Privacy policy.

This policy applies to everyone who visits https://www.institutionalmodels.com — clients, prospective clients, and any other visitor. It governs any information we obtain in connection with a visit or interaction with the site, and how we use it.

Our engagement letters and non-disclosure agreements govern information exchanged during an active engagement. This policy applies to the website itself.

We honor the privacy and data-protection rights available to you under the laws of the state, country, or other jurisdiction in which you reside — including, where applicable, the EU and UK General Data Protection Regulations, the California Consumer Privacy Act, Canada's PIPEDA, and equivalent frameworks elsewhere. Where two frameworks differ, we apply whichever is more protective of you.

We collect only the information you choose to share through our forms — typically your name, work email, firm, and role. When you submit a form, we also record the submission's IP address and browser user-agent solely to prevent abuse (spam, rate-limit violations).

Anonymous, aggregated analytics may be collected via Google Analytics if you accept the on-page notice. Declining that notice suppresses analytics for the session.

We use your information to respond to your inquiries, deliver materials you request, and — only where we reasonably believe the content is of professional interest to you — occasionally share related publications or updates. We do not send generic marketing.

We do not sell, rent, distribute, license, or share your information — whether identifying you individually or in aggregated or anonymized form — with any outside party for their own use, including data brokers, advertising networks, and analytics resellers.

The only third parties we rely on are the infrastructure services required to run the site and honor your requests: hosting (Vercel), transactional email delivery (Resend), and database and file storage (Supabase). These providers process data solely on our behalf under their own contractual and regulatory obligations. Everything they store is accessible only to the practice principal through server-only credentials.

You may ask us at any time to delete records we hold about you, remove you from mailing lists, or provide a copy of the information we have. We strive to make these requests as effortless as possible:

— A one-line reply to any email you have received from us saying “unsubscribe” or “delete my data” is sufficient. We honor it.

— The contact form on this website is a second, always-available channel.

We act on these requests promptly, and we confirm completion.

We retain records only as long as they remain useful to the relationship they document — typically the duration of an active or prospective engagement, plus a reasonable period thereafter for record-keeping. Records are removed sooner on your request.

This site sets no marketing or advertising cookies. Analytics cookies are set only after you accept the on-page notice.

This site is directed at institutional professionals and is not intended for children under 16. We do not knowingly collect information from children.

We may update this policy from time to time. Material changes will be noted at the top of this page with a revised effective date.