Privacy Policy

1. Scope

This policy covers trailrangebrands.com. It explains what personal information the site collects, what happens to it, and what you can ask us to do about it. It does not cover Trail Range Grid, the internal operations tool, beyond the request that asks for access to it.

The site is a set of static pages with one connected form: the Grid access request. Everything else on the site transmits nothing. The general inquiry form on the contact page has no destination approved and stores nothing, and it says so on screen when you press the button.

2. Information we collect

From the Grid access request. These are the fields the form asks for and the exact columns the record holds:

• Your name.
• Your business email address. Addresses at consumer providers are refused by the form.
• Your phone number, stored exactly as you type it.
• The organisation you are asking on behalf of.
• Which kind of access you asked for — employee or partner.
• What you wrote in the box asking what you need Grid for. Whatever you put there is what is stored; please do not put confidential or proprietary information in it.
• The consent record: the moment you ticked the box agreeing to the Terms of Use and this Policy, and the revision identifier of the documents you were shown. Consent that is taken and not stored cannot be shown later, which is the only reason to ask for it.
• Whether a member of Trail Range staff entered the request on your behalf, and which one. For a request sent through this form that is empty, and its emptiness is what marks the request as having come from the public form.

What the record gains afterwards. As a member of staff handles it, the same row records its state, who picked it up and when, who decided it and when, the reason if it was refused, and — if it was approved and carried out — which staff record was created and when. It also records which partner organisation on file it was matched to, if any, and the times the row was created and last changed.

What the site collects on its own. Nothing. There is no analytics software, no advertising tracker, no session recording, no fingerprinting and no third-party marketing pixel on any page, and the site sets no cookies.

What the infrastructure sees. Our hosting provider processes technical request data — IP address, browser user agent, requested URL — in order to serve pages and protect against abuse, as any web host does. Trail Range does not query or retain that data for its own purposes.

3. How we use it

• To read, review and decide your request for access to Trail Range Grid.
• To contact you about that request, using the address and number you gave.
• To create a staff record if the request is approved and carried out.
• To keep a record of the decision, including the reason for a refusal — a refusal without a recorded reason is indistinguishable from a request that was lost.
• To show, if it is ever asked, that consent was given and to which revision of these documents.

4. Legal bases and consent

Where a legal basis is required, we rely on: steps taken at your request before entering into a relationship (you asked for access and we have to read it to answer); our legitimate interest in controlling who can see internal operations records; and your consent, which you give by ticking the box on the request form and which is recorded with the revision identifier of the documents shown to you.

The box is never pre-ticked and the form will not send without it. You can withdraw consent as described in section 10 — withdrawing it does not undo a decision already made, and we will say so plainly rather than implying otherwise.

5. How we share it

We do not sell personal information and we do not share it for anyone else’s marketing. Two providers process it because they run the infrastructure:

• Supabase — the database that holds the request, its decision and the consent record.
• Vercel — hosting for this website, which processes request data as described in section 2.

Inside Trail Range, a request is readable by staff and by nobody else — including you. The public website has permission to write a request and no permission to read one, so nothing on this site can display a request back to a visitor.

6. Cookies

This site sets no cookies and uses no local storage for tracking. There is nothing to consent to and no banner, because there is nothing to ask about. If that ever changes we will update this policy before it does, not after.

7. Marketing communications

There is no marketing list on this site and no newsletter. Nothing you submit is used to market to you, and there is no subscription to opt out of. If you send a Grid access request, the only contact you should expect is about that request.

8. Data retention

No retention period has been set. That decision has not been made, and publishing a number that nothing enforces would be worse than saying so. Requests are kept until a retention policy is issued and published here.

Two things are already true and will survive whatever that policy says. A request that has not been decided can be removed. A request that has been approved or refused cannot be deleted — the database refuses it — because a decision that can be erased is indistinguishable from a request that was never received, and the person who asked has no way to tell those apart either.

There is no self-service deletion tool and no automated erasure schedule. Removal is performed by a person, and section 10 says how to ask.

9. Machine learning — planned, and not yet running

Nothing on this list is in operation today. No behavioural model exists, none is being trained, and no interaction with Trail Range or Grid is currently being analysed by one. This section is written now, before the first model, for the same reason the rest of this document is: a disclosure that arrives after the capability is a disclosure nobody could act on.

What is planned. Trail Range intends to use machine learning to learn from how the platform is used and to make it work better. The input would be interaction with the platform itself — which pages and records are opened, which searches and filters are run, what a signed-in Grid user does and when. It would be used to order queues sensibly, surface the record somebody is probably looking for, and show where the tool is slow or confusing.

What it would not do. It would not be built on advertising trackers or third-party pixels, because there are none and none are planned. No profile would be sold, shared or handed to anyone for their own purposes. Nothing on this public website feeds it: there is no analytics on these pages at all.

The commitment that matters, and it is not general. Grid contains an access approval workflow, so a model influencing who is admitted would be an automated decision about a person with a real effect on them. That is refused outright: an access request is decided by a person. A model may order the review queue or put a signal in front of a reviewer; it does not approve, does not refuse, and does not decide anything by itself. The database enforces it rather than trusting the promise — a decision on a request can only be recorded against the account of an administrator who made it, and there is no path by which an automated process can sign one.

Two things that follow. You may object to behavioural analysis, and you may ask for a human explanation of a decision that affected you — including why an access request was refused. Both go through the route in section 12; neither requires a form that does not exist.

This policy will be updated before any behavioural model is put into operation, and the revision identifier will change so that a consent record made under this version cannot be read as agreement to a later one.

10. Your rights

Depending on where you live, you may have the right to ask what personal information we hold about you, to have it corrected, to ask for it to be deleted, to receive a copy, to object to certain processing, and not to be discriminated against for asking.

To exercise any of them, send it through the Grid access request form and say what you are asking for. It is the only route on this site that reaches anybody, and it arrives in the same reviewed queue a person reads.

One limit, stated rather than buried: a decided request cannot be deleted, for the reason in section 8. If you ask us to delete one, we will tell you that it is retained and why, instead of quietly not doing it.

11. Security, children, and visitors outside the United States

Security. Information travels over TLS and is held in a database where access is decided row by row: a request is readable only by an active Trail Range staff record, enforced by the database rather than by the application asking nicely. No method of transmission or storage is completely secure and we do not claim otherwise.

Children. This is a business-to-business site. It is not directed to children, and we do not knowingly collect information from anyone under 13.

Outside the United States. This site and its database are operated and hosted in the United States. If you submit a request from elsewhere, it is processed there, under laws that may differ from your own.

12. Changes and contact

Substantive changes are published on this page and the revision identifier above changes with them, so a consent record can always name the version it was given under. Someone who agreed before a section existed did not agree to it.

Questions about this policy, about information we hold, or about a decision that affected you: send them through the Grid access request form, which is the connected route. Trail Range has not published a contact address for privacy matters, and pointing you at one that does not exist would be worse than saying so.