Privacy policy
How BASH Consulting collects, uses, and protects information from visitors and clients across bash-365.com and our consulting engagements
Estimated reading time: 11 minutes
Table of Contents
Who we are and what this policy covers
BASH Consulting LLC (“BASH Consulting”, and “BASH” after this) is an independent information technology (IT) consultancy in Denver, Colorado. This policy explains what we collect when you visit our website at https://bash-365.com, when you get in touch through our contact page, and when you work with us on a consulting engagement — and the choices you have over that information. It is written for both site visitors and clients.
This is the policy for our own website and practice. It is not legal advice, and it does not describe how any third-party site we link to handles your data.
What we collect and why
We keep collection to what the site actually needs. Here is everything the site does today, described plainly.
Website analytics
We use one analytics tool, PostHog, and only on the production site (bash-365.com) — never on our local development builds. We have removed Google Analytics and Google Tag Manager, so the site no longer loads any Google tracking.
PostHog is a product-analytics tool hosted on PostHog US Cloud (us.i.posthog.com). It is off by default: it collects nothing until you opt in through the cookie banner (see “Cookies and similar technologies”), and it does not load at all if your browser sends a Global Privacy Control (GPC) or Do Not Track signal. Once you opt in, PostHog records pageviews, page-leave events, and automatically captured interactions such as clicks and form submissions. It also records specific events we have turned on: file downloads (file name and page), clicks on links that lead off our site (link text and destination), site-search terms you type, how far down a page you scroll, and clicks on the table of contents, the sidebar navigation, and code blocks. Each event also carries technical context such as your browser’s user-agent string, your screen and viewport size, and details about the page you were on. PostHog stores an anonymous identifier in a first-party cookie and in your browser’s local storage. Session recording (screen replay) is turned off. Internet Protocol (IP) anonymization is turned on and IP-based geolocation is disabled, so PostHog does not store your IP address or use it to determine your location. PostHog only builds a person profile for identified users, and we do not identify visitors, so you stay anonymous to us unless you tell us who you are — for example, by emailing us.
Contact and newsletter forms
Our contact page offers a form for your name, email address, and a message. Our newsletter sign-up asks only for an email address. Right now, both forms are unconfigured: instead of sending data to a form service, they open a pre-addressed message in your own email program (addressed to info@bashconsultants.com). Nothing is posted to a third-party server — you send us an email directly, and we receive whatever you choose to write. The contact page also lists our email and phone number so you can reach us without a form at all.
If we later connect a form service (for example, Formspree), we will update this policy to name it and describe what it receives. When you email or call us, we keep your message and contact details so we can reply and manage our work with you.
The AI chat assistant
The site’s configuration includes an artificial intelligence (AI) chat assistant, but it is not active today. The production site is hosted on GitHub Pages, which has no server component, so the chat backend does not run and the widget shows nothing. No chat data is collected.
If we enable the assistant in the future, here is what would happen, so there are no surprises. The messages you type, along with the content of the page you are viewing, would be sent to Anthropic (the maker of Claude) through our own server so it can generate a reply. That server would use a credential we hold privately; it would not send the credential to your browser, and it would not log your message content. We will update this policy before turning the assistant on.
Hosting
The site is served by GitHub Pages, a service of GitHub, Inc. Like any web host, GitHub receives the requests your browser makes — including your IP address — as a normal part of delivering the pages, and it may keep server access logs. The site is served at bash-365.com, with bashconsultants.com kept as a mirror.
Cookies and similar technologies
We use a small number of first-party cookies and browser-storage entries:
- A PostHog cookie plus local-storage entries that hold an anonymous analytics identifier, set only after you opt in.
- A local-storage entry that records your cookie-consent choice for 365 days.
- A local-storage entry that remembers your light or dark theme preference. This one does no tracking.
A consent banner appears on the site with “Accept all” and “Reject all” options and a preferences panel offering three categories: Essential, Analytics, and Marketing. Analytics is off by default, so PostHog — the only analytics on the site — collects nothing unless you opt in, by choosing “Accept all” or turning on the Analytics category. If your browser sends a Global Privacy Control or Do Not Track signal, PostHog does not load at all, whatever the banner shows. The Marketing category is present but unused. Your choice is saved in your browser for 365 days; clear it, or choose “Reject all,” to withdraw consent.
Do Not Track and Global Privacy Control
If your browser sends a Do Not Track or a Global Privacy Control (GPC) signal, PostHog does not load or collect anything. Because we have removed Google tracking, there is no other analytics to opt out of.
How we use information
We use the information above to:
- operate, maintain, and improve the website, and understand which content is helpful;
- respond to your questions and requests, and send the newsletter updates you ask for;
- deliver and manage consulting work for our clients; and
- keep the site secure and prevent abuse.
We do not sell your personal information for money or other payment, and we do not use it to serve advertising.
