Privacy policy.

1.Introduction.

Innovatum, Inc. ("Innovatum", "we", "us" or "our") respects your privacy. This policy explains how we collect, use, disclose and safeguard personal information when you visit innovatum.com, contact us, request information about our products, or otherwise interact with us.

This policy applies to this website and to our marketing. It does not apply to personal information that our customers put into our software, RONOVA or ROBAR for customers still running it, or that we process on a customer's behalf as a processor. That is governed by the applicable customer agreement and data processing agreement, not by this policy. If you work for one of our customers and have a question about data held in your own organisation's system, ask that organisation: we cannot answer for their records.

2.What you send us.

This site has two forms, the contact form and the demo request. They collect what you type into them: your name, work email address, company, and whatever you write in the message, along with fields such as your primary market or how many sites you operate. If you email or telephone us instead, we hold what you send.

We use it to answer you. It is not sold, and it is not used to build an advertising profile.

Please do not send sensitive information through this website. We do not ask for it and do not want it: no health information, no patient data, no government identification numbers, no payment card details.

3.What is recorded with it.

When you submit a form, the following is recorded alongside what you typed. None of it is secret and all of it is ordinary for a web form, but a notice that does not list it is not accurate:

• Your IP address, as seen by our host, and the country it resolves to
• Your browser's user-agent string
• The page you submitted the form from
• Any utm_source, utm_medium, utm_campaign, utm_term or utm_content parameters present in the address you arrived at, which come from the link you followed, typically a campaign or a newsletter
• Which pricing tier you came from, if you reached the demo form from one
• Whether the anti-spam check passed, and how long the form took to fill in

4.What is collected automatically.

Less than you might expect. Our host keeps the standard server logs needed to serve and protect the site, including addresses and requested pages. Beyond those logs and the form metadata above, this site measures nothing about your visit unless you accept analytics cookies.

If you do accept, the analytics tag records the pages you view, the links you follow and the files you download, how far you scroll, whether you play a video or start a form (never what you type into it), the words you search for on the FAQ page, the site or search that referred you, and your approximate location, browser and device type. Until then it is not loaded at all: your browser makes no request to Google and no analytics cookie is set. See the cookies section below.

5.Information from other sources.

We may receive your business contact details from a colleague who refers you, from an event we take part in, or from a publicly available source such as your employer's website. We may combine that with information we already hold about you in order to respond sensibly.

6.How we use information.

We use personal information to:

• respond to your enquiry and provide the information, materials or support you ask for
• provide, maintain, secure and improve this website and its content
• send marketing communications, product announcements and event invitations where you have consented or the law otherwise allows it, and manage your preferences
• understand how visitors use the site and whether our content is working
• establish, manage and administer our business relationships and meet our contractual obligations
• detect, investigate and prevent spam, fraud, abuse and security incidents
• comply with applicable law and legal process, and enforce our terms and protect our legal rights

7.Legal bases for processing.

Where data protection law requires a legal basis, including in the European Economic Area, the United Kingdom and Switzerland, we rely on one or more of the following: your consent; the performance of a contract with you, or steps taken at your request before entering into one; compliance with a legal obligation; and our legitimate interests in operating, promoting, securing and improving our business, where those interests are not overridden by your rights.

Analytics cookies are used only with your consent, and you can withdraw it at any time through the Cookie Preferences link in the footer of any page. Withdrawing consent does not affect anything done before you withdrew it.

8.Who else processes it.

We do not sell personal information.

We disclose personal information to the following, and we name our current service providers rather than describing them in the abstract, because a list of categories is not much use to anyone checking:

• Service providers, each allowed to use the information only to provide its service to us. Cloudflare hosts and delivers this site and runs the anti-spam check on our forms, so it receives your IP address, browser details and the pages you request. Smartsheet receives enquiry records: what you type into a form, and the details listed under "What is recorded with it". Google provides tag management and analytics and, only if you accept analytics cookies, receives the pages you view, the referring site, your IP address and approximate location, your browser and device type, and the identifier stored in its cookie. If you do not accept, Google receives nothing from this site unless you choose to load the map on our contact page.
• Professional advisers. Lawyers, auditors, accountants and insurers, where needed.
• Corporate transactions. A prospective or actual acquirer, investor or successor in connection with a merger, acquisition, financing, reorganisation or sale of assets, subject to appropriate confidentiality protections.
• Legal and safety. Law enforcement, regulators, courts or others, where we believe disclosure is required by law or legal process, or is reasonably necessary to protect the rights, property or safety of Innovatum, our customers or others.
• At your direction. Anyone else you have asked or agreed for us to share with.

9.Cookies and analytics.

Nothing that measures you runs on this site until you say so. The analytics tag is not loaded until you accept: before that your browser makes no request to Google and no analytics cookie is set. Accepting and refusing are offered as equal choices, and you can change your mind at any time through the Cookie Preferences link in the footer of every page. If you withdraw, the analytics cookies are deleted and the tag is not loaded on later pages.

