Your information, handled like regulated data.

01Who we are and what this covers

This policy explains how Regulatory Leadership Partners LLC, a Wyoming limited liability company (“we,” “us,” or “the firm”), collects, uses, shares and protects personal information when you visit regulatoryleadership.com, use one of its forms or tools, book a call, subscribe to our briefing, or write to us. For the purposes of the EU and UK General Data Protection Regulations, we are the controller of that information.

It covers the public website and the sign-in pages of our client portal. Information exchanged during a consulting engagement is also governed by the engagement agreement and any confidentiality terms we sign with the client; where those are stricter, they win.

We hold ourselves to the standard we ask of our clients: collect the minimum, use it for the stated purpose, and be able to explain every step.

02Information you give us

Most of what we hold exists because you typed it and pressed send:

• Inquiries. The contact form collects your name, company, email address, phone number (optional), the engagement type and service area you choose, your project description, how you heard about us, and any file you choose to attach.
• Call bookings. When you book a call through the scheduler on our contact page or at the end of the proposal tool, the booking is made with Cal.com, which receives your name, email address, the time you choose and any notes you add. In the proposal tool, your name and email are filled in for you from what you already entered.
• The proposal tool. Our proposal engine asks for your name, company, work email, company website and answers about your project, then prices an estimate. It saves your details as you go: once you have entered an email address and a company name, we receive them together with your answers so far, even if you do not finish. We then email you your estimate.
• The Monthly Briefing. If you subscribe on our home or insights page, we receive your email address so that we can send you the briefing.
• Career applications. The careers form collects your name, email, phone, location, LinkedIn profile, discipline, experience, a message and your résumé, including whatever personal information the résumé contains.
• Correspondence. If you email or call us, we receive whatever you choose to share, and we keep the correspondence as a business record.

We don’t ask for sensitive personal information such as health, financial-account or government-identifier data, and we ask you not to include it. If a résumé or message contains some anyway, we use it only to handle that application or message.

03Information collected automatically

Server and security logs. Our host, Vercel, keeps standard request logs: IP address, browser type, the page requested and the time. Every website has them; we use them to operate and secure the site.

Details sent with a form. When you submit a form, we record the IP address, browser user-agent and referring page with the submission, so that we can recognize abuse and spam.

Analytics, only with your consent. If you choose “Allow analytics” on the banner, three tools load. Google Analytics 4 measures which pages are read, where visitors arrive from and what devices they use. Microsoft Clarity records how pages are used, including clicks, scrolling and a replay of the visit, so we can see what helps readers. PostHog counts page views and visits and the clicks it captures automatically, with session recording switched off and without building visitor profiles. Our Google Analytics configuration keeps Google signals and ad personalization switched off, and Consent Mode keeps every advertising flag denied. Every cookie these tools set is named in our Cookies Policy.

Where you came from, also only with consent. If you allow analytics, the site also remembers the first and most recent campaign link or external site that brought you here (for example a LinkedIn post), and includes that with a form you later send us, so we know which channels help people find us. Without consent, that information is never stored on your device; it is read only from the page you are on and only travels with a form you submit from that page.

Decline the banner, or browse with Global Privacy Control or Do Not Track switched on, and none of the analytics tools loads. What you will not find here, ever: advertising pixels of our own, data sales, or cross-site profiles built by us.

04How we use it, and why

We use personal information only for the purposes below. The EU and UK GDPR require us to name a legal basis for each; the same table tells everyone else exactly what we do.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (section 11). We will not use your information for a new, unrelated purpose without telling you first.

05AI-assisted triage and spam filtering

Triage. When an inquiry arrives through the contact form, its company name, engagement type, service area and message (not your name, email or phone number) are sent to TypeSafe AI, a decision-model service, which returns labels estimating whether the inquiry is genuine, what kind of help it needs and how urgent it looks. The labels only help us sort the inbox. They never change the status of an inquiry and never decide anything: a person reads every inquiry.

Spam filtering. Automated filters discard submissions that match known spam patterns, such as machine-generated text, and submissions sent from known anonymizing-network (Tor) exit addresses. If you think a message you sent has not reached us, email hello@regulatoryleadership.com directly and a person will see it.

Neither process makes a decision that has a legal or similarly significant effect on you, and we do not profile visitors.

06Service providers

These companies process personal information for us, under their contracts and security obligations, to run the parts of the service named. That is the complete list.

The site’s typefaces are served from our own domain, so reading a page sends nothing to a font provider. Links to other sites (regulators, publications, LinkedIn) take you to services whose own privacy practices apply once you arrive.

