Privacy Policy

Phenominal Consulting is operated by Phenominal LLC, a California limited liability company headquartered in Sacramento, California. Throughout this policy, "Phenominal," "we," "us," and "our" refer to Phenominal LLC.

If you have a question about this policy, contact us at brandon@phenominal.io.

We only collect information when you give it to us, when your browser sends it as part of a normal web request, or when a service we use (Cal.com, Microsoft Clarity) collects it on its own. Each category below maps to a specific feature of the site.

Information you give us directly

Chatbot conversations. If you use the site assistant ("Phenom") in the bottom-right of any page, the messages you type are sent to our server to generate a response. Conversations are not saved in our database. If you choose to leave your email at the end of a chat or submit a callback request through the chatbot, the transcript and any details you provide (name, company, license number, phone, message) are emailed to us.
Booking a call. Our scheduling page is powered by Cal.com. The information you submit there (name, email, phone, time slot, optional notes) is collected by Cal.com and forwarded to us so we can prepare for the call.

Information your browser sends automatically

IP address and user-agent. Your IP address and browser identification string are visible to our server on every request. They are written to our application logs and to email notifications generated by the chatbot transcript and callback features. They are not used to identify you personally and are not sold or shared.
Page and referrer. Standard web-server access logs record which pages you visit and the page that referred you, if any.
Session cookie. The site sets a session cookie to maintain page state and protect against cross-site request forgery. The session record on our server includes your IP address and user-agent and is automatically discarded after 120 minutes of inactivity.

Information collected by services we use

Microsoft Clarity records anonymized session replays of how visitors interact with our pages — clicks, scrolls, mouse movement, and form interaction. We use this to identify usability problems. Clarity sets its own cookies and processes the data on Microsoft's servers under Microsoft's Privacy Statement. We do not combine Clarity data with information you provide directly.
Cal.com hosts our booking flow at cal.phenominal.io. Booking data you enter goes to that Cal.com instance and is then forwarded to us via webhook.

We use the information described above only for these purposes:

To answer your questions and respond to inbound interest, including chatbot transcripts, callback requests, and scheduled calls.
To maintain our records of services rendered to clients we have entered into a written engagement agreement with.
To improve the site — Microsoft Clarity is used to spot friction in our content and forms, and our application logs are used to debug issues.
To meet legal, tax, and accounting obligations associated with running a California business.
To protect the site and the people who use it from abuse — rate limits, signed URLs, and basic security logging.

We do not advertise on this site. We do not sell or rent your personal information to third parties for money. We do not use your information for "behavioral advertising" or to build profiles for ad targeting.

The third-party services that may receive information about you when you use this site are:

Microsoft Corporation (Clarity) — session replay and analytics.
OpenRouter, Inc. — LLM inference for the chatbot. When you send a chatbot message, the text of your message and the recent conversation context are sent to OpenRouter, which routes the request to a model provider (currently free-tier models from Meta, NVIDIA, OpenAI, Google, Qwen, and others, depending on availability). We do not send your IP address, technical identifiers, or session data to OpenRouter. Only the text of the conversation is sent, which means if you type personal information into the chatbot (your email, license number, phone), it travels to OpenRouter with your message.
Cal.com — booking and scheduling. Our Cal.com instance is hosted on infrastructure we control at cal.phenominal.io.
PrivateEmail.com — outbound email delivery for chatbot transcripts and callback requests.

Each of these services has its own privacy practices. We have selected services we believe handle data responsibly, but we cannot make representations on their behalf.

We keep different categories of information for different lengths of time, based on what the information is for.

Chatbot transcripts and callback requests delivered to us by email are kept in our inbox for no more than 60 days unless they relate to a person who has become a client, in which case they are retained as part of that client relationship. We do not store these transcripts in any database; the email is the only copy.
Booking records from Cal.com are retained for the duration of our business relationship with you, plus the period required to meet our legal and accounting obligations.
Application logs (the technical logs our server writes to disk) are retained for up to 30 days unless an active investigation requires keeping them longer.
Sessions are discarded after 120 minutes of inactivity.
Microsoft Clarity retains session replay data under its own retention schedule, which we do not control.

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act ("CCPA/CPRA") give you specific rights regarding the personal information we collect about you:

Right to know. You may ask us to confirm whether we have collected personal information about you and to provide a copy of what we have.
Right to delete. You may ask us to delete personal information we have collected from you, subject to limited exceptions (for example, information we are legally required to retain for tax purposes).
Right to correct. You may ask us to correct inaccurate personal information about you.
Right to limit use of sensitive personal information. We do not knowingly collect sensitive personal information through this site, so this right is generally not engaged.
Right to non-discrimination. We will not penalize you, deny you services, or charge you a different price for exercising any of these rights.

To exercise any of these rights, email us at brandon@phenominal.io with the subject line "Privacy Request." We will respond within 45 days. We may need to verify your identity before fulfilling certain requests; for example, we may ask you to confirm details of a prior interaction with us so we can be sure we are responding to the correct person.

You may also designate an authorized agent to make a request on your behalf, in writing, with proof of authorization.

