Privacy policy

Last updated: August 21, 2026

Citadel Cloud Management ("Citadel", "we", "us") operates citadelcloudmanagement.com (the "site"). This policy describes the personal information the site collects, why we collect it, how long we keep it, who else processes it, and what you can ask us to do about it. It describes this website only. Consulting engagements are governed by the data-protection terms of the engagement agreement, not by this page.

Citadel Cloud Management is the controller of the personal information described here.

What this site does not do

Saying this plainly, because it determines most of what follows:

No payments. The site has no shop, no cart, and no checkout, and takes no card or bank details. Nothing here is for sale.
No accounts. There is no login, no password, and no user profile.
No advertising or cross-site tracking. No ad pixels, no retargeting, no audience sharing with ad networks.
No sale or sharing of personal information for money or for targeted advertising, as those terms are defined under US state privacy laws.
No automated decision-making that produces legal or similarly significant effects about you. Nothing on this site scores, ranks, approves, or rejects a person.
No model training on your data. Information you send us is never used as training data for any AI model, ours or a third party's.

What we collect, and why

What	When	Why	Legal basis (UK/EEA)
Name, email, subject, message	You send the contact form	To read and answer your message	Legitimate interests — replying to someone who contacted us
Email address, and optionally your interest	You subscribe to the newsletter	To send the newsletter you asked for	Consent
Email address, company (optional)	You request a free download	To deliver the file and follow up about it	Consent
Referrer and campaign parameters (UTM tags) attached to a form submission	You arrive from a link or campaign and then submit a form	To know which content brings people who get in touch	Legitimate interests — measuring what works
Name and email you type into the booking calendar	You book a call	To hold the appointment	Contract (steps taken at your request)
Your IP address, held briefly in memory	Every form submission	Rate limiting, to stop automated abuse of the forms	Legitimate interests — securing the service
Analytics events (pages viewed, approximate location, device and browser)	Only after you accept on the cookie banner	To understand which pages are useful	Consent

That is the complete list. The site keeps no database of visitors; there is nothing here to log into and no profile built about you.

Who else processes it

The site routes data through a short list of third parties. Each one, with its purpose and the category of data it sees, is published and kept current at Security and subprocessors. That page is the single source; this is a summary of it:

Render — hosting for the site itself.
Resend — transactional email delivery, the newsletter list, and lead-magnet delivery. Form submissions reach us through Resend.
Google Calendar appointment scheduling — the booking calendar embedded on Book a call. The calendar is Google's; what you type into it goes to Google, not through our site.
Google Analytics 4 — analytics, loaded only after you accept. IP anonymization is on and ad personalization signals stay switched off.
Google Fonts — typefaces, served from Google.

We do not sell your personal information to anyone, and we do not hand it to marketing partners.

How we use AI, and where it stops

Citadel builds AI systems, so it is fair to ask what runs against your data here.

Content on this site is AI-assisted. Articles, guides, and reference pages are drafted with AI tooling and reviewed by a human before publication. Technical details, prices, certification requirements, and salary figures change; verify anything you plan to act on against the vendor's own documentation.
AI tooling is used for our own research and outreach drafting. It runs against business contact information from commercial data sources, not against visitors to this site.
Your submissions are not fed to a model as training data, and no AI system makes a decision about you.
The site itself runs no chatbot or assistant, so there are no prompts or conversations for us to retain.

How long we keep it

Contact-form enquiries: up to 24 months from the last exchange, then deleted, unless the thread became a client relationship with its own retention terms.
Newsletter subscribers: until you unsubscribe. After that we keep your email on a suppression list so we do not mail you again — that record exists only to honour your opt-out.
Lead-magnet requests: up to 24 months from the download.
IP addresses used for rate limiting: held in the server's memory for minutes, never written to storage.
Analytics: retained by Google under the retention setting configured in GA4, which cannot exceed 14 months for event data.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information; to object to or restrict processing; to withdraw consent you have given; and to opt out of any sale, sharing, or targeted advertising — which, on this site, there is none of to opt out of.

To exercise any of these, email info@citadelcloudmanagement.com or use the contact form. We will answer within the time the applicable law allows, and we may need to verify your identity first. An authorised agent may act for you with proof of authorisation. We will not treat you differently for asking.

Cookies. You can change or withdraw your analytics consent at any time using the Cookie preferences link in the site footer. Withdrawal takes effect immediately and is as easy as giving consent was.

Global Privacy Control. If your browser sends a GPC signal, we treat it as an opt-out for that browser. We do not act on other "Do Not Track" headers, which have no agreed meaning.

Complaints. Tell us first — we would rather fix it. You also have the right to complain to your data protection authority. In the EEA, the list of authorities is published by the EDPB; in the UK it is the ICO.

Children

The site is built for working professionals and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, email us and we will delete it.

International transfers

Citadel operates from the United States and its providers are US-based, so information you send is processed in the United States. Where personal information is transferred out of the UK or EEA, we rely on the European Commission's Standard Contractual Clauses or the UK equivalent, unless the destination has an adequacy decision.

Security

We keep the surface small — no database of visitors, no stored payment details, no accounts to breach — and route data only through the named providers above. No system is perfectly secure, and email in particular is not a confidential channel. Do not send us credentials, health information, or anything else sensitive through the contact form; if an engagement needs that, we will agree a secure channel first.

Earlier storefront

This site previously ran a Shopify storefront. It closed on August 4, 2026, and the site no longer routes anything through Shopify. Shopify still holds data from that period under its own retention schedule; for that data see the Shopify Consumer Privacy Policy and, depending on where you live, the Shopify Privacy Portal.

Changes

We update this policy when our practices or the law change, and we change the "last updated" date above when we do. Material changes are announced on this page.

Contact

Email: info@citadelcloudmanagement.com Phone: +1 347-757-8099 Citadel Cloud Management, Houston, TX, United States