Privacy Policy

We explain what personal information we collect, why we use it, who receives it, how long we keep it, and the choices available to you. We aim to collect what we need to deliver our services and protect the people and organizations that use them.

1. Who we are and what this policy covers

Operational ITAM is operated by EpicB Media LLC, a Michigan limited liability company. In this policy, “Operational ITAM,” “we,” “us,” and “our” mean EpicB Media LLC operating this brand. We are responsible for personal information we collect for our own business purposes.

This policy covers our website, inquiries, consulting relationships, free resources, podcast submissions, and, when offered, digital products, subscriptions, customer accounts, training, events, and support. A section about an optional service applies when you use that service; it does not mean every service is currently available. Our principal audiences are professionals and organizations in the United States and Canada.

This policy does not set license rights, prices, refund eligibility, renewal terms, or cancellation deadlines. Those appear in the applicable purchase terms, subscription disclosures, or consulting agreement. It does not replace a client data processing agreement or an employer’s privacy notice. Other EpicB Media LLC brands and third-party sites are covered by their own notices unless they expressly adopt this policy.

2. Information we collect and its sources

We receive information directly from you, from your organization or an authorized purchaser, from the service providers involved in your transaction, and through the website and services you use. Where we receive professional contact information through a referral, event, public professional source, or permitted business-development source, we use it only for an appropriate business purpose and subject to the marketing choices below.

Inquiries and business contacts: name, work email, optional phone number, employer, role, organization size, service interests, technology environment, renewal timing, and the context you choose to share.
Purchases and billing: purchaser and billing contact details, billing address, applicable tax information, products or services purchased, license tier, transaction identifiers, payment status, invoices, subscription dates, and records of refunds, disputes, or cancellation.
Accounts and resource access, when offered: account identifiers, organization affiliation, authentication records, assigned access, accepted terms and consent records, downloads, product versions, access times, and support history. These help us deliver the right materials, maintain access, and investigate misuse.
Consulting and support: correspondence, meeting notes, project records, uploaded materials, and information necessary to perform the agreed engagement. Client datasets may contain personal information; the safeguards in Section 5 apply.
Subscriptions, training, and events: communication preferences, registration and attendance details, submitted questions, and feedback. We provide advance notice before recording or transcribing a session and obtain consent where required; a general inquiry or event registration is not blanket recording consent.
Podcast case files: first name, city or metro area, email, optional role and organization size, situation description, and attribution and permission choices.
Technical and usage information: IP address, browser and device information, referring page, pages requested, timestamps, security events, and limited analytics about interactions with the site. Analytics and embedded services are described in Section 10.

Required fields are identified when information is requested. If you decline information necessary to complete a purchase, verify access, or deliver an engagement, we may be unable to provide that function. Optional marketing choices do not determine whether you can buy from us.

Please do not send passwords, API keys, full payment credentials, government identification documents, health information, or confidential employer materials through general contact forms or podcast submissions. Where a project requires sensitive information, we agree on the purpose and a suitable transfer method first.

3. Why we use information

We use personal information to respond to requests; provide proposals and consulting; process purchases and invoices; deliver downloads and updates; administer accounts, licenses, and subscriptions; provide support; manage events and permitted recordings; communicate service changes; protect against fraud and unauthorized access; keep business and tax records; resolve disputes; and meet applicable legal obligations.

We also use limited usage information to understand and improve our resources and services, and use contact information for marketing only as described below. When possible, we use aggregated or de-identified information that does not reasonably identify a person or client organization. We do not attempt to re-identify information we maintain as de-identified.

4. Payments and subscriptions through Stripe

We use Stripe for payment processing and related billing functions when enabled. When you use a Stripe checkout, invoice payment page, or billing portal, Stripe receives the information needed to process and secure the transaction. This can include contact and billing details, payment credentials, transaction information, and technical or device signals used for fraud prevention and authentication.