We do not "sell" personal information for money. We do disclose information to the service providers listed above so that they can perform services for us; under CCPA/CPRA, the use of cross-context tracking technologies like Microsoft Clarity may be considered a "share" of personal information for cross-context behavioral advertising purposes. We do not use Clarity for advertising purposes, and we do not use the information collected by it to target ads.

The California Consumer Privacy Act (Cal. Civ. Code § 1798.140) defines specific categories of personal information. This section maps what phenominal.io collects to those statutory categories. In the prior 12 months, we have collected the following categories of personal information:

Identifiers (§ 1798.140(v)(1)(A)). Name, email address, phone number, IP address, browser user-agent, business name, license number when you provide it.
Internet or other electronic network activity (§ 1798.140(v)(1)(F)). Pages visited, referrer, click and scroll behavior on the marketing site (via Microsoft Clarity), chatbot conversation content, booking interactions on Cal.com.
Professional or employment-related information (§ 1798.140(v)(1)(I)). Information about your role at a licensed California cannabis business, when you provide it through the chatbot, a booking, or in correspondence.
Inferences (§ 1798.140(v)(1)(K)). We do not algorithmically derive predictions or profiles from the information above.

We do not collect the following statutory categories through this site: commercial information (no payment or invoicing is processed through phenominal.io), protected classification characteristics, biometric information, geolocation data beyond approximate region-from-IP, sensory data (audio, visual, thermal), or education information.

For each category collected, the table below shows the sources, purposes, and recipients in the prior 12 months. This is the disclosure required by Cal. Civ. Code § 1798.130(a)(5):

Category	Source	Business purpose	Recipients
Identifiers	Directly from you (chatbot, bookings, email); your browser	Respond to inquiries, prepare for calls, maintain logs	Cal.com, PrivateEmail.com, OpenRouter (text only)
Internet/network activity	Your browser; Microsoft Clarity	Operate the site, debug, improve usability, route chatbot messages	Microsoft Clarity, OpenRouter (chat text only)
Professional information	Directly from you	Assess engagement fit, prepare for calls	Internal only

We retain each category for the periods stated in the Retention section above. We do not sell any category of personal information. We may share Internet/network activity with Microsoft Clarity under the "share" definition of CPRA as described in the Your Privacy Choices section.

California law (CCPA/CPRA) gives you the right to opt out of the "sale" or "share" of your personal information. As stated above, we do not sell personal information for money. We use Microsoft Clarity for product analytics on this site, which under CCPA/CPRA's broader definition of "share" may count as a sharing of personal information for cross-context behavioral analytics, even though we do not use Clarity for advertising.

You have two ways to opt out:

Global Privacy Control (GPC). We honor GPC signals as a valid opt-out request. If your browser or a browser extension is configured to send a GPC signal, we treat that as an opt-out of "sale" and "share" of personal information for your visits, and we disable Clarity for sessions that arrive with the signal. Learn about Global Privacy Control.
Direct request. Email brandon@phenominal.io with the subject line "Do Not Sell or Share My Personal Information." Include the browser you use and, if possible, a recent session timestamp so we can identify your visit data. We will confirm receipt within 15 business days and complete the opt-out within 45 days.

Exercising this right will not change the services we provide you or the price we charge. The right to opt out applies only to information that may be construed as "sold" or "shared" under CCPA/CPRA; information you submit through the chatbot, contact forms, or paid engagements is processed under the purposes described above regardless of opt-out status.

This site is for cannabis distribution operators and the people who work with them. It is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided information to us, contact us and we will delete it.

We use reasonable technical and administrative measures to protect the information we hold:

Encryption in transit (HTTPS) for all pages and form submissions.
Signed, time-limited URLs for sensitive flows.
Server-side session management, CSRF protection, and rate limiting on public endpoints.
Access to administrative records is limited to people who need it to do the work, and is protected by individual user accounts and role-based permissions.

No system is perfectly secure, and we will tell you if we ever discover a security incident that affects your information, in the manner and timeframe required by California law.

We may disclose information we hold about you when required by valid legal process — for example, a subpoena, court order, government request, or other lawful demand from a regulator, law enforcement agency, or court of competent jurisdiction. We will limit any such disclosure to what the legal process actually requires. Where the law allows, we will notify you before complying.

This includes the California Department of Cannabis Control, the California Department of Tax and Fee Administration, the Internal Revenue Service, and other agencies with jurisdiction over our business or yours.

If we make material changes to this policy, we will update the effective date at the top of the page and, where appropriate, notify clients we have an active relationship with by email. Continued use of the site after a change indicates acceptance of the updated policy.

Questions, requests, or complaints about this policy or about our privacy practices should be directed to:

Phenominal LLC
Sacramento, California
brandon@phenominal.io

The operator.

The information that touches this site.

Information you give us directly

Information your browser sends automatically

Information collected by services we use

Purposes.

The third parties we use.

Retention.

Rights of California residents.

Statutory categories and 12-month look-back.

Do not sell or share my personal information.

Not for children.

What we do about it.

Disclosure when law requires it.

If this policy changes.

How to reach us.