There are two categories. Strictly necessary cookies and storage make the site work and cannot be switched off here. Analytics cookies, if you accept them, let us count visitors and see which pages get read. This site runs no advertising, remarketing or call-tracking tools.

If you accept analytics we use Google Analytics 4, loaded through Google Tag Manager. It sets cookies that recognise a returning browser, so we can tell how many people use the site, which pages they read and where they arrived from. We use that to decide what to write and what to fix. We do not use it to identify you personally, and we do not sell it.

A few things are set whatever you choose, because the site needs them or because you asked for them. All of them are in the list in the next section.

Most browsers also let you block or delete cookies in their own settings, which may change how the site works. We do not respond to the "Do Not Track" browser setting, because no common standard for it was ever agreed, and we do not currently read the Global Privacy Control signal either. Neither changes what happens before you choose, because nothing measuring you runs until you accept it.

10.The cookies and storage this site uses.

This is the complete list. Anything not on it is not set by this site.

• _ga, and _ga_ followed by a property code. Google Analytics, only if you accept analytics. They tell one browser from another so visits can be counted, and last up to 13 months, or until you withdraw consent.
• consent.choice, kept in your browser's local storage. Remembers your cookie decision so you are not asked on every page, and is never sent anywhere. Strictly necessary.
• lead.attribution, kept in your browser's session storage for the length of your visit, and only if you arrived through a link carrying utm_ campaign parameters. It holds those parameters so they can be attached to a form you submit, and is sent nowhere unless you submit one.
• Cloudflare security cookies such as __cf_bm and cf_clearance, set by our host to tell people from automated traffic and to protect the site. Short-lived. Strictly necessary.
• Cloudflare Turnstile, the anti-spam check on the contact and demo forms, may store data in your browser when it runs on those pages. Strictly necessary for the forms.
• Google Maps cookies, only if you click Show map on the contact page. Until then Google receives no request and sets nothing. Once loaded, the map is Google's, under Google's terms.

11.Marketing email.

If you get marketing email from us you can unsubscribe at any time using the link in any message, or by writing to us using the details below. We act on opt-outs promptly. We may still send you messages about a transaction, a support matter or an ongoing business relationship, because those are not marketing.

12.How long it is kept.

We keep personal information for as long as it is needed for the purposes described here, including keeping business records and meeting legal, tax, accounting and regulatory obligations, resolving disputes and enforcing agreements. How long that is varies by record type. When personal information is no longer needed we delete it or de-identify it.

Google Analytics keeps the visit data linked to its cookies for 14 months, then deletes it. Only aggregated reports, which identify no one, are kept after that.

13.Information leaving your country.

We are based in the United States, and the service providers named above process information in the United States and elsewhere. If you are outside the United States, information you send through this site will be transferred to and processed in the United States, whose data protection laws differ from those of your own country.

Where a transfer of personal information out of the European Economic Area or the United Kingdom requires a specific safeguard, we rely on an appropriate one. You can ask which applies to a particular transfer using the contact details below.

14.Security.

We maintain administrative, technical and physical safeguards intended to protect personal information against unauthorised access, disclosure, alteration and destruction.

On this website specifically: every page and form submission is served over HTTPS and insecure requests are upgraded, the site runs behind our host's network protection, a content security policy restricts what the page is allowed to load, and the forms carry layered spam defences including an anti-spam check. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15.Your rights.

Depending on where you live you may have some or all of the following rights over your personal information: to access it or get a copy; to correct inaccuracies; to ask for deletion; to ask for a portable copy; to object to or restrict certain processing; to withdraw consent you gave earlier; to opt out of targeted advertising, the sale of personal information or certain profiling; and not to be treated worse for exercising any of them. If you are in the European Union, the United Kingdom, Brazil or California, these are set out in law and we will honour them.

To make a request, write to us at the postal address below or use our contact form, and say what you want. We will not ask you to justify the request. We will verify who you are before we answer, which may mean asking you for more information, and you may use an authorised agent where the law allows it. We answer within the time limits the applicable law sets.

If you are not satisfied with our answer, you can complain to your local data protection authority or, in the United States, to your state attorney general.

16.Children.

This website and our products are meant for business use and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, tell us and we will delete it.

17.Other sites and embedded content.

This site links to other websites and to social media profiles we do not control, and the contact page can load an embedded Google map if you ask it to. This policy does not cover those services and we are not responsible for how they handle your information. Read the privacy notice of any third-party service you use.

18.Contacting us.

Innovatum, Inc., 1400 Buford Highway Northeast, Sugar Hill, GA 30518, United States. You can also reach us through the contact form on this site.

Write to that address for anything in this policy, including a request about your own information.

19.Changes to this policy.

We may update this policy to reflect changes in our practices, our technology or the law. The revised version goes on this page and the date at the top of it changes. If we make material changes we will give additional notice where the law requires it.