We receive transaction and billing records and limited payment-method information, such as card brand and last four digits, as needed to administer the purchase. We do not ask you to send full card details or card security codes by email or through our contact forms. Full payment credentials entered in Stripe-hosted payment fields are handled by Stripe, rather than stored in our website’s own records.

Stripe may act on our instructions for some activities and as an independent controller for others, including certain fraud prevention, legal compliance, and service operations. Its handling of information is explained in the Stripe Privacy Policy. Payment networks, banks, and any payment method you choose also process information under their applicable terms and notices.

For recurring purchases, we retain the subscription and authorization records needed to administer renewals, changes, and cancellation. Canceling a subscription stops future renewals according to the purchase terms; it does not automatically delete invoices, prior transactions, or license records. Deleting a website account is not a substitute for canceling a subscription. Contact us if you need assistance with either action.

5. Consulting data and organizational accounts

In an engagement, a client may give us asset inventories, license or usage records, contracts, spending data, or other operational evidence that contains employee or other personal information. Where we process that information on the client’s behalf, we follow the agreed instructions, confidentiality commitments, and applicable data processing terms. We use the minimum information needed for the engagement and encourage removal of unnecessary identifiers.

We do not use confidential client datasets for unrelated marketing, publish them in examples, or turn them into identifiable case studies without separate authorization. We agree on any approved subcontractors or external processing arrangements through the engagement’s terms. A confidentiality agreement alone does not authorize every possible use of client information.

If your organization purchases access for you, its authorized administrators may receive information necessary to manage its licenses, such as your name, work email, assigned access, and relevant access status. Individual activity reporting, if offered, will be described before use. Requests concerning information controlled by your employer should normally go to that organization; we will assist it as required by our agreement and applicable law.

6. AI-assisted work and automated processing

We may use AI-assisted tools to support research, drafting, organization, or analysis. We do not use identifiable customer information or confidential client materials to train general-purpose AI models, or authorize a provider to do so. Before using an external AI service on confidential client materials, we obtain the client’s authorization and review the service’s data handling, retention, access, and training settings. An engagement may require stricter restrictions, including no external AI processing.

We minimize or de-identify inputs where practical and apply human review to consulting conclusions and deliverables. We do not make decisions producing legal or similarly significant effects on individuals solely through automated processing. Payment providers may use automated fraud checks that affect a transaction. Contact us if a payment or access problem appears to result from an automated check so we can review what is within our control.

If we introduce a customer-facing AI assistant, integrations into a client environment, or another materially different use of personal information, we will provide a specific notice and any required choices before that processing begins. This policy is not permission to repurpose confidential materials for an unspecified future AI service.

7. Podcast contributions and public participation

For Listener Case Files, we honor the attribution and publication choices you make. We remove employer names, vendor names, dollar figures, and other details that could identify an organization before using a case on air. Your email address is not published. Selecting “do not use on air” means we will not broadcast your submission.

Ask to withdraw a submission before publication if you change your mind. We can stop future distribution under our control, but cannot retrieve episodes or materials already downloaded or independently copied. Podcast forms are not a confidential document-review channel. We obtain separate permission before using an identifiable testimonial, client logo, or named case study.

If we later offer discussion areas or interactive events, we will explain which contributions are visible to other participants before you post or participate. Avoid including personal or confidential information you do not want that audience to see.

Access within our business is limited to personnel and authorized contractors who need information for their work. Providers receive information needed for the function they perform and are subject to appropriate contractual or other safeguards. Some providers also process information for their own purposes under their notices.

Our website’s existing provider disclosures identify Formspree for form submissions, GoDaddy for hosting and technical logs, Google Analytics for website measurement, Google Fonts for font delivery, and Transistor for podcast hosting and aggregate listening reports. Stripe supports payments and billing as described above. A browser request to an external font, player, or payment provider can disclose your IP address and technical information to that provider.

Customer accounts and protected downloads are hosted on GoDaddy, which also relays account verification and password-reset messages; Google Workspace supports our business mailboxes. When additional functions are introduced, relevant providers may include customer relationship management, scheduling and conferencing, secure document storage, learning platforms, or support services. We will update this notice or the relevant service notice to identify material new arrangements before they begin. Merely listing a possible provider category here does not mean we have deployed it.

