LEGAL
Policy version approved October 29, 2026.
Buho Consulting LLC operates askbuho.com and Buho Tools. This notice covers the public website, inquiries and free Tools accounts. Client engagements, accounting records and client documents have separate service and recordkeeping arrangements. Public forms and Tools accounts are not a client-document portal. Do not send Social Security numbers, tax documents, bank credentials, account numbers, QuickBooks passwords or other sensitive financial information through them.
We use information you submit to respond to inquiries, understand your needs and discuss possible services. Website inquiries may include your name, email, optional phone number, preferred language, industry, service interest, general message, promotion and referral/campaign details. We also keep the page/source, time and handling status of the inquiry. Campaign/referral tags and the current page can accompany your request. Industry is visible and editable. You can include or remove the tool identifier and overall readiness result using the context checkbox on the request form. Individual self-assessment answers and calculator figures are not included. An account is linked to a request only when its email matches the request email. Free Tools access uses your name, email, language, verification and sign-in records. For authenticated users, we may record tool views, completion, unlocking and consultation clicks, together with tool, industry, language, page, promotion and time. These activity records are linked to your account. Calculator inputs and numerical results are calculated in your browser and are not transmitted to Buho or stored in the website database by the calculators. Information you put in a contact message is submitted with that message.
A session cookie recognizes signed-in users for up to seven days. It is HttpOnly and SameSite=Lax; the session cookie uses Secure in the production configuration. Signing out removes the current session, not your account or every session on other devices. Sign-in links are single-use and valid for 15 minutes. Expiration of access is different from deletion of stored records. Browser session storage remembers campaign/referral tags, promotions, the last tool, industry and overall readiness context. It does not store calculator figures. Browser settings and session restoration can affect its duration. The application sets no advertising cookies and offers no marketing signup. Account and request-related emails are service communications. We and our service providers process technical connection and anti-abuse information to operate and protect the site. This can include an IP address and request information. The application derives rate-limit keys from IP-related information and may pass an IP address with a Cloudflare Turnstile verification request. These controls do not make all website activity anonymous or guarantee that a free-text submission contains no sensitive information.
Cloudflare Pages, D1 and Turnstile provide hosting, database and abuse-prevention services. Brevo delivers sign-in emails and website-request notifications to Buho; sign-in emails contain the one-time access link. Zoho hosts our business email. Calendly handles scheduling when you follow its booking link. Google Fonts receives technical connection information when serving the site's fonts. Providers may process service logs and recovery copies under their applicable arrangements. No advertising analytics is configured in the reviewed application. For client engagements, Buho uses Intuit QuickBooks Online for document requests/uploads and shared access to clients' books. Use the invitations and upload instructions provided for your engagement. These workflows are separate from Buho Tools and public forms. Client records follow their own retention requirements, rather than the website periods below. External services have their own terms and privacy notices.
Our website schedule provides for deletion of non-client inquiries 12 months after the last meaningful contact or closure, and identifiable tool activity 90 days after the event. Free Tools accounts are reviewed after 12 months without use; review does not mean automatic account deletion on that date. Used or expired one-time sign-in records are deleted seven days after use or expiry. Expired session and rate-limit records are deleted seven days after expiry. Access does not remain valid during those additional record-retention periods. Documented legal holds can pause applicable deletions. Client returns, documents, engagement records and professional workpapers follow a separate schedule. Removing an active database record does not immediately erase recovery copies, provider logs or emails already delivered. When restoring records, we reapply applicable deletions. If you request deletion, we explain applicable provider limits and exceptions.
Contact [email protected] to ask about your information, request correction or deletion, or report suspected unauthorized access. We verify the request using the account or inquiry email before acting and explain applicable exceptions. Do not send identity documents, passwords, sign-in links or sensitive financial records through ordinary email. Signing out alone is not an account-deletion request. We may update this notice when our practices change. The published effective date identifies the current version. Questions may be sent to Buho Consulting LLC at [email protected].