07Other disclosures

We never sell personal information, and we never share it with advertisers. Beyond the service providers above, information leaves our hands only:

• With your agreement, for example when you ask us to introduce you to a client or a consultant. We never share a candidate’s details with a client without speaking to the candidate first.
• With professional advisers such as accountants, insurers or lawyers, where necessary and under confidentiality.
• When the law requires it, in response to a valid legal process. Where we lawfully can, we will tell you.
• In a business transfer, if the firm is ever merged, acquired or reorganized, under the same protections described here.

08The client portal

Clients and consultants we work with may be invited to an account on our client portal at portal.regulatoryleadership.com. Accounts are by invitation only; sign-in uses a password or a one-time email link, and passwords are stored only as salted hashes. Portal accounts and the engagement information in them are governed by the engagement agreement and confidentiality terms as well as this policy, are visible only to authorized users, and are never used for anything outside the engagement.

Signing in sets the strictly necessary cookies listed in our Cookies Policy. The portal runs no advertising or analytics tools; it does report technical errors to Sentry so we can fix them.

09How long we keep it

We keep personal information only as long as it serves the purpose you gave it to us for, then delete it:

You can shorten any of these at any time by asking us to delete your information (section 11).

10How we protect it

The website and the portal are served only over HTTPS, enforced with strict transport security, so everything you send is encrypted in transit. Submissions and attachments are stored in the portal, not in an inbox, and attachments open only through an authenticated administrator link. Access is limited to the people who need it to respond to you.

No method of transmission or storage is perfectly secure, and we will not pretend otherwise. If a breach ever affects your information, we will tell you, and the regulators who must be told, as the law requires.

11Your rights

Depending on where you live, including the EEA, the United Kingdom and a growing number of U.S. states, the law gives you rights to:

• know what personal information we hold about you and receive a copy, in a portable format where applicable;
• have it corrected or deleted;
• restrict or object to how we use it, including use based on legitimate interests;
• withdraw consent at any time, without affecting what we did before you withdrew it; and
• not be treated differently for exercising any of these rights.

We honor these requests from anyone, wherever you live. Email hello@regulatoryleadership.com and tell us what you would like. We will confirm receipt, may ask you to confirm you control the email address the information is linked to (we never ask for more than we need to verify you), and will complete the request within one month, or within 45 days where a U.S. state law sets that period. You may use an authorized agent; we may ask for proof of their authority.

To unsubscribe from the Monthly Briefing, reply to any issue or email us and we will remove you. To withdraw analytics consent, use the panel on our Cookies Policy.

If we decline a request, we will explain why. You can ask us to reconsider by replying with the word “appeal”, and we will answer within 45 days. If you are in the EEA or the UK, you can also complain to your data protection authority; in the U.S., your state attorney general.

12Notice for U.S. state residents

Privacy laws in California, Colorado, Connecticut, Virginia and other states ask businesses to describe what they collect in standard categories. In the last 12 months we have collected:

We collect these from you directly, from your browser, and from the services named in section 06, for the purposes in section 04, and keep them as section 09 describes. We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it.

Sale and sharing. We do not sell personal information for money and never have. We do not target advertising. One nuance, stated plainly: if you allow analytics, Microsoft Clarity sets cookies that Microsoft documents as also serving its own advertising purposes, and some state laws could treat that as “sharing” for cross-context behavioral advertising. It happens only after you opt in. You can opt out at any time with the panel on our Cookies Policy, and a browser that sends Global Privacy Control is treated as opted out from its first visit.

13International transfers

We are a United States company, and our website, portal and the services in section 06 store information in the United States. If you contact us from elsewhere, your information is transferred to the United States, where privacy law may differ from yours. Our team works remotely, and may access information from other countries, under the same safeguards.

Where European or UK law requires a transfer mechanism, our providers rely on the EU–U.S. Data Privacy Framework and its UK extension where they are certified, or on the European Commission’s Standard Contractual Clauses. Wherever it is processed, we protect your information as this policy describes.

14Children

This is a professional services site for life sciences companies and experienced consultants. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, tell us and we will delete it.

15Changes and revision history

When our practices change, this policy changes first, and the effective date above always shows the current version. If a change materially affects information you have already given us, we will say so prominently here, and ask for your consent where the law requires it.

1. October 12, 2026Full revision: every service provider named with what it receives; legal bases; the proposal tool, call bookings, the Monthly Briefing and AI-assisted triage described; a U.S. state notice; retention by category; campaign attribution now stored only with consent.
2. October 5, 2026Hosting moved to Vercel, with form submissions stored in our client portal; Microsoft Clarity and PostHog named alongside Google Analytics.
3. August 1, 2026The firm’s registered business address added.
4. July 11, 2026First published.

16Contact

Questions, requests and concerns about privacy all go to one inbox, and a person reads every message:

Regulatory Leadership Partners LLC
30 N Gould St Ste N, Sheridan, Wyoming 82801, USA
hello@regulatoryleadership.com