We may disclose relevant information to professional advisers; to banks and payment providers for transactions and disputes; when required by valid legal process; to investigate fraud or protect legal rights and safety; or in connection with a merger, acquisition, financing, or sale of business assets under appropriate confidentiality protections. We give notice of changes to responsibility for personal information when required.

We do not sell or rent personal information or disclose it to data brokers. We do not currently share personal information for cross-context behavioral advertising. Routine disclosure to a provider for a defined service is not permission for that provider to use client information for unrelated advertising.

9. Marketing and business development

Operational ITAM email list. Our direct email list provides practical ITAM, AI governance and FinOps guidance, product updates and offers, up to two emails per week. It is separate from our LinkedIn newsletter. We require a signup request and email confirmation before enrollment. We record your email address, signup and confirmation times, consent wording/version, source and subscription status. A temporary hashed network identifier helps limit abuse. Confirmation links expire after 48 hours; unconfirmed pending addresses and temporary network identifiers are removed after 30 days. We retain minimal consent and suppression records to honor your choices.

Our initial mailing service runs through our GoDaddy-hosted website and mail relay. A confirmed signup notifies the site owner. Marketing emails identify EpicB Media LLC and include an unsubscribe link; unsubscribing stops queued marketing messages without affecting transactional messages. We record outgoing-server acceptance and send failures, but do not use email-open tracking pixels. Replies and delivery-failure notices go to bill@operationalitam.com. Privacy requests go to privacy@operationalitam.com.

We send newsletters and promotional updates when you opt in or when another lawful basis or applicable exception permits the particular communication. A resource download, payment, or account registration does not by itself enroll you in optional marketing. Where consent is required, we request it separately and record it.

You can unsubscribe using the link in a marketing email or contact us directly. We act on requests promptly and within applicable legal deadlines. We retain a minimal suppression record so that we do not add you back unintentionally. Necessary receipts, security notices, service messages, and communications about an active engagement may continue; we do not use that exception to send disguised promotions.

For business outreach, we consider how contact details were obtained, relevance to the person’s role, applicable consent rules, and any restriction or objection. A public work email address or presence on a purchased list is not, by itself, permission for unrestricted contact. We do not currently buy contact lists. Before introducing an external lead-data service, we will review provenance, permitted use, notice, and opt-out requirements and update this policy as needed.

We may promote our services through LinkedIn or other platforms using contextual or platform-selected audiences. The platform’s own privacy notice governs its handling of activity within that platform. If you submit a lead form to us there, we receive the fields and choices shown on that form.

Planned LinkedIn advertising features. We plan to evaluate retargeting, conversion measurement, and Matched Audiences. These features are not currently active on our website. If introduced, a LinkedIn tag or server-side integration could send limited information about visits and selected actions, while audience matching could involve professional contact identifiers such as email addresses. Hashing an identifier does not make it anonymous. We would not send confidential client materials, payment credentials, or sensitive personal information for these purposes.

Before activating those features, we will describe the actual information, recipient, purpose, and choices in an updated notice; establish the appropriate legal basis; and implement required consent and opt-out controls. Some advertising disclosures can constitute “sharing,” “sale,” or targeted advertising under applicable law even without money changing hands. A marketing email opt-in is not automatically permission to upload your details to an advertising audience. Our planning statement here does not authorize tracking or audience uploads.

10. Cookies analytics and embedded services

Our site offers optional Google Analytics 4 page, interaction and purchase measurement linked to Google Ads. It loads only after you select Allow measurement in Cookie preferences; declining does not prevent access to resources or purchases. This helps us understand which ads lead to purchases. With your permission, Google receives browser and ad-click identifiers, device and referral information, pages viewed, product identifiers, order values, currency and a pseudonymous transaction reference for a verified payment. It may use cookies and derive approximate location. Google Signals and advertising personalization are disabled; we do not use this setup for remarketing or customer-list matching. We do not send names, email addresses, payment credentials or confidential client documents in these measurement events. Existing analytics permission does not automatically authorize this expanded purpose: visitors who previously allowed analytics are asked to choose again, while previous declines remain respected.