Client information during engagements
When we work with a client, we handle the systems and data involved in that engagement only to do the work, and only as agreed in our contract. We do not use client data for our own purposes or share it beyond what the engagement requires. Some clients operate under regulations such as the Health Insurance Portability and Accountability Act (HIPAA), the Payment Card Industry Data Security Standard (PCI DSS), or System and Organization Controls 2 (SOC 2) reporting; where that is the case, we work within what those frameworks require for the data we touch. We do not claim to be certified, accredited, or audited under any of them — we set out how we handle your data in the engagement agreement.
Service providers we rely on
We share information only with the providers that make the site and our practice work, and only for that purpose:
- PostHog — product analytics, on PostHog US Cloud. This is the only analytics provider we use.
- GitHub — hosting the site on GitHub Pages.
- Anthropic — only if the AI chat assistant is enabled in the future, and only for the messages and page content described above.
- jsDelivr — a content-delivery network (CDN) that serves one small utility script on an internal settings page.
- An email or form provider — only if we connect one to the contact or newsletter form; today those forms simply open your own email program.
Each provider handles data under its own terms and privacy policy. We also publish our blog posts to our LinkedIn company page, but that publishing runs from our own systems, not from your browser, so it collects nothing about your visit. Our footer links out to LinkedIn, YouTube, and other sites; following those links takes you to services with their own policies.
How information is shared
We do not sell your personal information for money or other payment, and we do not disclose it for cross-context behavioral advertising (targeting you with ads as you move across other websites) or share it for anyone else’s marketing. We share information only with the service providers listed above, when we are required to by law, or to protect the security and rights of BASH Consulting, our clients, or the public. The analytics described above involves data transfers that some privacy laws may treat as a “sale” or “share”; you can limit it with the opt-outs under “Your choices and rights.” If our practice is ever reorganized or its assets transferred, information may move as part of that change, subject to this policy.
How long we keep information
We keep emails and client records as long as we need them to do our work and meet our business and legal obligations, and no longer than necessary after that. Analytics events are stored by PostHog under our project plan’s retention settings; we minimize what we collect — IP addresses are anonymized and analytics run only after you opt in — and you can ask us to delete data about you at any time. Your cookie-consent choice stays in your browser for 365 days.
Your choices and rights
You can limit what is collected:
- Use the cookie banner — choose “Reject all” or leave the Analytics category off — to keep PostHog off. It is off until you opt in.
- Turn on Do Not Track or Global Privacy Control in your browser; PostHog will not load.
- Block or clear cookies and local storage in your browser to remove the analytics identifier.
- Email us and ask us to help you opt out, or to delete a message you sent us.
Depending on where you live, privacy laws may give you more rights. The European Union’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and — because we are based in Colorado — the Colorado Privacy Act (CPA) generally let you ask what personal information a business holds about you, request corrections, request deletion, and receive a copy of your information in a portable form. Under the CCPA/CPRA and the CPA, you can also opt out of the sale or sharing of personal information, of targeted advertising, and of profiling. The CPA also asks Colorado businesses to honor universal opt-out signals such as Global Privacy Control (GPC); our site honors both GPC and Do Not Track by not loading PostHog when either signal is present.
We will honor requests like these from anyone who asks, wherever you live, to the extent we can reasonably identify the information. To make a request, email our team at info@bashconsultants.com. We may need to confirm your identity before we act. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right. If we deny a request, you may appeal by replying to that email, and we will tell you the outcome.
Security
We take reasonable measures to protect the information we hold, and we rely on established providers — PostHog, GitHub, and, if it is enabled, Anthropic — that maintain their own security programs. No website or method of transmission over the internet is completely secure, so we cannot promise absolute security. If you need to send us sensitive details, ask first and we will arrange a suitable method.
Children’s privacy
The site and our services are meant for businesses and are not directed to children under 13. We do not knowingly collect information from children. If you believe a child has given us information, email our team and we will delete it.
International visitors
We operate from the United States. Depending on the provider, your information may be processed in the United States or in other countries: PostHog processes data on PostHog US Cloud in the United States, and our content-delivery network runs global infrastructure. If you visit from outside the United States, your information is processed in the United States and possibly elsewhere, where privacy laws may differ from those where you live. Where the GDPR applies, we rely on our legitimate interest in understanding and securing the site for analytics, on your consent where it is required, and on our contract with you for client work; transfers out of your country rely on our providers’ own transfer terms.
Changes to this policy
We may update this policy as the site and our practice change — for example, if we connect a form service or enable the AI chat assistant. When we do, we will revise the date shown below, and material changes will appear here on this page.
Contact us
To ask about this policy or make a request about your data, email our team. You can also call us at (720) 352-4641 or write to BASH Consulting LLC in Denver, Colorado. Amr Abdel-Motaleb, our founder and principal consultant, handles privacy requests.
Last updated July 9, 2026.