A short, plain-English statement of what Rubric Advisory collects, why, who processes it, and what you can ask us to do with it. Written to reflect how the practice actually operates. Last updated August 2026.
This policy covers information collected by Rubric Advisory ("Rubric", "we", "us") when you visit rubricadvisory.com, submit the contact form, or write to us at an @rubricadvisory.com address. It does not cover data governed by a signed engagement letter with a client; that is handled under the terms of the engagement.
From the contact form: the name, email address, organisation (optional) and message you submit. Nothing else.
From email to us: whatever you choose to send.
From the website itself: standard server access logs (IP address, user-agent, timestamps, referring URL) collected by our hosting provider for operational and security purposes.
Cookies and tracking: the site loads Google Fonts (fonts only, no cookies). It may load a Google Ads conversion tag when campaigns are active, which drops a first-party cookie used only to measure whether a paid ad led to a Connect click. No third-party advertising cookies. No cross-site tracking pixels. No analytics beyond what Google Ads requires.
To respond to your enquiry. To keep basic records of who has written to us so we do not lose thread of a conversation. To secure the site against abuse. To measure whether paid advertising campaigns are reaching the intended audience. Nothing else.
We do not sell personal information. We do not share it with advertisers. We do not use it to build profiles.
The site and its supporting services run on a small set of vendors. Each holds only the minimum data needed to do its job:
Each vendor operates under its own privacy commitments. If you would like the current list of processors and their privacy statements, write to privacy@rubricadvisory.com.
Contact-form emails and correspondence are kept for as long as they are useful to the ongoing relationship. If we have not spoken in five years and there is no active or pending engagement, we delete on request or as part of periodic housekeeping.
Server access logs are retained by our hosting provider on their standard schedule (typically 30 days).
Our hosting and email vendors run infrastructure primarily in the United States and European Union. Data submitted through the site may be processed in either region depending on how requests are routed. Data collected in the course of a paid engagement is subject to whatever residency requirements are agreed in the engagement letter, and may be deleted at engagement end at the client's request.
You may write to privacy@rubricadvisory.com at any time to:
If you are a California resident, you have the rights described in the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete and correct, and the right to opt out of the sale or sharing of personal information. Rubric does not sell or share personal information for advertising purposes.
If you are in the European Economic Area or the United Kingdom, we handle your personal data in a manner consistent with the GDPR / UK GDPR: lawful basis is legitimate interest (responding to your enquiry) or consent (where applicable).
The site is served over HTTPS. Contact-form submissions are transmitted over TLS. The destination mailbox is protected by authentication managed by our email host. We use reasonable technical and organisational measures to protect the information we hold. No internet system is perfectly secure, and we make no guarantee against determined adversaries.
This site is not directed at anyone under 16. We do not knowingly collect personal information from children.
We may update this policy from time to time. Material changes will be noted on this page with a revised "last updated" date at the top. Continued use of the site after a change means you accept the updated policy.
Questions about this policy or requests about your data go to privacy@rubricadvisory.com. We aim to respond within a working week.