GoDaddy may add hosting-related traffic measurement, and embedded Transistor players or other external services can receive technical information when loaded. Stripe-hosted payment and billing pages may use cookies or similar technologies for their own functions. Our customer store uses necessary session cookies for authentication, security and account access.

You can manage cookies through your browser and use the Google Analytics opt-out browser add-on. Blocking necessary technologies can prevent sign-in or payments. Browser controls and an analytics add-on are not substitutes for consent where the law requires it.

Where applicable law requires consent before optional technologies operate, we obtain it before activation and provide a way to withdraw it. Where applicable law requires recognition of an opt-out preference signal such as Global Privacy Control, we honor that signal for the relevant processing. Do Not Track and Global Privacy Control are different signals; neither should be assumed to control every third-party service. Our first-party analytics implementation skips loading when a Do Not Track or Global Privacy Control signal is present, even if analytics were previously allowed. Third-party services may respond differently.

We will identify material changes to analytics, advertising, and cookie practices before introducing them. We do not treat continued browsing or acceptance of purchase terms as blanket consent to optional tracking.

11. Cross-border processing

We operate in the United States. Personal information, including information from Canadian customers, may be processed in the United States and other countries where our approved providers operate. It may be accessible to courts, law enforcement, or other authorities under those countries’ laws. We do not promise Canadian-only or province-specific storage unless separately agreed.

We remain responsible for information entrusted to providers as required by applicable law and use appropriate contractual, access, and security safeguards. Where required, we assess transfers, give additional notice, and use recognized transfer mechanisms. For example, processing subject to applicable Québec requirements may require a privacy impact assessment before information is sent outside Québec. We do not rely on acceptance of this policy alone as a universal legal basis for international transfers.

12. How long we keep information

We retain information for its stated purpose, then delete or de-identify it unless a legal obligation, dispute, security need, or documented business requirement justifies retention. The following operating periods are subject to applicable law and the client’s agreement:

Inquiries: during active discussions and generally up to three years after the last meaningful contact.
Marketing: while subscribed, with minimal consent and suppression records retained as needed to demonstrate and honor choices.
Orders, invoices, tax and accounting evidence: generally seven years after the relevant transaction or financial year, adjusted for applicable obligations. We retain only the information needed for those purposes.
Perpetual license evidence: minimal purchaser, license, and transaction-reference records while necessary to recognize the continuing license and resolve related issues. Detailed payment data is not kept indefinitely merely because a license is perpetual.
Accounts and subscriptions: while active and as needed to close the account, provide agreed support, preserve continuing entitlements, and resolve billing or legal issues. We retain raw access logs only for the operational or security period needed, rather than for the full duration of a perpetual license.
Client project data: according to the engagement’s agreed return or deletion schedule. Contract, invoice, and dispute records may be retained separately. We do not assume that an accounting retention period applies to every client dataset.
Podcast case files: generally up to two years; published episodes and necessary permission records may be retained longer.
Analytics and technical logs: Google Analytics user-level data is configured for 14 months under the existing policy; hosting and security logs follow the relevant service’s documented retention settings. Aggregate reports may remain after underlying records are deleted.

Deletion requests are subject to lawful exceptions. We may retain narrowly necessary records for tax, accounting, fraud prevention, legal claims, consent evidence, and suppression. Backup copies may remain until the normal backup cycle expires and are restricted from ordinary use. A payment provider may have its own independent retention duties. We explain relevant limitations when responding to your request.

13. Your choices and requests

Contact us to request access, correction, deletion, a copy of your information, or an end to optional communications. Depending on where you live and which laws apply, you may also have rights to portability, restriction, withdrawal of consent, objection, an appeal, or an opt-out of sale, sharing, targeted advertising, or certain automated processing. We do not charge or discriminate against you for exercising applicable rights.

