Privacy Policy — what this website does with your data

This policy covers onealgorithm.com, including the blog at /blog, and the social-media comment and message handling described in its own section. It is written by ONE ALGORITHM LLC (OneAlgorithm), a company registered in Pennsylvania, United States. It describes what this website actually does — not what a privacy policy usually says.

The short version

What happens when you use the contact form

The contact form is the only place on this site where you type anything about yourself. It asks for six things:

• First name
• Last name
• Email address
• Company name
• What you need — a service picked from a list
• A free-text message

Before it sends, the form runs two anti-spam checks. The first is a hidden field that people never see and automated scripts fill in — if it has a value, the submission is discarded in your browser and nothing is sent anywhere. The second is Cloudflare Turnstile. Your browser loads a small script from Cloudflare (only on the contact page, nowhere else on the site) and sends Cloudflare a token along with technical signals about the browser itself. Cloudflare checks it and tells us pass or fail. We receive only that answer, never the underlying signals. Cloudflare states that Turnstile does not use this data to track individuals or to target advertising.

When you press send, your browser posts the six fields and that token to /api/lead on this domain — our own code, running on Cloudflare's network. It confirms the token with Cloudflare, which involves sending Cloudflare your IP address so the token can be tied to the browser that solved it. If the check passes, our code forwards your details to Salesforce Web-to-Lead.

That forwarding happens server to server, so Salesforce receives what you typed but not your IP address and not the page you were reading. The result is a Lead record in our Salesforce CRM. We use it to reply to you, to work out whether we can help, and to keep track of the conversation if one follows. If you are in the EU or UK, the legal basis is taking steps at your request before entering a contract, together with our legitimate interest in answering enquiries about our own services and in keeping the form free of spam.

You can also just email or call us. Those arrive in our normal company email and phone systems (Microsoft 365) and are kept like any other business correspondence.

What we collect when you are just reading

This site is hosted on Cloudflare Pages, and every request to it passes through Cloudflare's network. As with any web host, that produces a server-side record containing your IP address, the page you asked for, the time, your browser and operating system, and the page that referred you. Cloudflare also uses this to tell automated traffic from real visitors and to absorb attacks, and it may set a cookie of its own for that purpose. We rely on our legitimate interest in keeping the site up and secure. Cloudflare Web Analytics also counts page views for us; it is cookieless and does not track you across sites.

We do not have a login, a shopping basket, or any feature that builds a profile of you across visits.

Cookies and analytics

We use Google Analytics 4 (measurement ID G-RC48CMQ05T). It loads from Google's servers and sets cookies in your browser. It records which pages you look at, how long for, where you arrived from, your device and browser, and an approximate location that Google derives from your IP address.

Analytics loads when the page loads. If your browser sends a Global Privacy Control signal, nothing from Google or Microsoft Clarity loads at all. You can also turn analytics off on this site:

Turn off analytics on this site

We also send Google three specific events:

• You submitted the contact form.
• You tapped the phone number.
• You tapped the email address.

Each carries which of the three it was and the address of the page you were on. None of them carries your name, your email address, or anything you typed into the form. Analytics only runs on onealgorithm.com and www.onealgorithm.com — preview and staging copies of this site are silent.

There is no cookie banner on this site, so these cookies are set when the page loads. Besides the button above, you can install the Google Analytics Opt-out Browser Add-on, block cookies for this site in your browser settings, or turn on your browser's tracking protection. Nothing on this site stops working if you do.

The map and the blog

The map. Our contact page embeds a Google Maps frame showing our Malvern office. It only loads if you scroll down far enough to reach it. When it does, your browser connects to Google, which means Google receives your IP address and the fact that you were on our contact page, and may set its own cookies. If you never scroll to the map, none of that happens.

The blog. Our blog at /blog is a separate application built on Ghost, served under this domain through Cloudflare. It keeps its own server logs and sets its own cookies, and if you sign up there to get posts by email, it stores the address you give it. Unsubscribe links are in every email it sends.

Instagram and Facebook comments and messages we handle for clients

Some businesses hire us to answer comments and messages on their own Instagram, Facebook and other social accounts. When you comment on, or message, one of those business accounts, our app (OA BPO Connector Hub) receives the following through the platform's official API (Meta, and where a client uses them, Google or TikTok):

• your public comment, the post it was on, and the time;
• your public username or name, and the account ID the platform gives our app for you;
• the public reply we post under your comment;
• any private reply we send you, and any direct message you send the business.

We handle this on behalf of that business, our client, and use it only to reply for them: a public reply under your comment and, if you asked about buying or price, one private message with a link to the business's website or order form. We send at most one private message per comment, within 7 days, and nothing more unless you reply. We do not use this data for advertising, do not sell or share it, and do not combine it with other data about you. The business can see these conversations.

Who processes it. The app runs on Railway (hosting and database) and Cloudflare (network). To decide whether a comment needs a reply and to draft it, the comment text is sent to an AI model through OpenRouter. The data arrives from, and replies go back through, the platform's own API — Meta (Instagram and Facebook), Google or TikTok — whose handling of your data is covered by its own privacy policy.

How long we keep it. We keep comment and message records for up to 12 months, so we never reply twice and can show the business what was said, then delete them. To have yours deleted sooner, follow the steps in How to request deletion of your data.

