as needed for the purposes described in this policy — to respond to your inquiry, deliver a service, or maintain records of a business relationship — or until you ask us to delete it.

Analytics data collected by Rybbit is retained according to Rybbit's retention policy (linked at the bottom of this page). Search Console data is retained by Google under Google's terms.

If you'd like your data deleted, contact us using the email address at the bottom of this page.

Your rights

You have the right to:

  • Know what personal information we've collected about you.
  • Access a copy of the personal information we have.
  • Correct inaccurate information.
  • Delete personal information we hold.
  • Opt out of any further communications from us.

We don't sell personal information, so there's no need to opt out of a sale.

If you're a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Those rights are consistent with what's above: the right to know, access, correct, delete, and opt out of sale (again — we don't sell). You also have the right to non-discrimination. We won't deny you service or charge different prices because you exercised a privacy right.

To exercise any of these rights, email us at info@impeto.biz. We'll respond within a reasonable timeframe.

Security

We take reasonable measures to protect the information we collect. Our website runs over HTTPS. The providers that hold information you submit to us — Attio, TidyCal, Cloudflare, Resend, and Google Workspace — each maintain their own security programs.

No system is perfectly secure, and we can't guarantee absolute security. If we became aware of a data breach affecting your information, we'd notify you consistent with our legal obligations.

Children's privacy

This site is intended for business audiences and is not directed at children under 16. We don't knowingly collect information from children under 16. If you're a parent or guardian and believe your child has provided information to us, contact us at info@impeto.biz and we'll delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page reflects the most recent change. If we make a material change, we'll flag it at the top of the page for a reasonable period after the change goes into effect.

Governing law

Impeto Labs is based in California. This Privacy Policy is governed by the laws of the State of California.

How to reach us

For questions about this policy, or to exercise any of your rights above, email us at:

info@impeto.biz

Impeto Labs · California, United States

Processor privacy policies

event_upcoming Book an Operations Review