Send requests to privacy@operationalitam.com with “Privacy request” in the subject, or use the postal address below. You do not need to create an account. We may request proportionate information to verify identity and authority before releasing or deleting records. Please do not send identification documents unless we specifically explain why they are needed and provide a suitable method.

We aim to respond within 30 days and will meet the deadline applicable to your request. If a permitted extension is needed, we explain why and when to expect a response. If we cannot fulfill all or part of a request, we explain the reason and available appeal or complaint route. An authorized agent may act for you where permitted, subject to appropriate verification. You may appeal a decision by replying with “Privacy appeal”; where applicable, we provide the relevant regulator’s complaint information.

14. Additional information for Canada

Where PIPEDA or applicable provincial privacy law governs our activities, we identify appropriate purposes and obtain meaningful consent when required. You may request access and correction, ask about our handling practices, challenge compliance, or withdraw consent subject to legal or contractual restrictions and reasonable notice. We explain any effect on a service before relying on withdrawal to discontinue it.

Canadian commercial electronic messages are subject to applicable CASL consent, identification, and unsubscribe requirements. We do not assume all business-to-business messages are exempt or that a publicly listed email establishes consent. Required promotional consent is separate from the information needed to deliver a purchase.

Our privacy contact coordinates Canadian requests, including requests arising under applicable Alberta, British Columbia, or Québec law. Québec rights may include portability in the circumstances prescribed by law. Cross-border handling is described above. You may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial authority, including the Commission d’accès à l’information du Québec. Contacting us first can help resolve an issue but does not remove your right to contact a regulator.

15. Additional information for United States residents

Applicable U.S. state privacy rights depend on the law, the information involved, and whether our activities meet its coverage requirements. We do not imply that every comprehensive state privacy law applies to our business or to every business-contact record. The categories, sources, purposes, recipients, and retention criteria above describe our processing.

Where applicable, residents may request access, correction, deletion, portability, and the relevant opt-outs or appeal. We do not currently sell personal information or share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about people. If these practices change, we will update notices and implement required choices before the new processing begins. Any required California notice at collection or other supplemental state notice will be provided at the relevant collection point.

16. Visitors in other jurisdictions

When EU or UK data protection law applies, we rely on the legal basis appropriate to the activity: contract for requested services, legal obligation for required records, consent for processing that requires consent, and legitimate interests for proportionate business administration, security, and response to inquiries, subject to your rights. Where we rely on consent, you can withdraw it without affecting the lawfulness of prior processing.

Applicable rights can include access, rectification, erasure, portability, restriction, objection, and complaint to a supervisory authority. You can object to direct marketing at any time. International transfer safeguards and any additional local disclosures will be provided as required. We do not use our North American focus to waive rights that otherwise apply.

17. Security and children

We use reasonable administrative, technical, and organizational measures suited to the information and service, including protected transmission and limiting access. No system is perfectly secure. If an incident triggers notification duties, we notify affected parties or authorities as required. Please contact us promptly about a suspected exposure and avoid placing the exposed information into an ordinary email.

Our services are intended for adult business professionals, not children. We do not knowingly collect personal information from children under 16. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

18. Changes and future services

We update the effective date when this policy changes. For a material change, we provide an appropriate notice, such as a prominent website notice or direct communication to affected customers. Where required, we obtain new consent before using previously collected information for a new purpose. Publication of a revised policy alone does not override prior choices, confidentiality commitments, or applicable law.

New services such as memberships, training, integrations, communities, or AI tools may have additional notices. Those notices explain the relevant collection before it occurs. We do not collect information merely because it might be useful in a future business scenario.

19. Contact us

Privacy contact — EpicB Media LLC, operating as Operational ITAM
privacy@operationalitam.com
35339 23 Mile RD, PO BOX 112
New Baltimore, MI 48047, United States

Please identify the service or interaction involved so we can route your request appropriately.