How to request deletion of your data

If you commented on, or messaged, an Instagram or Facebook account that One Algorithm manages for a business, you can have every record we hold about you deleted. These are the user data deletion instructions for our app, OA BPO Connector Hub.

What we delete.

• your comments and the time they were posted;
• your username or name and the account ID the platform gave our app;
• our public replies and private replies to you, and any messages you sent;
• any notes or classifications attached to those records.

How long it takes. We delete your records from our systems within 30 days of your request and confirm by email when it is done.

Removing our app through Facebook. Go to Facebook Settings & Privacy > Settings > Apps and Websites, find OA BPO Connector Hub and select Remove. To have the data we already hold deleted, email us as described above.

What this does not delete. Deleting your data from our systems does not remove comments you posted publicly on Instagram or Facebook. Delete those in the app itself. Meta's own handling of your data is covered by Meta's privacy policy.

Who else sees your information

We do not sell or rent your information. These are the companies that handle it on our behalf, and what each one gets:

• Salesforce — everything you type into the contact form, but not your IP address and not the page you submitted from. It is our CRM.
• Google — analytics about your visit, and, if you scroll to the map on the contact page, the request that loads it.
• Cloudflare — every request to this site, as our host and network provider; the Turnstile bot check, including your IP address; and the form endpoint that passes your enquiry to Salesforce.
• Ghost — anything you do on the blog, including a subscription email address if you give one.
• Microsoft — email and calls you send us directly, because our company email runs on Microsoft 365; and, unless you turned analytics off, how you used the page, through Microsoft Clarity. Clarity passes what it collects to Microsoft's advertising network as well as to us.
• Railway and OpenRouter — social-media comments and messages we handle for clients, as set out in that section.

Beyond those, we will disclose information if the law requires it, if we need to defend our legal rights, or if the business is sold or merged — in which case the buyer inherits this policy until they publish their own. Anything else needs your say-so.

What this site does not do

• We do not sell or rent personal information, and we never have.
• There are no advertising or social pixels on this site — no Meta, no LinkedIn, no TikTok, no retargeting tags.
• There is no chat widget watching what you type, and no tool that records anything you enter into a form. We do use Microsoft Clarity, which replays how a page was used — where a visit scrolled to, what got clicked — and it masks the text of form fields. Turn analytics off above, or send Global Privacy Control, and it never loads.
• Our fonts are served from this domain, not from Google Fonts, so reading the site does not send your IP address to a font provider.
• This site is not aimed at children, and we do not knowingly collect information from anyone under 13. If you believe a child has sent us something, email us and we will delete it.

How long we keep it

We have not set a fixed retention schedule. Enquiries stay in our Salesforce CRM until we delete them, because a business enquiry can turn into a live conversation years later. Analytics data is kept for as long as the retention setting on our Google Analytics property allows, which Google enforces. Cloudflare and Ghost keep their logs on their own schedules.

We would rather tell you that a period is undefined than print a number we do not actually enforce. If you want your record removed, ask and we will remove it.

Your rights, and how to use them

Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Email [email protected] with "Privacy request" in the subject line and tell us what you want. We may need to ask a question or two to confirm you are the person the record is about. We do not charge for this, and asking will not change how we treat you.

If you are in California

Under the CCPA as amended by the CPRA, the categories of personal information this site collects are identifiers (name, email address, employer, IP address), internet activity (pages viewed, referrer), approximate geolocation derived from your IP address, and whatever you choose to write in the message box. It comes from you directly, or from your browser as you use the site. We collect it to respond to enquiries, provide our services, keep the site working, and meet legal obligations.

You have the right to know what we have collected, to have it deleted, to have it corrected, and not to be discriminated against for asking. You may use an authorised agent. We do not sell personal information, and we do not share it for cross-context behavioural advertising — this site runs no advertising tags. We do not use or disclose sensitive personal information beyond what is needed to provide what you asked for.

If you are in the EU or the UK

We are a US company and we do not have an establishment in the EU or UK, but if the GDPR or UK GDPR applies to you: our legal bases are your request and our legitimate interests, as set out in each section above. You have the right to access, correct, erase, restrict, port, or object to our processing of your data, and to complain to your national data protection authority or, in the UK, the Information Commissioner's Office.

Be aware that this website is hosted in the United States and every processor named above is a US company, so your data is transferred to and stored in the United States.

We are not going to claim a certification or a compliance framework we do not hold. This policy describes what we do; it is not a statement that we have been audited against any standard.

If you are in Canada, the UAE, or India

We work in those countries, but this website and everything it collects sit in the United States. Local law may give you rights beyond the ones above; if it does, ask us using the same email address and we will deal with your request on the same terms.

Security

The site is served only over HTTPS, with HSTS, a strict referrer policy, and headers that stop it being framed by another site. The contact form travels over encrypted connections the whole way, and the bot check that guards it is verified by our own server rather than in your browser, where anyone could skip it. Access to the CRM is limited to people at this company who need it.

No website can promise perfect security, and we are not going to. The contact form is a normal business enquiry channel: please do not send us passwords, payment details, classified or controlled unclassified information, or anything else you would not put in an ordinary email.

Changes to this policy

If we change what this site does with data, we change this page and move the "Last updated" date at the top. There is no mailing list for policy changes, so the date is the thing to check. Material changes take effect when they are published here.

This version was published on October 13, 2026.

How to reach us

Privacy questions, or a request to see or delete your data, go to the same place as everything else:

Our Terms & Conditions cover the rest of your use of this site.